net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #include <net/bluetooth/sco.h>
  38 #endif
  39
  40 #include "hci_request.h"
  41 #include "smp.h"
  42 #include "mgmt_util.h"
  43 #include "mgmt_config.h"
  44 #include "msft.h"
  45
  46 #define MGMT_VERSION    1
  47 #define MGMT_REVISION   21
  48
  49 static const u16 mgmt_commands[] = {
  50         MGMT_OP_READ_INDEX_LIST,
  51         MGMT_OP_READ_INFO,
  52         MGMT_OP_SET_POWERED,
  53         MGMT_OP_SET_DISCOVERABLE,
  54         MGMT_OP_SET_CONNECTABLE,
  55         MGMT_OP_SET_FAST_CONNECTABLE,
  56         MGMT_OP_SET_BONDABLE,
  57         MGMT_OP_SET_LINK_SECURITY,
  58         MGMT_OP_SET_SSP,
  59         MGMT_OP_SET_HS,
  60         MGMT_OP_SET_LE,
  61         MGMT_OP_SET_DEV_CLASS,
  62         MGMT_OP_SET_LOCAL_NAME,
  63         MGMT_OP_ADD_UUID,
  64         MGMT_OP_REMOVE_UUID,
  65         MGMT_OP_LOAD_LINK_KEYS,
  66         MGMT_OP_LOAD_LONG_TERM_KEYS,
  67         MGMT_OP_DISCONNECT,
  68         MGMT_OP_GET_CONNECTIONS,
  69         MGMT_OP_PIN_CODE_REPLY,
  70         MGMT_OP_PIN_CODE_NEG_REPLY,
  71         MGMT_OP_SET_IO_CAPABILITY,
  72         MGMT_OP_PAIR_DEVICE,
  73         MGMT_OP_CANCEL_PAIR_DEVICE,
  74         MGMT_OP_UNPAIR_DEVICE,
  75         MGMT_OP_USER_CONFIRM_REPLY,
  76         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  77         MGMT_OP_USER_PASSKEY_REPLY,
  78         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  79         MGMT_OP_READ_LOCAL_OOB_DATA,
  80         MGMT_OP_ADD_REMOTE_OOB_DATA,
  81         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  82         MGMT_OP_START_DISCOVERY,
  83         MGMT_OP_STOP_DISCOVERY,
  84         MGMT_OP_CONFIRM_NAME,
  85         MGMT_OP_BLOCK_DEVICE,
  86         MGMT_OP_UNBLOCK_DEVICE,
  87         MGMT_OP_SET_DEVICE_ID,
  88         MGMT_OP_SET_ADVERTISING,
  89         MGMT_OP_SET_BREDR,
  90         MGMT_OP_SET_STATIC_ADDRESS,
  91         MGMT_OP_SET_SCAN_PARAMS,
  92         MGMT_OP_SET_SECURE_CONN,
  93         MGMT_OP_SET_DEBUG_KEYS,
  94         MGMT_OP_SET_PRIVACY,
  95         MGMT_OP_LOAD_IRKS,
  96         MGMT_OP_GET_CONN_INFO,
  97         MGMT_OP_GET_CLOCK_INFO,
  98         MGMT_OP_ADD_DEVICE,
  99         MGMT_OP_REMOVE_DEVICE,
 100         MGMT_OP_LOAD_CONN_PARAM,
 101         MGMT_OP_READ_UNCONF_INDEX_LIST,
 102         MGMT_OP_READ_CONFIG_INFO,
 103         MGMT_OP_SET_EXTERNAL_CONFIG,
 104         MGMT_OP_SET_PUBLIC_ADDRESS,
 105         MGMT_OP_START_SERVICE_DISCOVERY,
 106         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 107         MGMT_OP_READ_EXT_INDEX_LIST,
 108         MGMT_OP_READ_ADV_FEATURES,
 109         MGMT_OP_ADD_ADVERTISING,
 110         MGMT_OP_REMOVE_ADVERTISING,
 111         MGMT_OP_GET_ADV_SIZE_INFO,
 112         MGMT_OP_START_LIMITED_DISCOVERY,
 113         MGMT_OP_READ_EXT_INFO,
 114         MGMT_OP_SET_APPEARANCE,
 115         MGMT_OP_GET_PHY_CONFIGURATION,
 116         MGMT_OP_SET_PHY_CONFIGURATION,
 117         MGMT_OP_SET_BLOCKED_KEYS,
 118         MGMT_OP_SET_WIDEBAND_SPEECH,
 119         MGMT_OP_READ_CONTROLLER_CAP,
 120         MGMT_OP_READ_EXP_FEATURES_INFO,
 121         MGMT_OP_SET_EXP_FEATURE,
 122         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 123         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 124         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 125         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 126         MGMT_OP_GET_DEVICE_FLAGS,
 127         MGMT_OP_SET_DEVICE_FLAGS,
 128         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 129         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 130         MGMT_OP_REMOVE_ADV_MONITOR,
 131         MGMT_OP_ADD_EXT_ADV_PARAMS,
 132         MGMT_OP_ADD_EXT_ADV_DATA,
 133         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 134 };
 135
 136 static const u16 mgmt_events[] = {
 137         MGMT_EV_CONTROLLER_ERROR,
 138         MGMT_EV_INDEX_ADDED,
 139         MGMT_EV_INDEX_REMOVED,
 140         MGMT_EV_NEW_SETTINGS,
 141         MGMT_EV_CLASS_OF_DEV_CHANGED,
 142         MGMT_EV_LOCAL_NAME_CHANGED,
 143         MGMT_EV_NEW_LINK_KEY,
 144         MGMT_EV_NEW_LONG_TERM_KEY,
 145         MGMT_EV_DEVICE_CONNECTED,
 146         MGMT_EV_DEVICE_DISCONNECTED,
 147         MGMT_EV_CONNECT_FAILED,
 148         MGMT_EV_PIN_CODE_REQUEST,
 149         MGMT_EV_USER_CONFIRM_REQUEST,
 150         MGMT_EV_USER_PASSKEY_REQUEST,
 151         MGMT_EV_AUTH_FAILED,
 152         MGMT_EV_DEVICE_FOUND,
 153         MGMT_EV_DISCOVERING,
 154         MGMT_EV_DEVICE_BLOCKED,
 155         MGMT_EV_DEVICE_UNBLOCKED,
 156         MGMT_EV_DEVICE_UNPAIRED,
 157         MGMT_EV_PASSKEY_NOTIFY,
 158         MGMT_EV_NEW_IRK,
 159         MGMT_EV_NEW_CSRK,
 160         MGMT_EV_DEVICE_ADDED,
 161         MGMT_EV_DEVICE_REMOVED,
 162         MGMT_EV_NEW_CONN_PARAM,
 163         MGMT_EV_UNCONF_INDEX_ADDED,
 164         MGMT_EV_UNCONF_INDEX_REMOVED,
 165         MGMT_EV_NEW_CONFIG_OPTIONS,
 166         MGMT_EV_EXT_INDEX_ADDED,
 167         MGMT_EV_EXT_INDEX_REMOVED,
 168         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 169         MGMT_EV_ADVERTISING_ADDED,
 170         MGMT_EV_ADVERTISING_REMOVED,
 171         MGMT_EV_EXT_INFO_CHANGED,
 172         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 173         MGMT_EV_EXP_FEATURE_CHANGED,
 174         MGMT_EV_DEVICE_FLAGS_CHANGED,
 175         MGMT_EV_ADV_MONITOR_ADDED,
 176         MGMT_EV_ADV_MONITOR_REMOVED,
 177         MGMT_EV_CONTROLLER_SUSPEND,
 178         MGMT_EV_CONTROLLER_RESUME,
 179 };
 180
 181 static const u16 mgmt_untrusted_commands[] = {
 182         MGMT_OP_READ_INDEX_LIST,
 183         MGMT_OP_READ_INFO,
 184         MGMT_OP_READ_UNCONF_INDEX_LIST,
 185         MGMT_OP_READ_CONFIG_INFO,
 186         MGMT_OP_READ_EXT_INDEX_LIST,
 187         MGMT_OP_READ_EXT_INFO,
 188         MGMT_OP_READ_CONTROLLER_CAP,
 189         MGMT_OP_READ_EXP_FEATURES_INFO,
 190         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 191         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 192 };
 193
 194 static const u16 mgmt_untrusted_events[] = {
 195         MGMT_EV_INDEX_ADDED,
 196         MGMT_EV_INDEX_REMOVED,
 197         MGMT_EV_NEW_SETTINGS,
 198         MGMT_EV_CLASS_OF_DEV_CHANGED,
 199         MGMT_EV_LOCAL_NAME_CHANGED,
 200         MGMT_EV_UNCONF_INDEX_ADDED,
 201         MGMT_EV_UNCONF_INDEX_REMOVED,
 202         MGMT_EV_NEW_CONFIG_OPTIONS,
 203         MGMT_EV_EXT_INDEX_ADDED,
 204         MGMT_EV_EXT_INDEX_REMOVED,
 205         MGMT_EV_EXT_INFO_CHANGED,
 206         MGMT_EV_EXP_FEATURE_CHANGED,
 207 };
 208
 209 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 210
 211 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 212                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 213
 214 /* HCI to MGMT error code conversion table */
 215 static const u8 mgmt_status_table[] = {
 216         MGMT_STATUS_SUCCESS,
 217         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 218         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 219         MGMT_STATUS_FAILED,             /* Hardware Failure */
 220         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 221         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 222         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 223         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 224         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 225         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 226         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 227         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 228         MGMT_STATUS_BUSY,               /* Command Disallowed */
 229         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 230         MGMT_STATUS_REJECTED,           /* Rejected Security */
 231         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 232         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 233         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 234         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 235         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 236         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 237         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 238         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 239         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 240         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 241         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 242         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 243         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 244         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 245         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 246         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 247         MGMT_STATUS_FAILED,             /* Unspecified Error */
 248         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 249         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 250         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 251         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 252         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 253         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 254         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 255         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 256         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 257         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 258         MGMT_STATUS_FAILED,             /* Transaction Collision */
 259         MGMT_STATUS_FAILED,             /* Reserved for future use */
 260         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 261         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 262         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 263         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 264         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 265         MGMT_STATUS_FAILED,             /* Reserved for future use */
 266         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 267         MGMT_STATUS_FAILED,             /* Reserved for future use */
 268         MGMT_STATUS_FAILED,             /* Slot Violation */
 269         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 270         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 271         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 272         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 273         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 274         MGMT_STATUS_BUSY,               /* Controller Busy */
 275         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 276         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 277         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 278         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 279         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 280 };
 281
 282 static u8 mgmt_status(u8 hci_status)
 283 {
 284         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 285                 return mgmt_status_table[hci_status];
 286
 287         return MGMT_STATUS_FAILED;
 288 }
 289
 290 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 291                             u16 len, int flag)
 292 {
 293         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 294                                flag, NULL);
 295 }
 296
 297 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 298                               u16 len, int flag, struct sock *skip_sk)
 299 {
 300         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 301                                flag, skip_sk);
 302 }
 303
 304 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 305                       struct sock *skip_sk)
 306 {
 307         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 308                                HCI_SOCK_TRUSTED, skip_sk);
 309 }
 310
 311 static u8 le_addr_type(u8 mgmt_addr_type)
 312 {
 313         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 314                 return ADDR_LE_DEV_PUBLIC;
 315         else
 316                 return ADDR_LE_DEV_RANDOM;
 317 }
 318
 319 void mgmt_fill_version_info(void *ver)
 320 {
 321         struct mgmt_rp_read_version *rp = ver;
 322
 323         rp->version = MGMT_VERSION;
 324         rp->revision = cpu_to_le16(MGMT_REVISION);
 325 }
 326
 327 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 328                         u16 data_len)
 329 {
 330         struct mgmt_rp_read_version rp;
 331
 332         bt_dev_dbg(hdev, "sock %p", sk);
 333
 334         mgmt_fill_version_info(&rp);
 335
 336         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 337                                  &rp, sizeof(rp));
 338 }
 339
 340 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 341                          u16 data_len)
 342 {
 343         struct mgmt_rp_read_commands *rp;
 344         u16 num_commands, num_events;
 345         size_t rp_size;
 346         int i, err;
 347
 348         bt_dev_dbg(hdev, "sock %p", sk);
 349
 350         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 351                 num_commands = ARRAY_SIZE(mgmt_commands);
 352                 num_events = ARRAY_SIZE(mgmt_events);
 353         } else {
 354                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 355                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 356         }
 357
 358         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 359
 360         rp = kmalloc(rp_size, GFP_KERNEL);
 361         if (!rp)
 362                 return -ENOMEM;
 363
 364         rp->num_commands = cpu_to_le16(num_commands);
 365         rp->num_events = cpu_to_le16(num_events);
 366
 367         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 368                 __le16 *opcode = rp->opcodes;
 369
 370                 for (i = 0; i < num_commands; i++, opcode++)
 371                         put_unaligned_le16(mgmt_commands[i], opcode);
 372
 373                 for (i = 0; i < num_events; i++, opcode++)
 374                         put_unaligned_le16(mgmt_events[i], opcode);
 375         } else {
 376                 __le16 *opcode = rp->opcodes;
 377
 378                 for (i = 0; i < num_commands; i++, opcode++)
 379                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 380
 381                 for (i = 0; i < num_events; i++, opcode++)
 382                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 383         }
 384
 385         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 386                                 rp, rp_size);
 387         kfree(rp);
 388
 389         return err;
 390 }
 391
 392 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 393                            u16 data_len)
 394 {
 395         struct mgmt_rp_read_index_list *rp;
 396         struct hci_dev *d;
 397         size_t rp_len;
 398         u16 count;
 399         int err;
 400
 401         bt_dev_dbg(hdev, "sock %p", sk);
 402
 403         read_lock(&hci_dev_list_lock);
 404
 405         count = 0;
 406         list_for_each_entry(d, &hci_dev_list, list) {
 407                 if (d->dev_type == HCI_PRIMARY &&
 408                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 409                         count++;
 410         }
 411
 412         rp_len = sizeof(*rp) + (2 * count);
 413         rp = kmalloc(rp_len, GFP_ATOMIC);
 414         if (!rp) {
 415                 read_unlock(&hci_dev_list_lock);
 416                 return -ENOMEM;
 417         }
 418
 419         count = 0;
 420         list_for_each_entry(d, &hci_dev_list, list) {
 421                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 422                     hci_dev_test_flag(d, HCI_CONFIG) ||
 423                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 424                         continue;
 425
 426                 /* Devices marked as raw-only are neither configured
 427                  * nor unconfigured controllers.
 428                  */
 429                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 430                         continue;
 431
 432                 if (d->dev_type == HCI_PRIMARY &&
 433                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 434                         rp->index[count++] = cpu_to_le16(d->id);
 435                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 436                 }
 437         }
 438
 439         rp->num_controllers = cpu_to_le16(count);
 440         rp_len = sizeof(*rp) + (2 * count);
 441
 442         read_unlock(&hci_dev_list_lock);
 443
 444         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 445                                 0, rp, rp_len);
 446
 447         kfree(rp);
 448
 449         return err;
 450 }
 451
 452 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 453                                   void *data, u16 data_len)
 454 {
 455         struct mgmt_rp_read_unconf_index_list *rp;
 456         struct hci_dev *d;
 457         size_t rp_len;
 458         u16 count;
 459         int err;
 460
 461         bt_dev_dbg(hdev, "sock %p", sk);
 462
 463         read_lock(&hci_dev_list_lock);
 464
 465         count = 0;
 466         list_for_each_entry(d, &hci_dev_list, list) {
 467                 if (d->dev_type == HCI_PRIMARY &&
 468                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 469                         count++;
 470         }
 471
 472         rp_len = sizeof(*rp) + (2 * count);
 473         rp = kmalloc(rp_len, GFP_ATOMIC);
 474         if (!rp) {
 475                 read_unlock(&hci_dev_list_lock);
 476                 return -ENOMEM;
 477         }
 478
 479         count = 0;
 480         list_for_each_entry(d, &hci_dev_list, list) {
 481                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 482                     hci_dev_test_flag(d, HCI_CONFIG) ||
 483                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 484                         continue;
 485
 486                 /* Devices marked as raw-only are neither configured
 487                  * nor unconfigured controllers.
 488                  */
 489                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 490                         continue;
 491
 492                 if (d->dev_type == HCI_PRIMARY &&
 493                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 494                         rp->index[count++] = cpu_to_le16(d->id);
 495                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 496                 }
 497         }
 498
 499         rp->num_controllers = cpu_to_le16(count);
 500         rp_len = sizeof(*rp) + (2 * count);
 501
 502         read_unlock(&hci_dev_list_lock);
 503
 504         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 505                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 506
 507         kfree(rp);
 508
 509         return err;
 510 }
 511
 512 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 513                                void *data, u16 data_len)
 514 {
 515         struct mgmt_rp_read_ext_index_list *rp;
 516         struct hci_dev *d;
 517         u16 count;
 518         int err;
 519
 520         bt_dev_dbg(hdev, "sock %p", sk);
 521
 522         read_lock(&hci_dev_list_lock);
 523
 524         count = 0;
 525         list_for_each_entry(d, &hci_dev_list, list) {
 526                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 527                         count++;
 528         }
 529
 530         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 531         if (!rp) {
 532                 read_unlock(&hci_dev_list_lock);
 533                 return -ENOMEM;
 534         }
 535
 536         count = 0;
 537         list_for_each_entry(d, &hci_dev_list, list) {
 538                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 539                     hci_dev_test_flag(d, HCI_CONFIG) ||
 540                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 541                         continue;
 542
 543                 /* Devices marked as raw-only are neither configured
 544                  * nor unconfigured controllers.
 545                  */
 546                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 547                         continue;
 548
 549                 if (d->dev_type == HCI_PRIMARY) {
 550                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 551                                 rp->entry[count].type = 0x01;
 552                         else
 553                                 rp->entry[count].type = 0x00;
 554                 } else if (d->dev_type == HCI_AMP) {
 555                         rp->entry[count].type = 0x02;
 556                 } else {
 557                         continue;
 558                 }
 559
 560                 rp->entry[count].bus = d->bus;
 561                 rp->entry[count++].index = cpu_to_le16(d->id);
 562                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 563         }
 564
 565         rp->num_controllers = cpu_to_le16(count);
 566
 567         read_unlock(&hci_dev_list_lock);
 568
 569         /* If this command is called at least once, then all the
 570          * default index and unconfigured index events are disabled
 571          * and from now on only extended index events are used.
 572          */
 573         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 574         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 575         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 576
 577         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 578                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 579                                 struct_size(rp, entry, count));
 580
 581         kfree(rp);
 582
 583         return err;
 584 }
 585
 586 static bool is_configured(struct hci_dev *hdev)
 587 {
 588         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 589             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 590                 return false;
 591
 592         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 593              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 594             !bacmp(&hdev->public_addr, BDADDR_ANY))
 595                 return false;
 596
 597         return true;
 598 }
 599
 600 static __le32 get_missing_options(struct hci_dev *hdev)
 601 {
 602         u32 options = 0;
 603
 604         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 605             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 606                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 607
 608         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 609              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 610             !bacmp(&hdev->public_addr, BDADDR_ANY))
 611                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 612
 613         return cpu_to_le32(options);
 614 }
 615
 616 static int new_options(struct hci_dev *hdev, struct sock *skip)
 617 {
 618         __le32 options = get_missing_options(hdev);
 619
 620         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 621                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 622 }
 623
 624 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 625 {
 626         __le32 options = get_missing_options(hdev);
 627
 628         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 629                                  sizeof(options));
 630 }
 631
 632 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 633                             void *data, u16 data_len)
 634 {
 635         struct mgmt_rp_read_config_info rp;
 636         u32 options = 0;
 637
 638         bt_dev_dbg(hdev, "sock %p", sk);
 639
 640         hci_dev_lock(hdev);
 641
 642         memset(&rp, 0, sizeof(rp));
 643         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 644
 645         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 646                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 647
 648         if (hdev->set_bdaddr)
 649                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 650
 651         rp.supported_options = cpu_to_le32(options);
 652         rp.missing_options = get_missing_options(hdev);
 653
 654         hci_dev_unlock(hdev);
 655
 656         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 657                                  &rp, sizeof(rp));
 658 }
 659
 660 static u32 get_supported_phys(struct hci_dev *hdev)
 661 {
 662         u32 supported_phys = 0;
 663
 664         if (lmp_bredr_capable(hdev)) {
 665                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 666
 667                 if (hdev->features[0][0] & LMP_3SLOT)
 668                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 669
 670                 if (hdev->features[0][0] & LMP_5SLOT)
 671                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 672
 673                 if (lmp_edr_2m_capable(hdev)) {
 674                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 675
 676                         if (lmp_edr_3slot_capable(hdev))
 677                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 678
 679                         if (lmp_edr_5slot_capable(hdev))
 680                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 681
 682                         if (lmp_edr_3m_capable(hdev)) {
 683                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 684
 685                                 if (lmp_edr_3slot_capable(hdev))
 686                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 687
 688                                 if (lmp_edr_5slot_capable(hdev))
 689                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 690                         }
 691                 }
 692         }
 693
 694         if (lmp_le_capable(hdev)) {
 695                 supported_phys |= MGMT_PHY_LE_1M_TX;
 696                 supported_phys |= MGMT_PHY_LE_1M_RX;
 697
 698                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 699                         supported_phys |= MGMT_PHY_LE_2M_TX;
 700                         supported_phys |= MGMT_PHY_LE_2M_RX;
 701                 }
 702
 703                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 704                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 705                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 706                 }
 707         }
 708
 709         return supported_phys;
 710 }
 711
 712 static u32 get_selected_phys(struct hci_dev *hdev)
 713 {
 714         u32 selected_phys = 0;
 715
 716         if (lmp_bredr_capable(hdev)) {
 717                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 718
 719                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 720                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 721
 722                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 723                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 724
 725                 if (lmp_edr_2m_capable(hdev)) {
 726                         if (!(hdev->pkt_type & HCI_2DH1))
 727                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 728
 729                         if (lmp_edr_3slot_capable(hdev) &&
 730                             !(hdev->pkt_type & HCI_2DH3))
 731                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 732
 733                         if (lmp_edr_5slot_capable(hdev) &&
 734                             !(hdev->pkt_type & HCI_2DH5))
 735                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 736
 737                         if (lmp_edr_3m_capable(hdev)) {
 738                                 if (!(hdev->pkt_type & HCI_3DH1))
 739                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 740
 741                                 if (lmp_edr_3slot_capable(hdev) &&
 742                                     !(hdev->pkt_type & HCI_3DH3))
 743                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 744
 745                                 if (lmp_edr_5slot_capable(hdev) &&
 746                                     !(hdev->pkt_type & HCI_3DH5))
 747                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 748                         }
 749                 }
 750         }
 751
 752         if (lmp_le_capable(hdev)) {
 753                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 754                         selected_phys |= MGMT_PHY_LE_1M_TX;
 755
 756                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 757                         selected_phys |= MGMT_PHY_LE_1M_RX;
 758
 759                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 760                         selected_phys |= MGMT_PHY_LE_2M_TX;
 761
 762                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 763                         selected_phys |= MGMT_PHY_LE_2M_RX;
 764
 765                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 766                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 767
 768                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 769                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 770         }
 771
 772         return selected_phys;
 773 }
 774
 775 static u32 get_configurable_phys(struct hci_dev *hdev)
 776 {
 777         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 778                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 779 }
 780
 781 static u32 get_supported_settings(struct hci_dev *hdev)
 782 {
 783         u32 settings = 0;
 784
 785         settings |= MGMT_SETTING_POWERED;
 786         settings |= MGMT_SETTING_BONDABLE;
 787         settings |= MGMT_SETTING_DEBUG_KEYS;
 788         settings |= MGMT_SETTING_CONNECTABLE;
 789         settings |= MGMT_SETTING_DISCOVERABLE;
 790
 791         if (lmp_bredr_capable(hdev)) {
 792                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 793                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 794                 settings |= MGMT_SETTING_BREDR;
 795                 settings |= MGMT_SETTING_LINK_SECURITY;
 796
 797                 if (lmp_ssp_capable(hdev)) {
 798                         settings |= MGMT_SETTING_SSP;
 799                         if (IS_ENABLED(CONFIG_BT_HS))
 800                                 settings |= MGMT_SETTING_HS;
 801                 }
 802
 803                 if (lmp_sc_capable(hdev))
 804                         settings |= MGMT_SETTING_SECURE_CONN;
 805
 806                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 807                              &hdev->quirks))
 808                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 809         }
 810
 811         if (lmp_le_capable(hdev)) {
 812                 settings |= MGMT_SETTING_LE;
 813                 settings |= MGMT_SETTING_SECURE_CONN;
 814                 settings |= MGMT_SETTING_PRIVACY;
 815                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 816
 817                 /* When the experimental feature for LL Privacy support is
 818                  * enabled, then advertising is no longer supported.
 819                  */
 820                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 821                         settings |= MGMT_SETTING_ADVERTISING;
 822         }
 823
 824         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 825             hdev->set_bdaddr)
 826                 settings |= MGMT_SETTING_CONFIGURATION;
 827
 828         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 829
 830         return settings;
 831 }
 832
 833 static u32 get_current_settings(struct hci_dev *hdev)
 834 {
 835         u32 settings = 0;
 836
 837         if (hdev_is_powered(hdev))
 838                 settings |= MGMT_SETTING_POWERED;
 839
 840         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 841                 settings |= MGMT_SETTING_CONNECTABLE;
 842
 843         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 844                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 845
 846         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 847                 settings |= MGMT_SETTING_DISCOVERABLE;
 848
 849         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 850                 settings |= MGMT_SETTING_BONDABLE;
 851
 852         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 853                 settings |= MGMT_SETTING_BREDR;
 854
 855         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 856                 settings |= MGMT_SETTING_LE;
 857
 858         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 859                 settings |= MGMT_SETTING_LINK_SECURITY;
 860
 861         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 862                 settings |= MGMT_SETTING_SSP;
 863
 864         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 865                 settings |= MGMT_SETTING_HS;
 866
 867         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 868                 settings |= MGMT_SETTING_ADVERTISING;
 869
 870         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 871                 settings |= MGMT_SETTING_SECURE_CONN;
 872
 873         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 874                 settings |= MGMT_SETTING_DEBUG_KEYS;
 875
 876         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 877                 settings |= MGMT_SETTING_PRIVACY;
 878
 879         /* The current setting for static address has two purposes. The
 880          * first is to indicate if the static address will be used and
 881          * the second is to indicate if it is actually set.
 882          *
 883          * This means if the static address is not configured, this flag
 884          * will never be set. If the address is configured, then if the
 885          * address is actually used decides if the flag is set or not.
 886          *
 887          * For single mode LE only controllers and dual-mode controllers
 888          * with BR/EDR disabled, the existence of the static address will
 889          * be evaluated.
 890          */
 891         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 892             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 893             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 894                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 895                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 896         }
 897
 898         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 899                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 900
 901         return settings;
 902 }
 903
 904 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 905 {
 906         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 907 }
 908
 909 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 910                                                   struct hci_dev *hdev,
 911                                                   const void *data)
 912 {
 913         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 914 }
 915
 916 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 917 {
 918         struct mgmt_pending_cmd *cmd;
 919
 920         /* If there's a pending mgmt command the flags will not yet have
 921          * their final values, so check for this first.
 922          */
 923         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 924         if (cmd) {
 925                 struct mgmt_mode *cp = cmd->param;
 926                 if (cp->val == 0x01)
 927                         return LE_AD_GENERAL;
 928                 else if (cp->val == 0x02)
 929                         return LE_AD_LIMITED;
 930         } else {
 931                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 932                         return LE_AD_LIMITED;
 933                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 934                         return LE_AD_GENERAL;
 935         }
 936
 937         return 0;
 938 }
 939
 940 bool mgmt_get_connectable(struct hci_dev *hdev)
 941 {
 942         struct mgmt_pending_cmd *cmd;
 943
 944         /* If there's a pending mgmt command the flag will not yet have
 945          * it's final value, so check for this first.
 946          */
 947         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 948         if (cmd) {
 949                 struct mgmt_mode *cp = cmd->param;
 950
 951                 return cp->val;
 952         }
 953
 954         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 955 }
 956
 957 static void service_cache_off(struct work_struct *work)
 958 {
 959         struct hci_dev *hdev = container_of(work, struct hci_dev,
 960                                             service_cache.work);
 961         struct hci_request req;
 962
 963         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 964                 return;
 965
 966         hci_req_init(&req, hdev);
 967
 968         hci_dev_lock(hdev);
 969
 970         __hci_req_update_eir(&req);
 971         __hci_req_update_class(&req);
 972
 973         hci_dev_unlock(hdev);
 974
 975         hci_req_run(&req, NULL);
 976 }
 977
 978 static void rpa_expired(struct work_struct *work)
 979 {
 980         struct hci_dev *hdev = container_of(work, struct hci_dev,
 981                                             rpa_expired.work);
 982         struct hci_request req;
 983
 984         bt_dev_dbg(hdev, "");
 985
 986         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 987
 988         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 989                 return;
 990
 991         /* The generation of a new RPA and programming it into the
 992          * controller happens in the hci_req_enable_advertising()
 993          * function.
 994          */
 995         hci_req_init(&req, hdev);
 996         if (ext_adv_capable(hdev))
 997                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 998         else
 999                 __hci_req_enable_advertising(&req);
1000         hci_req_run(&req, NULL);
1001 }
1002
1003 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1004 {
1005         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1006                 return;
1007
1008         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1009         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1010
1011         /* Non-mgmt controlled devices get this bit set
1012          * implicitly so that pairing works for them, however
1013          * for mgmt we require user-space to explicitly enable
1014          * it
1015          */
1016         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1017 }
1018
1019 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1020                                 void *data, u16 data_len)
1021 {
1022         struct mgmt_rp_read_info rp;
1023
1024         bt_dev_dbg(hdev, "sock %p", sk);
1025
1026         hci_dev_lock(hdev);
1027
1028         memset(&rp, 0, sizeof(rp));
1029
1030         bacpy(&rp.bdaddr, &hdev->bdaddr);
1031
1032         rp.version = hdev->hci_ver;
1033         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1034
1035         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1036         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1037
1038         memcpy(rp.dev_class, hdev->dev_class, 3);
1039
1040         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1041         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1042
1043         hci_dev_unlock(hdev);
1044
1045         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1046                                  sizeof(rp));
1047 }
1048
1049 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1050 {
1051         u16 eir_len = 0;
1052         size_t name_len;
1053
1054         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1055                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1056                                           hdev->dev_class, 3);
1057
1058         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1059                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1060                                           hdev->appearance);
1061
1062         name_len = strlen(hdev->dev_name);
1063         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1064                                   hdev->dev_name, name_len);
1065
1066         name_len = strlen(hdev->short_name);
1067         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1068                                   hdev->short_name, name_len);
1069
1070         return eir_len;
1071 }
1072
1073 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1074                                     void *data, u16 data_len)
1075 {
1076         char buf[512];
1077         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1078         u16 eir_len;
1079
1080         bt_dev_dbg(hdev, "sock %p", sk);
1081
1082         memset(&buf, 0, sizeof(buf));
1083
1084         hci_dev_lock(hdev);
1085
1086         bacpy(&rp->bdaddr, &hdev->bdaddr);
1087
1088         rp->version = hdev->hci_ver;
1089         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1090
1091         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1092         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1093
1094
1095         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1096         rp->eir_len = cpu_to_le16(eir_len);
1097
1098         hci_dev_unlock(hdev);
1099
1100         /* If this command is called at least once, then the events
1101          * for class of device and local name changes are disabled
1102          * and only the new extended controller information event
1103          * is used.
1104          */
1105         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1106         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1107         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1108
1109         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1110                                  sizeof(*rp) + eir_len);
1111 }
1112
1113 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1114 {
1115         char buf[512];
1116         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1117         u16 eir_len;
1118
1119         memset(buf, 0, sizeof(buf));
1120
1121         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1122         ev->eir_len = cpu_to_le16(eir_len);
1123
1124         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1125                                   sizeof(*ev) + eir_len,
1126                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1127 }
1128
1129 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1130 {
1131         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1132
1133         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1134                                  sizeof(settings));
1135 }
1136
1137 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1138 {
1139         bt_dev_dbg(hdev, "status 0x%02x", status);
1140
1141         if (hci_conn_count(hdev) == 0) {
1142                 cancel_delayed_work(&hdev->power_off);
1143                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1144         }
1145 }
1146
1147 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1148 {
1149         struct mgmt_ev_advertising_added ev;
1150
1151         ev.instance = instance;
1152
1153         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1154 }
1155
1156 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1157                               u8 instance)
1158 {
1159         struct mgmt_ev_advertising_removed ev;
1160
1161         ev.instance = instance;
1162
1163         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1164 }
1165
1166 static void cancel_adv_timeout(struct hci_dev *hdev)
1167 {
1168         if (hdev->adv_instance_timeout) {
1169                 hdev->adv_instance_timeout = 0;
1170                 cancel_delayed_work(&hdev->adv_instance_expire);
1171         }
1172 }
1173
1174 static int clean_up_hci_state(struct hci_dev *hdev)
1175 {
1176         struct hci_request req;
1177         struct hci_conn *conn;
1178         bool discov_stopped;
1179         int err;
1180
1181         hci_req_init(&req, hdev);
1182
1183         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1184             test_bit(HCI_PSCAN, &hdev->flags)) {
1185                 u8 scan = 0x00;
1186                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1187         }
1188
1189         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1190
1191         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1192                 __hci_req_disable_advertising(&req);
1193
1194         discov_stopped = hci_req_stop_discovery(&req);
1195
1196         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1197                 /* 0x15 == Terminated due to Power Off */
1198                 __hci_abort_conn(&req, conn, 0x15);
1199         }
1200
1201         err = hci_req_run(&req, clean_up_hci_complete);
1202         if (!err && discov_stopped)
1203                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1204
1205         return err;
1206 }
1207
1208 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1209                        u16 len)
1210 {
1211         struct mgmt_mode *cp = data;
1212         struct mgmt_pending_cmd *cmd;
1213         int err;
1214
1215         bt_dev_dbg(hdev, "sock %p", sk);
1216
1217         if (cp->val != 0x00 && cp->val != 0x01)
1218                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1219                                        MGMT_STATUS_INVALID_PARAMS);
1220
1221         hci_dev_lock(hdev);
1222
1223         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1224                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1225                                       MGMT_STATUS_BUSY);
1226                 goto failed;
1227         }
1228
1229         if (!!cp->val == hdev_is_powered(hdev)) {
1230                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1231                 goto failed;
1232         }
1233
1234         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1235         if (!cmd) {
1236                 err = -ENOMEM;
1237                 goto failed;
1238         }
1239
1240         if (cp->val) {
1241                 queue_work(hdev->req_workqueue, &hdev->power_on);
1242                 err = 0;
1243         } else {
1244                 /* Disconnect connections, stop scans, etc */
1245                 err = clean_up_hci_state(hdev);
1246                 if (!err)
1247                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1248                                            HCI_POWER_OFF_TIMEOUT);
1249
1250                 /* ENODATA means there were no HCI commands queued */
1251                 if (err == -ENODATA) {
1252                         cancel_delayed_work(&hdev->power_off);
1253                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1254                         err = 0;
1255                 }
1256         }
1257
1258 failed:
1259         hci_dev_unlock(hdev);
1260         return err;
1261 }
1262
1263 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1264 {
1265         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1266
1267         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1268                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1269 }
1270
1271 int mgmt_new_settings(struct hci_dev *hdev)
1272 {
1273         return new_settings(hdev, NULL);
1274 }
1275
1276 struct cmd_lookup {
1277         struct sock *sk;
1278         struct hci_dev *hdev;
1279         u8 mgmt_status;
1280 };
1281
1282 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1283 {
1284         struct cmd_lookup *match = data;
1285
1286         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1287
1288         list_del(&cmd->list);
1289
1290         if (match->sk == NULL) {
1291                 match->sk = cmd->sk;
1292                 sock_hold(match->sk);
1293         }
1294
1295         mgmt_pending_free(cmd);
1296 }
1297
1298 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1299 {
1300         u8 *status = data;
1301
1302         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1303         mgmt_pending_remove(cmd);
1304 }
1305
1306 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1307 {
1308         if (cmd->cmd_complete) {
1309                 u8 *status = data;
1310
1311                 cmd->cmd_complete(cmd, *status);
1312                 mgmt_pending_remove(cmd);
1313
1314                 return;
1315         }
1316
1317         cmd_status_rsp(cmd, data);
1318 }
1319
1320 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1321 {
1322         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1323                                  cmd->param, cmd->param_len);
1324 }
1325
1326 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1327 {
1328         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1329                                  cmd->param, sizeof(struct mgmt_addr_info));
1330 }
1331
1332 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1333 {
1334         if (!lmp_bredr_capable(hdev))
1335                 return MGMT_STATUS_NOT_SUPPORTED;
1336         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1337                 return MGMT_STATUS_REJECTED;
1338         else
1339                 return MGMT_STATUS_SUCCESS;
1340 }
1341
1342 static u8 mgmt_le_support(struct hci_dev *hdev)
1343 {
1344         if (!lmp_le_capable(hdev))
1345                 return MGMT_STATUS_NOT_SUPPORTED;
1346         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1347                 return MGMT_STATUS_REJECTED;
1348         else
1349                 return MGMT_STATUS_SUCCESS;
1350 }
1351
1352 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1353 {
1354         struct mgmt_pending_cmd *cmd;
1355
1356         bt_dev_dbg(hdev, "status 0x%02x", status);
1357
1358         hci_dev_lock(hdev);
1359
1360         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1361         if (!cmd)
1362                 goto unlock;
1363
1364         if (status) {
1365                 u8 mgmt_err = mgmt_status(status);
1366                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1367                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1368                 goto remove_cmd;
1369         }
1370
1371         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1372             hdev->discov_timeout > 0) {
1373                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1374                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1375         }
1376
1377         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1378         new_settings(hdev, cmd->sk);
1379
1380 remove_cmd:
1381         mgmt_pending_remove(cmd);
1382
1383 unlock:
1384         hci_dev_unlock(hdev);
1385 }
1386
1387 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1388                             u16 len)
1389 {
1390         struct mgmt_cp_set_discoverable *cp = data;
1391         struct mgmt_pending_cmd *cmd;
1392         u16 timeout;
1393         int err;
1394
1395         bt_dev_dbg(hdev, "sock %p", sk);
1396
1397         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1398             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1400                                        MGMT_STATUS_REJECTED);
1401
1402         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1403                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1404                                        MGMT_STATUS_INVALID_PARAMS);
1405
1406         timeout = __le16_to_cpu(cp->timeout);
1407
1408         /* Disabling discoverable requires that no timeout is set,
1409          * and enabling limited discoverable requires a timeout.
1410          */
1411         if ((cp->val == 0x00 && timeout > 0) ||
1412             (cp->val == 0x02 && timeout == 0))
1413                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1414                                        MGMT_STATUS_INVALID_PARAMS);
1415
1416         hci_dev_lock(hdev);
1417
1418         if (!hdev_is_powered(hdev) && timeout > 0) {
1419                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1420                                       MGMT_STATUS_NOT_POWERED);
1421                 goto failed;
1422         }
1423
1424         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1425             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1426                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1427                                       MGMT_STATUS_BUSY);
1428                 goto failed;
1429         }
1430
1431         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1432                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1433                                       MGMT_STATUS_REJECTED);
1434                 goto failed;
1435         }
1436
1437         if (hdev->advertising_paused) {
1438                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1439                                       MGMT_STATUS_BUSY);
1440                 goto failed;
1441         }
1442
1443         if (!hdev_is_powered(hdev)) {
1444                 bool changed = false;
1445
1446                 /* Setting limited discoverable when powered off is
1447                  * not a valid operation since it requires a timeout
1448                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1449                  */
1450                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1451                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1452                         changed = true;
1453                 }
1454
1455                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1456                 if (err < 0)
1457                         goto failed;
1458
1459                 if (changed)
1460                         err = new_settings(hdev, sk);
1461
1462                 goto failed;
1463         }
1464
1465         /* If the current mode is the same, then just update the timeout
1466          * value with the new value. And if only the timeout gets updated,
1467          * then no need for any HCI transactions.
1468          */
1469         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1470             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1471                                                    HCI_LIMITED_DISCOVERABLE)) {
1472                 cancel_delayed_work(&hdev->discov_off);
1473                 hdev->discov_timeout = timeout;
1474
1475                 if (cp->val && hdev->discov_timeout > 0) {
1476                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1477                         queue_delayed_work(hdev->req_workqueue,
1478                                            &hdev->discov_off, to);
1479                 }
1480
1481                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1482                 goto failed;
1483         }
1484
1485         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1486         if (!cmd) {
1487                 err = -ENOMEM;
1488                 goto failed;
1489         }
1490
1491         /* Cancel any potential discoverable timeout that might be
1492          * still active and store new timeout value. The arming of
1493          * the timeout happens in the complete handler.
1494          */
1495         cancel_delayed_work(&hdev->discov_off);
1496         hdev->discov_timeout = timeout;
1497
1498         if (cp->val)
1499                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1500         else
1501                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1502
1503         /* Limited discoverable mode */
1504         if (cp->val == 0x02)
1505                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1506         else
1507                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1508
1509         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1510         err = 0;
1511
1512 failed:
1513         hci_dev_unlock(hdev);
1514         return err;
1515 }
1516
1517 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1518 {
1519         struct mgmt_pending_cmd *cmd;
1520
1521         bt_dev_dbg(hdev, "status 0x%02x", status);
1522
1523         hci_dev_lock(hdev);
1524
1525         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1526         if (!cmd)
1527                 goto unlock;
1528
1529         if (status) {
1530                 u8 mgmt_err = mgmt_status(status);
1531                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1532                 goto remove_cmd;
1533         }
1534
1535         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1536         new_settings(hdev, cmd->sk);
1537
1538 remove_cmd:
1539         mgmt_pending_remove(cmd);
1540
1541 unlock:
1542         hci_dev_unlock(hdev);
1543 }
1544
1545 static int set_connectable_update_settings(struct hci_dev *hdev,
1546                                            struct sock *sk, u8 val)
1547 {
1548         bool changed = false;
1549         int err;
1550
1551         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1552                 changed = true;
1553
1554         if (val) {
1555                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1556         } else {
1557                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1558                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1559         }
1560
1561         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1562         if (err < 0)
1563                 return err;
1564
1565         if (changed) {
1566                 hci_req_update_scan(hdev);
1567                 hci_update_background_scan(hdev);
1568                 return new_settings(hdev, sk);
1569         }
1570
1571         return 0;
1572 }
1573
1574 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1575                            u16 len)
1576 {
1577         struct mgmt_mode *cp = data;
1578         struct mgmt_pending_cmd *cmd;
1579         int err;
1580
1581         bt_dev_dbg(hdev, "sock %p", sk);
1582
1583         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1584             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1585                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1586                                        MGMT_STATUS_REJECTED);
1587
1588         if (cp->val != 0x00 && cp->val != 0x01)
1589                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1590                                        MGMT_STATUS_INVALID_PARAMS);
1591
1592         hci_dev_lock(hdev);
1593
1594         if (!hdev_is_powered(hdev)) {
1595                 err = set_connectable_update_settings(hdev, sk, cp->val);
1596                 goto failed;
1597         }
1598
1599         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1600             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1601                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1602                                       MGMT_STATUS_BUSY);
1603                 goto failed;
1604         }
1605
1606         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1607         if (!cmd) {
1608                 err = -ENOMEM;
1609                 goto failed;
1610         }
1611
1612         if (cp->val) {
1613                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1614         } else {
1615                 if (hdev->discov_timeout > 0)
1616                         cancel_delayed_work(&hdev->discov_off);
1617
1618                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1619                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1620                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1621         }
1622
1623         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1624         err = 0;
1625
1626 failed:
1627         hci_dev_unlock(hdev);
1628         return err;
1629 }
1630
1631 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1632                         u16 len)
1633 {
1634         struct mgmt_mode *cp = data;
1635         bool changed;
1636         int err;
1637
1638         bt_dev_dbg(hdev, "sock %p", sk);
1639
1640         if (cp->val != 0x00 && cp->val != 0x01)
1641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1642                                        MGMT_STATUS_INVALID_PARAMS);
1643
1644         hci_dev_lock(hdev);
1645
1646         if (cp->val)
1647                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1648         else
1649                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1650
1651         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1652         if (err < 0)
1653                 goto unlock;
1654
1655         if (changed) {
1656                 /* In limited privacy mode the change of bondable mode
1657                  * may affect the local advertising address.
1658                  */
1659                 if (hdev_is_powered(hdev) &&
1660                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1661                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1662                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1663                         queue_work(hdev->req_workqueue,
1664                                    &hdev->discoverable_update);
1665
1666                 err = new_settings(hdev, sk);
1667         }
1668
1669 unlock:
1670         hci_dev_unlock(hdev);
1671         return err;
1672 }
1673
1674 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1675                              u16 len)
1676 {
1677         struct mgmt_mode *cp = data;
1678         struct mgmt_pending_cmd *cmd;
1679         u8 val, status;
1680         int err;
1681
1682         bt_dev_dbg(hdev, "sock %p", sk);
1683
1684         status = mgmt_bredr_support(hdev);
1685         if (status)
1686                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1687                                        status);
1688
1689         if (cp->val != 0x00 && cp->val != 0x01)
1690                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1691                                        MGMT_STATUS_INVALID_PARAMS);
1692
1693         hci_dev_lock(hdev);
1694
1695         if (!hdev_is_powered(hdev)) {
1696                 bool changed = false;
1697
1698                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1699                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1700                         changed = true;
1701                 }
1702
1703                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1704                 if (err < 0)
1705                         goto failed;
1706
1707                 if (changed)
1708                         err = new_settings(hdev, sk);
1709
1710                 goto failed;
1711         }
1712
1713         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1714                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1715                                       MGMT_STATUS_BUSY);
1716                 goto failed;
1717         }
1718
1719         val = !!cp->val;
1720
1721         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1722                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1723                 goto failed;
1724         }
1725
1726         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1727         if (!cmd) {
1728                 err = -ENOMEM;
1729                 goto failed;
1730         }
1731
1732         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1733         if (err < 0) {
1734                 mgmt_pending_remove(cmd);
1735                 goto failed;
1736         }
1737
1738 failed:
1739         hci_dev_unlock(hdev);
1740         return err;
1741 }
1742
1743 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1744 {
1745         struct mgmt_mode *cp = data;
1746         struct mgmt_pending_cmd *cmd;
1747         u8 status;
1748         int err;
1749
1750         bt_dev_dbg(hdev, "sock %p", sk);
1751
1752         status = mgmt_bredr_support(hdev);
1753         if (status)
1754                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1755
1756         if (!lmp_ssp_capable(hdev))
1757                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1758                                        MGMT_STATUS_NOT_SUPPORTED);
1759
1760         if (cp->val != 0x00 && cp->val != 0x01)
1761                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1762                                        MGMT_STATUS_INVALID_PARAMS);
1763
1764         hci_dev_lock(hdev);
1765
1766         if (!hdev_is_powered(hdev)) {
1767                 bool changed;
1768
1769                 if (cp->val) {
1770                         changed = !hci_dev_test_and_set_flag(hdev,
1771                                                              HCI_SSP_ENABLED);
1772                 } else {
1773                         changed = hci_dev_test_and_clear_flag(hdev,
1774                                                               HCI_SSP_ENABLED);
1775                         if (!changed)
1776                                 changed = hci_dev_test_and_clear_flag(hdev,
1777                                                                       HCI_HS_ENABLED);
1778                         else
1779                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1780                 }
1781
1782                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1783                 if (err < 0)
1784                         goto failed;
1785
1786                 if (changed)
1787                         err = new_settings(hdev, sk);
1788
1789                 goto failed;
1790         }
1791
1792         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1793                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1794                                       MGMT_STATUS_BUSY);
1795                 goto failed;
1796         }
1797
1798         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1799                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1800                 goto failed;
1801         }
1802
1803         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1804         if (!cmd) {
1805                 err = -ENOMEM;
1806                 goto failed;
1807         }
1808
1809         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1810                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1811                              sizeof(cp->val), &cp->val);
1812
1813         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1814         if (err < 0) {
1815                 mgmt_pending_remove(cmd);
1816                 goto failed;
1817         }
1818
1819 failed:
1820         hci_dev_unlock(hdev);
1821         return err;
1822 }
1823
1824 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1825 {
1826         struct mgmt_mode *cp = data;
1827         bool changed;
1828         u8 status;
1829         int err;
1830
1831         bt_dev_dbg(hdev, "sock %p", sk);
1832
1833         if (!IS_ENABLED(CONFIG_BT_HS))
1834                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1835                                        MGMT_STATUS_NOT_SUPPORTED);
1836
1837         status = mgmt_bredr_support(hdev);
1838         if (status)
1839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1840
1841         if (!lmp_ssp_capable(hdev))
1842                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1843                                        MGMT_STATUS_NOT_SUPPORTED);
1844
1845         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1846                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1847                                        MGMT_STATUS_REJECTED);
1848
1849         if (cp->val != 0x00 && cp->val != 0x01)
1850                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1851                                        MGMT_STATUS_INVALID_PARAMS);
1852
1853         hci_dev_lock(hdev);
1854
1855         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1856                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1857                                       MGMT_STATUS_BUSY);
1858                 goto unlock;
1859         }
1860
1861         if (cp->val) {
1862                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1863         } else {
1864                 if (hdev_is_powered(hdev)) {
1865                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1866                                               MGMT_STATUS_REJECTED);
1867                         goto unlock;
1868                 }
1869
1870                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1871         }
1872
1873         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1874         if (err < 0)
1875                 goto unlock;
1876
1877         if (changed)
1878                 err = new_settings(hdev, sk);
1879
1880 unlock:
1881         hci_dev_unlock(hdev);
1882         return err;
1883 }
1884
1885 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1886 {
1887         struct cmd_lookup match = { NULL, hdev };
1888
1889         hci_dev_lock(hdev);
1890
1891         if (status) {
1892                 u8 mgmt_err = mgmt_status(status);
1893
1894                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1895                                      &mgmt_err);
1896                 goto unlock;
1897         }
1898
1899         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1900
1901         new_settings(hdev, match.sk);
1902
1903         if (match.sk)
1904                 sock_put(match.sk);
1905
1906         /* Make sure the controller has a good default for
1907          * advertising data. Restrict the update to when LE
1908          * has actually been enabled. During power on, the
1909          * update in powered_update_hci will take care of it.
1910          */
1911         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1912                 struct hci_request req;
1913                 hci_req_init(&req, hdev);
1914                 if (ext_adv_capable(hdev)) {
1915                         int err;
1916
1917                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1918                         if (!err)
1919                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1920                 } else {
1921                         __hci_req_update_adv_data(&req, 0x00);
1922                         __hci_req_update_scan_rsp_data(&req, 0x00);
1923                 }
1924                 hci_req_run(&req, NULL);
1925                 hci_update_background_scan(hdev);
1926         }
1927
1928 unlock:
1929         hci_dev_unlock(hdev);
1930 }
1931
1932 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1933 {
1934         struct mgmt_mode *cp = data;
1935         struct hci_cp_write_le_host_supported hci_cp;
1936         struct mgmt_pending_cmd *cmd;
1937         struct hci_request req;
1938         int err;
1939         u8 val, enabled;
1940
1941         bt_dev_dbg(hdev, "sock %p", sk);
1942
1943         if (!lmp_le_capable(hdev))
1944                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1945                                        MGMT_STATUS_NOT_SUPPORTED);
1946
1947         if (cp->val != 0x00 && cp->val != 0x01)
1948                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1949                                        MGMT_STATUS_INVALID_PARAMS);
1950
1951         /* Bluetooth single mode LE only controllers or dual-mode
1952          * controllers configured as LE only devices, do not allow
1953          * switching LE off. These have either LE enabled explicitly
1954          * or BR/EDR has been previously switched off.
1955          *
1956          * When trying to enable an already enabled LE, then gracefully
1957          * send a positive response. Trying to disable it however will
1958          * result into rejection.
1959          */
1960         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1961                 if (cp->val == 0x01)
1962                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1963
1964                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1965                                        MGMT_STATUS_REJECTED);
1966         }
1967
1968         hci_dev_lock(hdev);
1969
1970         val = !!cp->val;
1971         enabled = lmp_host_le_capable(hdev);
1972
1973         if (!val)
1974                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1975
1976         if (!hdev_is_powered(hdev) || val == enabled) {
1977                 bool changed = false;
1978
1979                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1980                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1981                         changed = true;
1982                 }
1983
1984                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1985                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1986                         changed = true;
1987                 }
1988
1989                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1990                 if (err < 0)
1991                         goto unlock;
1992
1993                 if (changed)
1994                         err = new_settings(hdev, sk);
1995
1996                 goto unlock;
1997         }
1998
1999         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2000             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2001                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2002                                       MGMT_STATUS_BUSY);
2003                 goto unlock;
2004         }
2005
2006         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2007         if (!cmd) {
2008                 err = -ENOMEM;
2009                 goto unlock;
2010         }
2011
2012         hci_req_init(&req, hdev);
2013
2014         memset(&hci_cp, 0, sizeof(hci_cp));
2015
2016         if (val) {
2017                 hci_cp.le = val;
2018                 hci_cp.simul = 0x00;
2019         } else {
2020                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2021                         __hci_req_disable_advertising(&req);
2022
2023                 if (ext_adv_capable(hdev))
2024                         __hci_req_clear_ext_adv_sets(&req);
2025         }
2026
2027         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2028                     &hci_cp);
2029
2030         err = hci_req_run(&req, le_enable_complete);
2031         if (err < 0)
2032                 mgmt_pending_remove(cmd);
2033
2034 unlock:
2035         hci_dev_unlock(hdev);
2036         return err;
2037 }
2038
2039 /* This is a helper function to test for pending mgmt commands that can
2040  * cause CoD or EIR HCI commands. We can only allow one such pending
2041  * mgmt command at a time since otherwise we cannot easily track what
2042  * the current values are, will be, and based on that calculate if a new
2043  * HCI command needs to be sent and if yes with what value.
2044  */
2045 static bool pending_eir_or_class(struct hci_dev *hdev)
2046 {
2047         struct mgmt_pending_cmd *cmd;
2048
2049         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2050                 switch (cmd->opcode) {
2051                 case MGMT_OP_ADD_UUID:
2052                 case MGMT_OP_REMOVE_UUID:
2053                 case MGMT_OP_SET_DEV_CLASS:
2054                 case MGMT_OP_SET_POWERED:
2055                         return true;
2056                 }
2057         }
2058
2059         return false;
2060 }
2061
2062 static const u8 bluetooth_base_uuid[] = {
2063                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2064                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2065 };
2066
2067 static u8 get_uuid_size(const u8 *uuid)
2068 {
2069         u32 val;
2070
2071         if (memcmp(uuid, bluetooth_base_uuid, 12))
2072                 return 128;
2073
2074         val = get_unaligned_le32(&uuid[12]);
2075         if (val > 0xffff)
2076                 return 32;
2077
2078         return 16;
2079 }
2080
2081 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2082 {
2083         struct mgmt_pending_cmd *cmd;
2084
2085         hci_dev_lock(hdev);
2086
2087         cmd = pending_find(mgmt_op, hdev);
2088         if (!cmd)
2089                 goto unlock;
2090
2091         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2092                           mgmt_status(status), hdev->dev_class, 3);
2093
2094         mgmt_pending_remove(cmd);
2095
2096 unlock:
2097         hci_dev_unlock(hdev);
2098 }
2099
2100 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2101 {
2102         bt_dev_dbg(hdev, "status 0x%02x", status);
2103
2104         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2105 }
2106
2107 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2108 {
2109         struct mgmt_cp_add_uuid *cp = data;
2110         struct mgmt_pending_cmd *cmd;
2111         struct hci_request req;
2112         struct bt_uuid *uuid;
2113         int err;
2114
2115         bt_dev_dbg(hdev, "sock %p", sk);
2116
2117         hci_dev_lock(hdev);
2118
2119         if (pending_eir_or_class(hdev)) {
2120                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2121                                       MGMT_STATUS_BUSY);
2122                 goto failed;
2123         }
2124
2125         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2126         if (!uuid) {
2127                 err = -ENOMEM;
2128                 goto failed;
2129         }
2130
2131         memcpy(uuid->uuid, cp->uuid, 16);
2132         uuid->svc_hint = cp->svc_hint;
2133         uuid->size = get_uuid_size(cp->uuid);
2134
2135         list_add_tail(&uuid->list, &hdev->uuids);
2136
2137         hci_req_init(&req, hdev);
2138
2139         __hci_req_update_class(&req);
2140         __hci_req_update_eir(&req);
2141
2142         err = hci_req_run(&req, add_uuid_complete);
2143         if (err < 0) {
2144                 if (err != -ENODATA)
2145                         goto failed;
2146
2147                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2148                                         hdev->dev_class, 3);
2149                 goto failed;
2150         }
2151
2152         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2153         if (!cmd) {
2154                 err = -ENOMEM;
2155                 goto failed;
2156         }
2157
2158         err = 0;
2159
2160 failed:
2161         hci_dev_unlock(hdev);
2162         return err;
2163 }
2164
2165 static bool enable_service_cache(struct hci_dev *hdev)
2166 {
2167         if (!hdev_is_powered(hdev))
2168                 return false;
2169
2170         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2171                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2172                                    CACHE_TIMEOUT);
2173                 return true;
2174         }
2175
2176         return false;
2177 }
2178
2179 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2180 {
2181         bt_dev_dbg(hdev, "status 0x%02x", status);
2182
2183         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2184 }
2185
2186 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2187                        u16 len)
2188 {
2189         struct mgmt_cp_remove_uuid *cp = data;
2190         struct mgmt_pending_cmd *cmd;
2191         struct bt_uuid *match, *tmp;
2192         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2193         struct hci_request req;
2194         int err, found;
2195
2196         bt_dev_dbg(hdev, "sock %p", sk);
2197
2198         hci_dev_lock(hdev);
2199
2200         if (pending_eir_or_class(hdev)) {
2201                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2202                                       MGMT_STATUS_BUSY);
2203                 goto unlock;
2204         }
2205
2206         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2207                 hci_uuids_clear(hdev);
2208
2209                 if (enable_service_cache(hdev)) {
2210                         err = mgmt_cmd_complete(sk, hdev->id,
2211                                                 MGMT_OP_REMOVE_UUID,
2212                                                 0, hdev->dev_class, 3);
2213                         goto unlock;
2214                 }
2215
2216                 goto update_class;
2217         }
2218
2219         found = 0;
2220
2221         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2222                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2223                         continue;
2224
2225                 list_del(&match->list);
2226                 kfree(match);
2227                 found++;
2228         }
2229
2230         if (found == 0) {
2231                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2232                                       MGMT_STATUS_INVALID_PARAMS);
2233                 goto unlock;
2234         }
2235
2236 update_class:
2237         hci_req_init(&req, hdev);
2238
2239         __hci_req_update_class(&req);
2240         __hci_req_update_eir(&req);
2241
2242         err = hci_req_run(&req, remove_uuid_complete);
2243         if (err < 0) {
2244                 if (err != -ENODATA)
2245                         goto unlock;
2246
2247                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2248                                         hdev->dev_class, 3);
2249                 goto unlock;
2250         }
2251
2252         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2253         if (!cmd) {
2254                 err = -ENOMEM;
2255                 goto unlock;
2256         }
2257
2258         err = 0;
2259
2260 unlock:
2261         hci_dev_unlock(hdev);
2262         return err;
2263 }
2264
2265 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2266 {
2267         bt_dev_dbg(hdev, "status 0x%02x", status);
2268
2269         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2270 }
2271
2272 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2273                          u16 len)
2274 {
2275         struct mgmt_cp_set_dev_class *cp = data;
2276         struct mgmt_pending_cmd *cmd;
2277         struct hci_request req;
2278         int err;
2279
2280         bt_dev_dbg(hdev, "sock %p", sk);
2281
2282         if (!lmp_bredr_capable(hdev))
2283                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2284                                        MGMT_STATUS_NOT_SUPPORTED);
2285
2286         hci_dev_lock(hdev);
2287
2288         if (pending_eir_or_class(hdev)) {
2289                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2290                                       MGMT_STATUS_BUSY);
2291                 goto unlock;
2292         }
2293
2294         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2295                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2296                                       MGMT_STATUS_INVALID_PARAMS);
2297                 goto unlock;
2298         }
2299
2300         hdev->major_class = cp->major;
2301         hdev->minor_class = cp->minor;
2302
2303         if (!hdev_is_powered(hdev)) {
2304                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2305                                         hdev->dev_class, 3);
2306                 goto unlock;
2307         }
2308
2309         hci_req_init(&req, hdev);
2310
2311         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2312                 hci_dev_unlock(hdev);
2313                 cancel_delayed_work_sync(&hdev->service_cache);
2314                 hci_dev_lock(hdev);
2315                 __hci_req_update_eir(&req);
2316         }
2317
2318         __hci_req_update_class(&req);
2319
2320         err = hci_req_run(&req, set_class_complete);
2321         if (err < 0) {
2322                 if (err != -ENODATA)
2323                         goto unlock;
2324
2325                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2326                                         hdev->dev_class, 3);
2327                 goto unlock;
2328         }
2329
2330         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2331         if (!cmd) {
2332                 err = -ENOMEM;
2333                 goto unlock;
2334         }
2335
2336         err = 0;
2337
2338 unlock:
2339         hci_dev_unlock(hdev);
2340         return err;
2341 }
2342
2343 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2344                           u16 len)
2345 {
2346         struct mgmt_cp_load_link_keys *cp = data;
2347         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2348                                    sizeof(struct mgmt_link_key_info));
2349         u16 key_count, expected_len;
2350         bool changed;
2351         int i;
2352
2353         bt_dev_dbg(hdev, "sock %p", sk);
2354
2355         if (!lmp_bredr_capable(hdev))
2356                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2357                                        MGMT_STATUS_NOT_SUPPORTED);
2358
2359         key_count = __le16_to_cpu(cp->key_count);
2360         if (key_count > max_key_count) {
2361                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2362                            key_count);
2363                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2364                                        MGMT_STATUS_INVALID_PARAMS);
2365         }
2366
2367         expected_len = struct_size(cp, keys, key_count);
2368         if (expected_len != len) {
2369                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2370                            expected_len, len);
2371                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2372                                        MGMT_STATUS_INVALID_PARAMS);
2373         }
2374
2375         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2376                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2377                                        MGMT_STATUS_INVALID_PARAMS);
2378
2379         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2380                    key_count);
2381
2382         for (i = 0; i < key_count; i++) {
2383                 struct mgmt_link_key_info *key = &cp->keys[i];
2384
2385                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2386                         return mgmt_cmd_status(sk, hdev->id,
2387                                                MGMT_OP_LOAD_LINK_KEYS,
2388                                                MGMT_STATUS_INVALID_PARAMS);
2389         }
2390
2391         hci_dev_lock(hdev);
2392
2393         hci_link_keys_clear(hdev);
2394
2395         if (cp->debug_keys)
2396                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2397         else
2398                 changed = hci_dev_test_and_clear_flag(hdev,
2399                                                       HCI_KEEP_DEBUG_KEYS);
2400
2401         if (changed)
2402                 new_settings(hdev, NULL);
2403
2404         for (i = 0; i < key_count; i++) {
2405                 struct mgmt_link_key_info *key = &cp->keys[i];
2406
2407                 if (hci_is_blocked_key(hdev,
2408                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2409                                        key->val)) {
2410                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2411                                     &key->addr.bdaddr);
2412                         continue;
2413                 }
2414
2415                 /* Always ignore debug keys and require a new pairing if
2416                  * the user wants to use them.
2417                  */
2418                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2419                         continue;
2420
2421                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2422                                  key->type, key->pin_len, NULL);
2423         }
2424
2425         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2426
2427         hci_dev_unlock(hdev);
2428
2429         return 0;
2430 }
2431
2432 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2433                            u8 addr_type, struct sock *skip_sk)
2434 {
2435         struct mgmt_ev_device_unpaired ev;
2436
2437         bacpy(&ev.addr.bdaddr, bdaddr);
2438         ev.addr.type = addr_type;
2439
2440         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2441                           skip_sk);
2442 }
2443
2444 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2445                          u16 len)
2446 {
2447         struct mgmt_cp_unpair_device *cp = data;
2448         struct mgmt_rp_unpair_device rp;
2449         struct hci_conn_params *params;
2450         struct mgmt_pending_cmd *cmd;
2451         struct hci_conn *conn;
2452         u8 addr_type;
2453         int err;
2454
2455         memset(&rp, 0, sizeof(rp));
2456         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2457         rp.addr.type = cp->addr.type;
2458
2459         if (!bdaddr_type_is_valid(cp->addr.type))
2460                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2461                                          MGMT_STATUS_INVALID_PARAMS,
2462                                          &rp, sizeof(rp));
2463
2464         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2465                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466                                          MGMT_STATUS_INVALID_PARAMS,
2467                                          &rp, sizeof(rp));
2468
2469         hci_dev_lock(hdev);
2470
2471         if (!hdev_is_powered(hdev)) {
2472                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2473                                         MGMT_STATUS_NOT_POWERED, &rp,
2474                                         sizeof(rp));
2475                 goto unlock;
2476         }
2477
2478         if (cp->addr.type == BDADDR_BREDR) {
2479                 /* If disconnection is requested, then look up the
2480                  * connection. If the remote device is connected, it
2481                  * will be later used to terminate the link.
2482                  *
2483                  * Setting it to NULL explicitly will cause no
2484                  * termination of the link.
2485                  */
2486                 if (cp->disconnect)
2487                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2488                                                        &cp->addr.bdaddr);
2489                 else
2490                         conn = NULL;
2491
2492                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2493                 if (err < 0) {
2494                         err = mgmt_cmd_complete(sk, hdev->id,
2495                                                 MGMT_OP_UNPAIR_DEVICE,
2496                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2497                                                 sizeof(rp));
2498                         goto unlock;
2499                 }
2500
2501                 goto done;
2502         }
2503
2504         /* LE address type */
2505         addr_type = le_addr_type(cp->addr.type);
2506
2507         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2508         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2509         if (err < 0) {
2510                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2511                                         MGMT_STATUS_NOT_PAIRED, &rp,
2512                                         sizeof(rp));
2513                 goto unlock;
2514         }
2515
2516         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2517         if (!conn) {
2518                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2519                 goto done;
2520         }
2521
2522
2523         /* Defer clearing up the connection parameters until closing to
2524          * give a chance of keeping them if a repairing happens.
2525          */
2526         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2527
2528         /* Disable auto-connection parameters if present */
2529         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2530         if (params) {
2531                 if (params->explicit_connect)
2532                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2533                 else
2534                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2535         }
2536
2537         /* If disconnection is not requested, then clear the connection
2538          * variable so that the link is not terminated.
2539          */
2540         if (!cp->disconnect)
2541                 conn = NULL;
2542
2543 done:
2544         /* If the connection variable is set, then termination of the
2545          * link is requested.
2546          */
2547         if (!conn) {
2548                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2549                                         &rp, sizeof(rp));
2550                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2551                 goto unlock;
2552         }
2553
2554         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2555                                sizeof(*cp));
2556         if (!cmd) {
2557                 err = -ENOMEM;
2558                 goto unlock;
2559         }
2560
2561         cmd->cmd_complete = addr_cmd_complete;
2562
2563         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2564         if (err < 0)
2565                 mgmt_pending_remove(cmd);
2566
2567 unlock:
2568         hci_dev_unlock(hdev);
2569         return err;
2570 }
2571
2572 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2573                       u16 len)
2574 {
2575         struct mgmt_cp_disconnect *cp = data;
2576         struct mgmt_rp_disconnect rp;
2577         struct mgmt_pending_cmd *cmd;
2578         struct hci_conn *conn;
2579         int err;
2580
2581         bt_dev_dbg(hdev, "sock %p", sk);
2582
2583         memset(&rp, 0, sizeof(rp));
2584         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2585         rp.addr.type = cp->addr.type;
2586
2587         if (!bdaddr_type_is_valid(cp->addr.type))
2588                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2589                                          MGMT_STATUS_INVALID_PARAMS,
2590                                          &rp, sizeof(rp));
2591
2592         hci_dev_lock(hdev);
2593
2594         if (!test_bit(HCI_UP, &hdev->flags)) {
2595                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2596                                         MGMT_STATUS_NOT_POWERED, &rp,
2597                                         sizeof(rp));
2598                 goto failed;
2599         }
2600
2601         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2602                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2603                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2604                 goto failed;
2605         }
2606
2607         if (cp->addr.type == BDADDR_BREDR)
2608                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2609                                                &cp->addr.bdaddr);
2610         else
2611                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2612                                                le_addr_type(cp->addr.type));
2613
2614         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2615                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2616                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2617                                         sizeof(rp));
2618                 goto failed;
2619         }
2620
2621         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2622         if (!cmd) {
2623                 err = -ENOMEM;
2624                 goto failed;
2625         }
2626
2627         cmd->cmd_complete = generic_cmd_complete;
2628
2629         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2630         if (err < 0)
2631                 mgmt_pending_remove(cmd);
2632
2633 failed:
2634         hci_dev_unlock(hdev);
2635         return err;
2636 }
2637
2638 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2639 {
2640         switch (link_type) {
2641         case LE_LINK:
2642                 switch (addr_type) {
2643                 case ADDR_LE_DEV_PUBLIC:
2644                         return BDADDR_LE_PUBLIC;
2645
2646                 default:
2647                         /* Fallback to LE Random address type */
2648                         return BDADDR_LE_RANDOM;
2649                 }
2650
2651         default:
2652                 /* Fallback to BR/EDR type */
2653                 return BDADDR_BREDR;
2654         }
2655 }
2656
2657 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2658                            u16 data_len)
2659 {
2660         struct mgmt_rp_get_connections *rp;
2661         struct hci_conn *c;
2662         int err;
2663         u16 i;
2664
2665         bt_dev_dbg(hdev, "sock %p", sk);
2666
2667         hci_dev_lock(hdev);
2668
2669         if (!hdev_is_powered(hdev)) {
2670                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2671                                       MGMT_STATUS_NOT_POWERED);
2672                 goto unlock;
2673         }
2674
2675         i = 0;
2676         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2677                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2678                         i++;
2679         }
2680
2681         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2682         if (!rp) {
2683                 err = -ENOMEM;
2684                 goto unlock;
2685         }
2686
2687         i = 0;
2688         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2689                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2690                         continue;
2691                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2692                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2693                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2694                         continue;
2695                 i++;
2696         }
2697
2698         rp->conn_count = cpu_to_le16(i);
2699
2700         /* Recalculate length in case of filtered SCO connections, etc */
2701         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2702                                 struct_size(rp, addr, i));
2703
2704         kfree(rp);
2705
2706 unlock:
2707         hci_dev_unlock(hdev);
2708         return err;
2709 }
2710
2711 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2712                                    struct mgmt_cp_pin_code_neg_reply *cp)
2713 {
2714         struct mgmt_pending_cmd *cmd;
2715         int err;
2716
2717         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2718                                sizeof(*cp));
2719         if (!cmd)
2720                 return -ENOMEM;
2721
2722         cmd->cmd_complete = addr_cmd_complete;
2723
2724         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2725                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2726         if (err < 0)
2727                 mgmt_pending_remove(cmd);
2728
2729         return err;
2730 }
2731
2732 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2733                           u16 len)
2734 {
2735         struct hci_conn *conn;
2736         struct mgmt_cp_pin_code_reply *cp = data;
2737         struct hci_cp_pin_code_reply reply;
2738         struct mgmt_pending_cmd *cmd;
2739         int err;
2740
2741         bt_dev_dbg(hdev, "sock %p", sk);
2742
2743         hci_dev_lock(hdev);
2744
2745         if (!hdev_is_powered(hdev)) {
2746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2747                                       MGMT_STATUS_NOT_POWERED);
2748                 goto failed;
2749         }
2750
2751         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2752         if (!conn) {
2753                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2754                                       MGMT_STATUS_NOT_CONNECTED);
2755                 goto failed;
2756         }
2757
2758         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2759                 struct mgmt_cp_pin_code_neg_reply ncp;
2760
2761                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2762
2763                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2764
2765                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2766                 if (err >= 0)
2767                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2768                                               MGMT_STATUS_INVALID_PARAMS);
2769
2770                 goto failed;
2771         }
2772
2773         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2774         if (!cmd) {
2775                 err = -ENOMEM;
2776                 goto failed;
2777         }
2778
2779         cmd->cmd_complete = addr_cmd_complete;
2780
2781         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2782         reply.pin_len = cp->pin_len;
2783         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2784
2785         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2786         if (err < 0)
2787                 mgmt_pending_remove(cmd);
2788
2789 failed:
2790         hci_dev_unlock(hdev);
2791         return err;
2792 }
2793
2794 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2795                              u16 len)
2796 {
2797         struct mgmt_cp_set_io_capability *cp = data;
2798
2799         bt_dev_dbg(hdev, "sock %p", sk);
2800
2801         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2802                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2803                                        MGMT_STATUS_INVALID_PARAMS);
2804
2805         hci_dev_lock(hdev);
2806
2807         hdev->io_capability = cp->io_capability;
2808
2809         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2810
2811         hci_dev_unlock(hdev);
2812
2813         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2814                                  NULL, 0);
2815 }
2816
2817 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2818 {
2819         struct hci_dev *hdev = conn->hdev;
2820         struct mgmt_pending_cmd *cmd;
2821
2822         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2823                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2824                         continue;
2825
2826                 if (cmd->user_data != conn)
2827                         continue;
2828
2829                 return cmd;
2830         }
2831
2832         return NULL;
2833 }
2834
2835 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2836 {
2837         struct mgmt_rp_pair_device rp;
2838         struct hci_conn *conn = cmd->user_data;
2839         int err;
2840
2841         bacpy(&rp.addr.bdaddr, &conn->dst);
2842         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2843
2844         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2845                                 status, &rp, sizeof(rp));
2846
2847         /* So we don't get further callbacks for this connection */
2848         conn->connect_cfm_cb = NULL;
2849         conn->security_cfm_cb = NULL;
2850         conn->disconn_cfm_cb = NULL;
2851
2852         hci_conn_drop(conn);
2853
2854         /* The device is paired so there is no need to remove
2855          * its connection parameters anymore.
2856          */
2857         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2858
2859         hci_conn_put(conn);
2860
2861         return err;
2862 }
2863
2864 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2865 {
2866         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2867         struct mgmt_pending_cmd *cmd;
2868
2869         cmd = find_pairing(conn);
2870         if (cmd) {
2871                 cmd->cmd_complete(cmd, status);
2872                 mgmt_pending_remove(cmd);
2873         }
2874 }
2875
2876 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2877 {
2878         struct mgmt_pending_cmd *cmd;
2879
2880         BT_DBG("status %u", status);
2881
2882         cmd = find_pairing(conn);
2883         if (!cmd) {
2884                 BT_DBG("Unable to find a pending command");
2885                 return;
2886         }
2887
2888         cmd->cmd_complete(cmd, mgmt_status(status));
2889         mgmt_pending_remove(cmd);
2890 }
2891
2892 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2893 {
2894         struct mgmt_pending_cmd *cmd;
2895
2896         BT_DBG("status %u", status);
2897
2898         if (!status)
2899                 return;
2900
2901         cmd = find_pairing(conn);
2902         if (!cmd) {
2903                 BT_DBG("Unable to find a pending command");
2904                 return;
2905         }
2906
2907         cmd->cmd_complete(cmd, mgmt_status(status));
2908         mgmt_pending_remove(cmd);
2909 }
2910
2911 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2912                        u16 len)
2913 {
2914         struct mgmt_cp_pair_device *cp = data;
2915         struct mgmt_rp_pair_device rp;
2916         struct mgmt_pending_cmd *cmd;
2917         u8 sec_level, auth_type;
2918         struct hci_conn *conn;
2919         int err;
2920
2921         bt_dev_dbg(hdev, "sock %p", sk);
2922
2923         memset(&rp, 0, sizeof(rp));
2924         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2925         rp.addr.type = cp->addr.type;
2926
2927         if (!bdaddr_type_is_valid(cp->addr.type))
2928                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2929                                          MGMT_STATUS_INVALID_PARAMS,
2930                                          &rp, sizeof(rp));
2931
2932         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2933                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2934                                          MGMT_STATUS_INVALID_PARAMS,
2935                                          &rp, sizeof(rp));
2936
2937         hci_dev_lock(hdev);
2938
2939         if (!hdev_is_powered(hdev)) {
2940                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2941                                         MGMT_STATUS_NOT_POWERED, &rp,
2942                                         sizeof(rp));
2943                 goto unlock;
2944         }
2945
2946         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2947                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2948                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2949                                         sizeof(rp));
2950                 goto unlock;
2951         }
2952
2953         sec_level = BT_SECURITY_MEDIUM;
2954         auth_type = HCI_AT_DEDICATED_BONDING;
2955
2956         if (cp->addr.type == BDADDR_BREDR) {
2957                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2958                                        auth_type, CONN_REASON_PAIR_DEVICE);
2959         } else {
2960                 u8 addr_type = le_addr_type(cp->addr.type);
2961                 struct hci_conn_params *p;
2962
2963                 /* When pairing a new device, it is expected to remember
2964                  * this device for future connections. Adding the connection
2965                  * parameter information ahead of time allows tracking
2966                  * of the peripheral preferred values and will speed up any
2967                  * further connection establishment.
2968                  *
2969                  * If connection parameters already exist, then they
2970                  * will be kept and this function does nothing.
2971                  */
2972                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2973
2974                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2975                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2976
2977                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2978                                            sec_level, HCI_LE_CONN_TIMEOUT,
2979                                            CONN_REASON_PAIR_DEVICE);
2980         }
2981
2982         if (IS_ERR(conn)) {
2983                 int status;
2984
2985                 if (PTR_ERR(conn) == -EBUSY)
2986                         status = MGMT_STATUS_BUSY;
2987                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2988                         status = MGMT_STATUS_NOT_SUPPORTED;
2989                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2990                         status = MGMT_STATUS_REJECTED;
2991                 else
2992                         status = MGMT_STATUS_CONNECT_FAILED;
2993
2994                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2995                                         status, &rp, sizeof(rp));
2996                 goto unlock;
2997         }
2998
2999         if (conn->connect_cfm_cb) {
3000                 hci_conn_drop(conn);
3001                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3002                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3003                 goto unlock;
3004         }
3005
3006         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3007         if (!cmd) {
3008                 err = -ENOMEM;
3009                 hci_conn_drop(conn);
3010                 goto unlock;
3011         }
3012
3013         cmd->cmd_complete = pairing_complete;
3014
3015         /* For LE, just connecting isn't a proof that the pairing finished */
3016         if (cp->addr.type == BDADDR_BREDR) {
3017                 conn->connect_cfm_cb = pairing_complete_cb;
3018                 conn->security_cfm_cb = pairing_complete_cb;
3019                 conn->disconn_cfm_cb = pairing_complete_cb;
3020         } else {
3021                 conn->connect_cfm_cb = le_pairing_complete_cb;
3022                 conn->security_cfm_cb = le_pairing_complete_cb;
3023                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3024         }
3025
3026         conn->io_capability = cp->io_cap;
3027         cmd->user_data = hci_conn_get(conn);
3028
3029         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3030             hci_conn_security(conn, sec_level, auth_type, true)) {
3031                 cmd->cmd_complete(cmd, 0);
3032                 mgmt_pending_remove(cmd);
3033         }
3034
3035         err = 0;
3036
3037 unlock:
3038         hci_dev_unlock(hdev);
3039         return err;
3040 }
3041
3042 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3043                               u16 len)
3044 {
3045         struct mgmt_addr_info *addr = data;
3046         struct mgmt_pending_cmd *cmd;
3047         struct hci_conn *conn;
3048         int err;
3049
3050         bt_dev_dbg(hdev, "sock %p", sk);
3051
3052         hci_dev_lock(hdev);
3053
3054         if (!hdev_is_powered(hdev)) {
3055                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3056                                       MGMT_STATUS_NOT_POWERED);
3057                 goto unlock;
3058         }
3059
3060         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3061         if (!cmd) {
3062                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3063                                       MGMT_STATUS_INVALID_PARAMS);
3064                 goto unlock;
3065         }
3066
3067         conn = cmd->user_data;
3068
3069         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3070                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3071                                       MGMT_STATUS_INVALID_PARAMS);
3072                 goto unlock;
3073         }
3074
3075         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3076         mgmt_pending_remove(cmd);
3077
3078         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3079                                 addr, sizeof(*addr));
3080
3081         /* Since user doesn't want to proceed with the connection, abort any
3082          * ongoing pairing and then terminate the link if it was created
3083          * because of the pair device action.
3084          */
3085         if (addr->type == BDADDR_BREDR)
3086                 hci_remove_link_key(hdev, &addr->bdaddr);
3087         else
3088                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3089                                               le_addr_type(addr->type));
3090
3091         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3092                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3093
3094 unlock:
3095         hci_dev_unlock(hdev);
3096         return err;
3097 }
3098
3099 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3100                              struct mgmt_addr_info *addr, u16 mgmt_op,
3101                              u16 hci_op, __le32 passkey)
3102 {
3103         struct mgmt_pending_cmd *cmd;
3104         struct hci_conn *conn;
3105         int err;
3106
3107         hci_dev_lock(hdev);
3108
3109         if (!hdev_is_powered(hdev)) {
3110                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3111                                         MGMT_STATUS_NOT_POWERED, addr,
3112                                         sizeof(*addr));
3113                 goto done;
3114         }
3115
3116         if (addr->type == BDADDR_BREDR)
3117                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3118         else
3119                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3120                                                le_addr_type(addr->type));
3121
3122         if (!conn) {
3123                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3124                                         MGMT_STATUS_NOT_CONNECTED, addr,
3125                                         sizeof(*addr));
3126                 goto done;
3127         }
3128
3129         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3130                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3131                 if (!err)
3132                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3133                                                 MGMT_STATUS_SUCCESS, addr,
3134                                                 sizeof(*addr));
3135                 else
3136                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3137                                                 MGMT_STATUS_FAILED, addr,
3138                                                 sizeof(*addr));
3139
3140                 goto done;
3141         }
3142
3143         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3144         if (!cmd) {
3145                 err = -ENOMEM;
3146                 goto done;
3147         }
3148
3149         cmd->cmd_complete = addr_cmd_complete;
3150
3151         /* Continue with pairing via HCI */
3152         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3153                 struct hci_cp_user_passkey_reply cp;
3154
3155                 bacpy(&cp.bdaddr, &addr->bdaddr);
3156                 cp.passkey = passkey;
3157                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3158         } else
3159                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3160                                    &addr->bdaddr);
3161
3162         if (err < 0)
3163                 mgmt_pending_remove(cmd);
3164
3165 done:
3166         hci_dev_unlock(hdev);
3167         return err;
3168 }
3169
3170 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3171                               void *data, u16 len)
3172 {
3173         struct mgmt_cp_pin_code_neg_reply *cp = data;
3174
3175         bt_dev_dbg(hdev, "sock %p", sk);
3176
3177         return user_pairing_resp(sk, hdev, &cp->addr,
3178                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3179                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3180 }
3181
3182 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3183                               u16 len)
3184 {
3185         struct mgmt_cp_user_confirm_reply *cp = data;
3186
3187         bt_dev_dbg(hdev, "sock %p", sk);
3188
3189         if (len != sizeof(*cp))
3190                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3191                                        MGMT_STATUS_INVALID_PARAMS);
3192
3193         return user_pairing_resp(sk, hdev, &cp->addr,
3194                                  MGMT_OP_USER_CONFIRM_REPLY,
3195                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3196 }
3197
3198 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3199                                   void *data, u16 len)
3200 {
3201         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3202
3203         bt_dev_dbg(hdev, "sock %p", sk);
3204
3205         return user_pairing_resp(sk, hdev, &cp->addr,
3206                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3207                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3208 }
3209
3210 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3211                               u16 len)
3212 {
3213         struct mgmt_cp_user_passkey_reply *cp = data;
3214
3215         bt_dev_dbg(hdev, "sock %p", sk);
3216
3217         return user_pairing_resp(sk, hdev, &cp->addr,
3218                                  MGMT_OP_USER_PASSKEY_REPLY,
3219                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3220 }
3221
3222 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3223                                   void *data, u16 len)
3224 {
3225         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3226
3227         bt_dev_dbg(hdev, "sock %p", sk);
3228
3229         return user_pairing_resp(sk, hdev, &cp->addr,
3230                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3231                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3232 }
3233
3234 static void adv_expire(struct hci_dev *hdev, u32 flags)
3235 {
3236         struct adv_info *adv_instance;
3237         struct hci_request req;
3238         int err;
3239
3240         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3241         if (!adv_instance)
3242                 return;
3243
3244         /* stop if current instance doesn't need to be changed */
3245         if (!(adv_instance->flags & flags))
3246                 return;
3247
3248         cancel_adv_timeout(hdev);
3249
3250         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3251         if (!adv_instance)
3252                 return;
3253
3254         hci_req_init(&req, hdev);
3255         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3256                                               true);
3257         if (err)
3258                 return;
3259
3260         hci_req_run(&req, NULL);
3261 }
3262
3263 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3264 {
3265         struct mgmt_cp_set_local_name *cp;
3266         struct mgmt_pending_cmd *cmd;
3267
3268         bt_dev_dbg(hdev, "status 0x%02x", status);
3269
3270         hci_dev_lock(hdev);
3271
3272         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3273         if (!cmd)
3274                 goto unlock;
3275
3276         cp = cmd->param;
3277
3278         if (status) {
3279                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3280                                 mgmt_status(status));
3281         } else {
3282                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3283                                   cp, sizeof(*cp));
3284
3285                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3286                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3287         }
3288
3289         mgmt_pending_remove(cmd);
3290
3291 unlock:
3292         hci_dev_unlock(hdev);
3293 }
3294
3295 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3296                           u16 len)
3297 {
3298         struct mgmt_cp_set_local_name *cp = data;
3299         struct mgmt_pending_cmd *cmd;
3300         struct hci_request req;
3301         int err;
3302
3303         bt_dev_dbg(hdev, "sock %p", sk);
3304
3305         hci_dev_lock(hdev);
3306
3307         /* If the old values are the same as the new ones just return a
3308          * direct command complete event.
3309          */
3310         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3311             !memcmp(hdev->short_name, cp->short_name,
3312                     sizeof(hdev->short_name))) {
3313                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3314                                         data, len);
3315                 goto failed;
3316         }
3317
3318         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3319
3320         if (!hdev_is_powered(hdev)) {
3321                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3322
3323                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3324                                         data, len);
3325                 if (err < 0)
3326                         goto failed;
3327
3328                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3329                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3330                 ext_info_changed(hdev, sk);
3331
3332                 goto failed;
3333         }
3334
3335         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3336         if (!cmd) {
3337                 err = -ENOMEM;
3338                 goto failed;
3339         }
3340
3341         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3342
3343         hci_req_init(&req, hdev);
3344
3345         if (lmp_bredr_capable(hdev)) {
3346                 __hci_req_update_name(&req);
3347                 __hci_req_update_eir(&req);
3348         }
3349
3350         /* The name is stored in the scan response data and so
3351          * no need to update the advertising data here.
3352          */
3353         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3354                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3355
3356         err = hci_req_run(&req, set_name_complete);
3357         if (err < 0)
3358                 mgmt_pending_remove(cmd);
3359
3360 failed:
3361         hci_dev_unlock(hdev);
3362         return err;
3363 }
3364
3365 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3366                           u16 len)
3367 {
3368         struct mgmt_cp_set_appearance *cp = data;
3369         u16 appearance;
3370         int err;
3371
3372         bt_dev_dbg(hdev, "sock %p", sk);
3373
3374         if (!lmp_le_capable(hdev))
3375                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3376                                        MGMT_STATUS_NOT_SUPPORTED);
3377
3378         appearance = le16_to_cpu(cp->appearance);
3379
3380         hci_dev_lock(hdev);
3381
3382         if (hdev->appearance != appearance) {
3383                 hdev->appearance = appearance;
3384
3385                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3386                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3387
3388                 ext_info_changed(hdev, sk);
3389         }
3390
3391         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3392                                 0);
3393
3394         hci_dev_unlock(hdev);
3395
3396         return err;
3397 }
3398
3399 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3400                                  void *data, u16 len)
3401 {
3402         struct mgmt_rp_get_phy_configuration rp;
3403
3404         bt_dev_dbg(hdev, "sock %p", sk);
3405
3406         hci_dev_lock(hdev);
3407
3408         memset(&rp, 0, sizeof(rp));
3409
3410         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3411         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3412         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3413
3414         hci_dev_unlock(hdev);
3415
3416         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3417                                  &rp, sizeof(rp));
3418 }
3419
3420 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3421 {
3422         struct mgmt_ev_phy_configuration_changed ev;
3423
3424         memset(&ev, 0, sizeof(ev));
3425
3426         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3427
3428         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3429                           sizeof(ev), skip);
3430 }
3431
3432 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3433                                      u16 opcode, struct sk_buff *skb)
3434 {
3435         struct mgmt_pending_cmd *cmd;
3436
3437         bt_dev_dbg(hdev, "status 0x%02x", status);
3438
3439         hci_dev_lock(hdev);
3440
3441         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3442         if (!cmd)
3443                 goto unlock;
3444
3445         if (status) {
3446                 mgmt_cmd_status(cmd->sk, hdev->id,
3447                                 MGMT_OP_SET_PHY_CONFIGURATION,
3448                                 mgmt_status(status));
3449         } else {
3450                 mgmt_cmd_complete(cmd->sk, hdev->id,
3451                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3452                                   NULL, 0);
3453
3454                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3455         }
3456
3457         mgmt_pending_remove(cmd);
3458
3459 unlock:
3460         hci_dev_unlock(hdev);
3461 }
3462
3463 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3464                                  void *data, u16 len)
3465 {
3466         struct mgmt_cp_set_phy_configuration *cp = data;
3467         struct hci_cp_le_set_default_phy cp_phy;
3468         struct mgmt_pending_cmd *cmd;
3469         struct hci_request req;
3470         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3471         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3472         bool changed = false;
3473         int err;
3474
3475         bt_dev_dbg(hdev, "sock %p", sk);
3476
3477         configurable_phys = get_configurable_phys(hdev);
3478         supported_phys = get_supported_phys(hdev);
3479         selected_phys = __le32_to_cpu(cp->selected_phys);
3480
3481         if (selected_phys & ~supported_phys)
3482                 return mgmt_cmd_status(sk, hdev->id,
3483                                        MGMT_OP_SET_PHY_CONFIGURATION,
3484                                        MGMT_STATUS_INVALID_PARAMS);
3485
3486         unconfigure_phys = supported_phys & ~configurable_phys;
3487
3488         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3489                 return mgmt_cmd_status(sk, hdev->id,
3490                                        MGMT_OP_SET_PHY_CONFIGURATION,
3491                                        MGMT_STATUS_INVALID_PARAMS);
3492
3493         if (selected_phys == get_selected_phys(hdev))
3494                 return mgmt_cmd_complete(sk, hdev->id,
3495                                          MGMT_OP_SET_PHY_CONFIGURATION,
3496                                          0, NULL, 0);
3497
3498         hci_dev_lock(hdev);
3499
3500         if (!hdev_is_powered(hdev)) {
3501                 err = mgmt_cmd_status(sk, hdev->id,
3502                                       MGMT_OP_SET_PHY_CONFIGURATION,
3503                                       MGMT_STATUS_REJECTED);
3504                 goto unlock;
3505         }
3506
3507         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3508                 err = mgmt_cmd_status(sk, hdev->id,
3509                                       MGMT_OP_SET_PHY_CONFIGURATION,
3510                                       MGMT_STATUS_BUSY);
3511                 goto unlock;
3512         }
3513
3514         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3515                 pkt_type |= (HCI_DH3 | HCI_DM3);
3516         else
3517                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3518
3519         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3520                 pkt_type |= (HCI_DH5 | HCI_DM5);
3521         else
3522                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3523
3524         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3525                 pkt_type &= ~HCI_2DH1;
3526         else
3527                 pkt_type |= HCI_2DH1;
3528
3529         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3530                 pkt_type &= ~HCI_2DH3;
3531         else
3532                 pkt_type |= HCI_2DH3;
3533
3534         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3535                 pkt_type &= ~HCI_2DH5;
3536         else
3537                 pkt_type |= HCI_2DH5;
3538
3539         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3540                 pkt_type &= ~HCI_3DH1;
3541         else
3542                 pkt_type |= HCI_3DH1;
3543
3544         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3545                 pkt_type &= ~HCI_3DH3;
3546         else
3547                 pkt_type |= HCI_3DH3;
3548
3549         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3550                 pkt_type &= ~HCI_3DH5;
3551         else
3552                 pkt_type |= HCI_3DH5;
3553
3554         if (pkt_type != hdev->pkt_type) {
3555                 hdev->pkt_type = pkt_type;
3556                 changed = true;
3557         }
3558
3559         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3560             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3561                 if (changed)
3562                         mgmt_phy_configuration_changed(hdev, sk);
3563
3564                 err = mgmt_cmd_complete(sk, hdev->id,
3565                                         MGMT_OP_SET_PHY_CONFIGURATION,
3566                                         0, NULL, 0);
3567
3568                 goto unlock;
3569         }
3570
3571         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3572                                len);
3573         if (!cmd) {
3574                 err = -ENOMEM;
3575                 goto unlock;
3576         }
3577
3578         hci_req_init(&req, hdev);
3579
3580         memset(&cp_phy, 0, sizeof(cp_phy));
3581
3582         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3583                 cp_phy.all_phys |= 0x01;
3584
3585         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3586                 cp_phy.all_phys |= 0x02;
3587
3588         if (selected_phys & MGMT_PHY_LE_1M_TX)
3589                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3590
3591         if (selected_phys & MGMT_PHY_LE_2M_TX)
3592                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3593
3594         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3595                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3596
3597         if (selected_phys & MGMT_PHY_LE_1M_RX)
3598                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3599
3600         if (selected_phys & MGMT_PHY_LE_2M_RX)
3601                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3602
3603         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3604                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3605
3606         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3607
3608         err = hci_req_run_skb(&req, set_default_phy_complete);
3609         if (err < 0)
3610                 mgmt_pending_remove(cmd);
3611
3612 unlock:
3613         hci_dev_unlock(hdev);
3614
3615         return err;
3616 }
3617
3618 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3619                             u16 len)
3620 {
3621         int err = MGMT_STATUS_SUCCESS;
3622         struct mgmt_cp_set_blocked_keys *keys = data;
3623         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3624                                    sizeof(struct mgmt_blocked_key_info));
3625         u16 key_count, expected_len;
3626         int i;
3627
3628         bt_dev_dbg(hdev, "sock %p", sk);
3629
3630         key_count = __le16_to_cpu(keys->key_count);
3631         if (key_count > max_key_count) {
3632                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3633                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3634                                        MGMT_STATUS_INVALID_PARAMS);
3635         }
3636
3637         expected_len = struct_size(keys, keys, key_count);
3638         if (expected_len != len) {
3639                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3640                            expected_len, len);
3641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3642                                        MGMT_STATUS_INVALID_PARAMS);
3643         }
3644
3645         hci_dev_lock(hdev);
3646
3647         hci_blocked_keys_clear(hdev);
3648
3649         for (i = 0; i < keys->key_count; ++i) {
3650                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3651
3652                 if (!b) {
3653                         err = MGMT_STATUS_NO_RESOURCES;
3654                         break;
3655                 }
3656
3657                 b->type = keys->keys[i].type;
3658                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3659                 list_add_rcu(&b->list, &hdev->blocked_keys);
3660         }
3661         hci_dev_unlock(hdev);
3662
3663         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3664                                 err, NULL, 0);
3665 }
3666
3667 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3668                                void *data, u16 len)
3669 {
3670         struct mgmt_mode *cp = data;
3671         int err;
3672         bool changed = false;
3673
3674         bt_dev_dbg(hdev, "sock %p", sk);
3675
3676         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3677                 return mgmt_cmd_status(sk, hdev->id,
3678                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3679                                        MGMT_STATUS_NOT_SUPPORTED);
3680
3681         if (cp->val != 0x00 && cp->val != 0x01)
3682                 return mgmt_cmd_status(sk, hdev->id,
3683                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3684                                        MGMT_STATUS_INVALID_PARAMS);
3685
3686         hci_dev_lock(hdev);
3687
3688         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3689                 err = mgmt_cmd_status(sk, hdev->id,
3690                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3691                                       MGMT_STATUS_BUSY);
3692                 goto unlock;
3693         }
3694
3695         if (hdev_is_powered(hdev) &&
3696             !!cp->val != hci_dev_test_flag(hdev,
3697                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3698                 err = mgmt_cmd_status(sk, hdev->id,
3699                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3700                                       MGMT_STATUS_REJECTED);
3701                 goto unlock;
3702         }
3703
3704         if (cp->val)
3705                 changed = !hci_dev_test_and_set_flag(hdev,
3706                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3707         else
3708                 changed = hci_dev_test_and_clear_flag(hdev,
3709                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3710
3711         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3712         if (err < 0)
3713                 goto unlock;
3714
3715         if (changed)
3716                 err = new_settings(hdev, sk);
3717
3718 unlock:
3719         hci_dev_unlock(hdev);
3720         return err;
3721 }
3722
3723 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3724                                void *data, u16 data_len)
3725 {
3726         char buf[20];
3727         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3728         u16 cap_len = 0;
3729         u8 flags = 0;
3730         u8 tx_power_range[2];
3731
3732         bt_dev_dbg(hdev, "sock %p", sk);
3733
3734         memset(&buf, 0, sizeof(buf));
3735
3736         hci_dev_lock(hdev);
3737
3738         /* When the Read Simple Pairing Options command is supported, then
3739          * the remote public key validation is supported.
3740          *
3741          * Alternatively, when Microsoft extensions are available, they can
3742          * indicate support for public key validation as well.
3743          */
3744         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3745                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3746
3747         flags |= 0x02;          /* Remote public key validation (LE) */
3748
3749         /* When the Read Encryption Key Size command is supported, then the
3750          * encryption key size is enforced.
3751          */
3752         if (hdev->commands[20] & 0x10)
3753                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3754
3755         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3756
3757         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3758                                   &flags, 1);
3759
3760         /* When the Read Simple Pairing Options command is supported, then
3761          * also max encryption key size information is provided.
3762          */
3763         if (hdev->commands[41] & 0x08)
3764                 cap_len = eir_append_le16(rp->cap, cap_len,
3765                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3766                                           hdev->max_enc_key_size);
3767
3768         cap_len = eir_append_le16(rp->cap, cap_len,
3769                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3770                                   SMP_MAX_ENC_KEY_SIZE);
3771
3772         /* Append the min/max LE tx power parameters if we were able to fetch
3773          * it from the controller
3774          */
3775         if (hdev->commands[38] & 0x80) {
3776                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3777                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3778                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3779                                           tx_power_range, 2);
3780         }
3781
3782         rp->cap_len = cpu_to_le16(cap_len);
3783
3784         hci_dev_unlock(hdev);
3785
3786         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3787                                  rp, sizeof(*rp) + cap_len);
3788 }
3789
3790 #ifdef CONFIG_BT_FEATURE_DEBUG
3791 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3792 static const u8 debug_uuid[16] = {
3793         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3794         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3795 };
3796 #endif
3797
3798 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3799 static const u8 simult_central_periph_uuid[16] = {
3800         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3801         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3802 };
3803
3804 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3805 static const u8 rpa_resolution_uuid[16] = {
3806         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3807         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3808 };
3809
3810 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3811                                   void *data, u16 data_len)
3812 {
3813         char buf[62];   /* Enough space for 3 features */
3814         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3815         u16 idx = 0;
3816         u32 flags;
3817
3818         bt_dev_dbg(hdev, "sock %p", sk);
3819
3820         memset(&buf, 0, sizeof(buf));
3821
3822 #ifdef CONFIG_BT_FEATURE_DEBUG
3823         if (!hdev) {
3824                 flags = bt_dbg_get() ? BIT(0) : 0;
3825
3826                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3827                 rp->features[idx].flags = cpu_to_le32(flags);
3828                 idx++;
3829         }
3830 #endif
3831
3832         if (hdev) {
3833                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3834                     (hdev->le_states[4] & 0x08) &&      /* Central */
3835                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3836                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3837                         flags = BIT(0);
3838                 else
3839                         flags = 0;
3840
3841                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3842                 rp->features[idx].flags = cpu_to_le32(flags);
3843                 idx++;
3844         }
3845
3846         if (hdev && use_ll_privacy(hdev)) {
3847                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3848                         flags = BIT(0) | BIT(1);
3849                 else
3850                         flags = BIT(1);
3851
3852                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3853                 rp->features[idx].flags = cpu_to_le32(flags);
3854                 idx++;
3855         }
3856
3857         rp->feature_count = cpu_to_le16(idx);
3858
3859         /* After reading the experimental features information, enable
3860          * the events to update client on any future change.
3861          */
3862         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3863
3864         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3865                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3866                                  0, rp, sizeof(*rp) + (20 * idx));
3867 }
3868
3869 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3870                                           struct sock *skip)
3871 {
3872         struct mgmt_ev_exp_feature_changed ev;
3873
3874         memset(&ev, 0, sizeof(ev));
3875         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3876         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3877
3878         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3879                                   &ev, sizeof(ev),
3880                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3881
3882 }
3883
3884 #ifdef CONFIG_BT_FEATURE_DEBUG
3885 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3886 {
3887         struct mgmt_ev_exp_feature_changed ev;
3888
3889         memset(&ev, 0, sizeof(ev));
3890         memcpy(ev.uuid, debug_uuid, 16);
3891         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3892
3893         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3894                                   &ev, sizeof(ev),
3895                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3896 }
3897 #endif
3898
3899 #define EXP_FEAT(_uuid, _set_func)      \
3900 {                                       \
3901         .uuid = _uuid,                  \
3902         .set_func = _set_func,          \
3903 }
3904
3905 /* The zero key uuid is special. Multiple exp features are set through it. */
3906 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
3907                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3908 {
3909         struct mgmt_rp_set_exp_feature rp;
3910
3911         memset(rp.uuid, 0, 16);
3912         rp.flags = cpu_to_le32(0);
3913
3914 #ifdef CONFIG_BT_FEATURE_DEBUG
3915         if (!hdev) {
3916                 bool changed = bt_dbg_get();
3917
3918                 bt_dbg_set(false);
3919
3920                 if (changed)
3921                         exp_debug_feature_changed(false, sk);
3922         }
3923 #endif
3924
3925         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3926                 bool changed;
3927
3928                 changed = hci_dev_test_and_clear_flag(hdev,
3929                                                       HCI_ENABLE_LL_PRIVACY);
3930                 if (changed)
3931                         exp_ll_privacy_feature_changed(false, hdev, sk);
3932         }
3933
3934         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3935
3936         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3937                                  MGMT_OP_SET_EXP_FEATURE, 0,
3938                                  &rp, sizeof(rp));
3939 }
3940
3941 #ifdef CONFIG_BT_FEATURE_DEBUG
3942 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
3943                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3944 {
3945         struct mgmt_rp_set_exp_feature rp;
3946
3947         bool val, changed;
3948         int err;
3949
3950         /* Command requires to use the non-controller index */
3951         if (hdev)
3952                 return mgmt_cmd_status(sk, hdev->id,
3953                                        MGMT_OP_SET_EXP_FEATURE,
3954                                        MGMT_STATUS_INVALID_INDEX);
3955
3956         /* Parameters are limited to a single octet */
3957         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3958                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3959                                        MGMT_OP_SET_EXP_FEATURE,
3960                                        MGMT_STATUS_INVALID_PARAMS);
3961
3962         /* Only boolean on/off is supported */
3963         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3964                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3965                                        MGMT_OP_SET_EXP_FEATURE,
3966                                        MGMT_STATUS_INVALID_PARAMS);
3967
3968         val = !!cp->param[0];
3969         changed = val ? !bt_dbg_get() : bt_dbg_get();
3970         bt_dbg_set(val);
3971
3972         memcpy(rp.uuid, debug_uuid, 16);
3973         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3974
3975         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3976
3977         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3978                                 MGMT_OP_SET_EXP_FEATURE, 0,
3979                                 &rp, sizeof(rp));
3980
3981         if (changed)
3982                 exp_debug_feature_changed(val, sk);
3983
3984         return err;
3985 }
3986 #endif
3987
3988 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
3989                                    struct mgmt_cp_set_exp_feature *cp,
3990                                    u16 data_len)
3991 {
3992         struct mgmt_rp_set_exp_feature rp;
3993         bool val, changed;
3994         int err;
3995         u32 flags;
3996
3997         /* Command requires to use the controller index */
3998         if (!hdev)
3999                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4000                                        MGMT_OP_SET_EXP_FEATURE,
4001                                        MGMT_STATUS_INVALID_INDEX);
4002
4003         /* Changes can only be made when controller is powered down */
4004         if (hdev_is_powered(hdev))
4005                 return mgmt_cmd_status(sk, hdev->id,
4006                                        MGMT_OP_SET_EXP_FEATURE,
4007                                        MGMT_STATUS_REJECTED);
4008
4009         /* Parameters are limited to a single octet */
4010         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4011                 return mgmt_cmd_status(sk, hdev->id,
4012                                        MGMT_OP_SET_EXP_FEATURE,
4013                                        MGMT_STATUS_INVALID_PARAMS);
4014
4015         /* Only boolean on/off is supported */
4016         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4017                 return mgmt_cmd_status(sk, hdev->id,
4018                                        MGMT_OP_SET_EXP_FEATURE,
4019                                        MGMT_STATUS_INVALID_PARAMS);
4020
4021         val = !!cp->param[0];
4022
4023         if (val) {
4024                 changed = !hci_dev_test_and_set_flag(hdev,
4025                                                      HCI_ENABLE_LL_PRIVACY);
4026                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4027
4028                 /* Enable LL privacy + supported settings changed */
4029                 flags = BIT(0) | BIT(1);
4030         } else {
4031                 changed = hci_dev_test_and_clear_flag(hdev,
4032                                                       HCI_ENABLE_LL_PRIVACY);
4033
4034                 /* Disable LL privacy + supported settings changed */
4035                 flags = BIT(1);
4036         }
4037
4038         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4039         rp.flags = cpu_to_le32(flags);
4040
4041         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4042
4043         err = mgmt_cmd_complete(sk, hdev->id,
4044                                 MGMT_OP_SET_EXP_FEATURE, 0,
4045                                 &rp, sizeof(rp));
4046
4047         if (changed)
4048                 exp_ll_privacy_feature_changed(val, hdev, sk);
4049
4050         return err;
4051 }
4052
4053 static const struct mgmt_exp_feature {
4054         const u8 *uuid;
4055         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4056                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4057 } exp_features[] = {
4058         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4059 #ifdef CONFIG_BT_FEATURE_DEBUG
4060         EXP_FEAT(debug_uuid, set_debug_func),
4061 #endif
4062         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4063
4064         /* end with a null feature */
4065         EXP_FEAT(NULL, NULL)
4066 };
4067
4068 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
4069                            void *data, u16 data_len)
4070 {
4071         struct mgmt_cp_set_exp_feature *cp = data;
4072         size_t i = 0;
4073
4074         bt_dev_dbg(hdev, "sock %p", sk);
4075
4076         for (i = 0; exp_features[i].uuid; i++) {
4077                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
4078                         return exp_features[i].set_func(sk, hdev, cp, data_len);
4079         }
4080
4081         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4082                                MGMT_OP_SET_EXP_FEATURE,
4083                                MGMT_STATUS_NOT_SUPPORTED);
4084 }
4085
4086 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4087
4088 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4089                             u16 data_len)
4090 {
4091         struct mgmt_cp_get_device_flags *cp = data;
4092         struct mgmt_rp_get_device_flags rp;
4093         struct bdaddr_list_with_flags *br_params;
4094         struct hci_conn_params *params;
4095         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4096         u32 current_flags = 0;
4097         u8 status = MGMT_STATUS_INVALID_PARAMS;
4098
4099         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4100                    &cp->addr.bdaddr, cp->addr.type);
4101
4102         hci_dev_lock(hdev);
4103
4104         memset(&rp, 0, sizeof(rp));
4105
4106         if (cp->addr.type == BDADDR_BREDR) {
4107                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4108                                                               &cp->addr.bdaddr,
4109                                                               cp->addr.type);
4110                 if (!br_params)
4111                         goto done;
4112
4113                 current_flags = br_params->current_flags;
4114         } else {
4115                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4116                                                 le_addr_type(cp->addr.type));
4117
4118                 if (!params)
4119                         goto done;
4120
4121                 current_flags = params->current_flags;
4122         }
4123
4124         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4125         rp.addr.type = cp->addr.type;
4126         rp.supported_flags = cpu_to_le32(supported_flags);
4127         rp.current_flags = cpu_to_le32(current_flags);
4128
4129         status = MGMT_STATUS_SUCCESS;
4130
4131 done:
4132         hci_dev_unlock(hdev);
4133
4134         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4135                                 &rp, sizeof(rp));
4136 }
4137
4138 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4139                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4140                                  u32 supported_flags, u32 current_flags)
4141 {
4142         struct mgmt_ev_device_flags_changed ev;
4143
4144         bacpy(&ev.addr.bdaddr, bdaddr);
4145         ev.addr.type = bdaddr_type;
4146         ev.supported_flags = cpu_to_le32(supported_flags);
4147         ev.current_flags = cpu_to_le32(current_flags);
4148
4149         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4150 }
4151
4152 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4153                             u16 len)
4154 {
4155         struct mgmt_cp_set_device_flags *cp = data;
4156         struct bdaddr_list_with_flags *br_params;
4157         struct hci_conn_params *params;
4158         u8 status = MGMT_STATUS_INVALID_PARAMS;
4159         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4160         u32 current_flags = __le32_to_cpu(cp->current_flags);
4161
4162         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4163                    &cp->addr.bdaddr, cp->addr.type,
4164                    __le32_to_cpu(current_flags));
4165
4166         if ((supported_flags | current_flags) != supported_flags) {
4167                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4168                             current_flags, supported_flags);
4169                 goto done;
4170         }
4171
4172         hci_dev_lock(hdev);
4173
4174         if (cp->addr.type == BDADDR_BREDR) {
4175                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4176                                                               &cp->addr.bdaddr,
4177                                                               cp->addr.type);
4178
4179                 if (br_params) {
4180                         br_params->current_flags = current_flags;
4181                         status = MGMT_STATUS_SUCCESS;
4182                 } else {
4183                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4184                                     &cp->addr.bdaddr, cp->addr.type);
4185                 }
4186         } else {
4187                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4188                                                 le_addr_type(cp->addr.type));
4189                 if (params) {
4190                         params->current_flags = current_flags;
4191                         status = MGMT_STATUS_SUCCESS;
4192                 } else {
4193                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4194                                     &cp->addr.bdaddr,
4195                                     le_addr_type(cp->addr.type));
4196                 }
4197         }
4198
4199 done:
4200         hci_dev_unlock(hdev);
4201
4202         if (status == MGMT_STATUS_SUCCESS)
4203                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4204                                      supported_flags, current_flags);
4205
4206         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4207                                  &cp->addr, sizeof(cp->addr));
4208 }
4209
4210 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4211                                    u16 handle)
4212 {
4213         struct mgmt_ev_adv_monitor_added ev;
4214
4215         ev.monitor_handle = cpu_to_le16(handle);
4216
4217         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4218 }
4219
4220 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4221 {
4222         struct mgmt_ev_adv_monitor_removed ev;
4223         struct mgmt_pending_cmd *cmd;
4224         struct sock *sk_skip = NULL;
4225         struct mgmt_cp_remove_adv_monitor *cp;
4226
4227         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4228         if (cmd) {
4229                 cp = cmd->param;
4230
4231                 if (cp->monitor_handle)
4232                         sk_skip = cmd->sk;
4233         }
4234
4235         ev.monitor_handle = cpu_to_le16(handle);
4236
4237         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4238 }
4239
4240 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4241                                  void *data, u16 len)
4242 {
4243         struct adv_monitor *monitor = NULL;
4244         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4245         int handle, err;
4246         size_t rp_size = 0;
4247         __u32 supported = 0;
4248         __u32 enabled = 0;
4249         __u16 num_handles = 0;
4250         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4251
4252         BT_DBG("request for %s", hdev->name);
4253
4254         hci_dev_lock(hdev);
4255
4256         if (msft_monitor_supported(hdev))
4257                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4258
4259         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4260                 handles[num_handles++] = monitor->handle;
4261
4262         hci_dev_unlock(hdev);
4263
4264         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4265         rp = kmalloc(rp_size, GFP_KERNEL);
4266         if (!rp)
4267                 return -ENOMEM;
4268
4269         /* All supported features are currently enabled */
4270         enabled = supported;
4271
4272         rp->supported_features = cpu_to_le32(supported);
4273         rp->enabled_features = cpu_to_le32(enabled);
4274         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4275         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4276         rp->num_handles = cpu_to_le16(num_handles);
4277         if (num_handles)
4278                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4279
4280         err = mgmt_cmd_complete(sk, hdev->id,
4281                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4282                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4283
4284         kfree(rp);
4285
4286         return err;
4287 }
4288
4289 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4290 {
4291         struct mgmt_rp_add_adv_patterns_monitor rp;
4292         struct mgmt_pending_cmd *cmd;
4293         struct adv_monitor *monitor;
4294         int err = 0;
4295
4296         hci_dev_lock(hdev);
4297
4298         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4299         if (!cmd) {
4300                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4301                 if (!cmd)
4302                         goto done;
4303         }
4304
4305         monitor = cmd->user_data;
4306         rp.monitor_handle = cpu_to_le16(monitor->handle);
4307
4308         if (!status) {
4309                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4310                 hdev->adv_monitors_cnt++;
4311                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4312                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4313                 hci_update_background_scan(hdev);
4314         }
4315
4316         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4317                                 mgmt_status(status), &rp, sizeof(rp));
4318         mgmt_pending_remove(cmd);
4319
4320 done:
4321         hci_dev_unlock(hdev);
4322         bt_dev_dbg(hdev, "add monitor %d complete, status %u",
4323                    rp.monitor_handle, status);
4324
4325         return err;
4326 }
4327
4328 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4329                                       struct adv_monitor *m, u8 status,
4330                                       void *data, u16 len, u16 op)
4331 {
4332         struct mgmt_rp_add_adv_patterns_monitor rp;
4333         struct mgmt_pending_cmd *cmd;
4334         int err;
4335         bool pending;
4336
4337         hci_dev_lock(hdev);
4338
4339         if (status)
4340                 goto unlock;
4341
4342         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4343             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4344             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4345             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4346                 status = MGMT_STATUS_BUSY;
4347                 goto unlock;
4348         }
4349
4350         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4351         if (!cmd) {
4352                 status = MGMT_STATUS_NO_RESOURCES;
4353                 goto unlock;
4354         }
4355
4356         cmd->user_data = m;
4357         pending = hci_add_adv_monitor(hdev, m, &err);
4358         if (err) {
4359                 if (err == -ENOSPC || err == -ENOMEM)
4360                         status = MGMT_STATUS_NO_RESOURCES;
4361                 else if (err == -EINVAL)
4362                         status = MGMT_STATUS_INVALID_PARAMS;
4363                 else
4364                         status = MGMT_STATUS_FAILED;
4365
4366                 mgmt_pending_remove(cmd);
4367                 goto unlock;
4368         }
4369
4370         if (!pending) {
4371                 mgmt_pending_remove(cmd);
4372                 rp.monitor_handle = cpu_to_le16(m->handle);
4373                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4374                 m->state = ADV_MONITOR_STATE_REGISTERED;
4375                 hdev->adv_monitors_cnt++;
4376
4377                 hci_dev_unlock(hdev);
4378                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4379                                          &rp, sizeof(rp));
4380         }
4381
4382         hci_dev_unlock(hdev);
4383
4384         return 0;
4385
4386 unlock:
4387         hci_free_adv_monitor(hdev, m);
4388         hci_dev_unlock(hdev);
4389         return mgmt_cmd_status(sk, hdev->id, op, status);
4390 }
4391
4392 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4393                                    struct mgmt_adv_rssi_thresholds *rssi)
4394 {
4395         if (rssi) {
4396                 m->rssi.low_threshold = rssi->low_threshold;
4397                 m->rssi.low_threshold_timeout =
4398                     __le16_to_cpu(rssi->low_threshold_timeout);
4399                 m->rssi.high_threshold = rssi->high_threshold;
4400                 m->rssi.high_threshold_timeout =
4401                     __le16_to_cpu(rssi->high_threshold_timeout);
4402                 m->rssi.sampling_period = rssi->sampling_period;
4403         } else {
4404                 /* Default values. These numbers are the least constricting
4405                  * parameters for MSFT API to work, so it behaves as if there
4406                  * are no rssi parameter to consider. May need to be changed
4407                  * if other API are to be supported.
4408                  */
4409                 m->rssi.low_threshold = -127;
4410                 m->rssi.low_threshold_timeout = 60;
4411                 m->rssi.high_threshold = -127;
4412                 m->rssi.high_threshold_timeout = 0;
4413                 m->rssi.sampling_period = 0;
4414         }
4415 }
4416
4417 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4418                                     struct mgmt_adv_pattern *patterns)
4419 {
4420         u8 offset = 0, length = 0;
4421         struct adv_pattern *p = NULL;
4422         int i;
4423
4424         for (i = 0; i < pattern_count; i++) {
4425                 offset = patterns[i].offset;
4426                 length = patterns[i].length;
4427                 if (offset >= HCI_MAX_AD_LENGTH ||
4428                     length > HCI_MAX_AD_LENGTH ||
4429                     (offset + length) > HCI_MAX_AD_LENGTH)
4430                         return MGMT_STATUS_INVALID_PARAMS;
4431
4432                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4433                 if (!p)
4434                         return MGMT_STATUS_NO_RESOURCES;
4435
4436                 p->ad_type = patterns[i].ad_type;
4437                 p->offset = patterns[i].offset;
4438                 p->length = patterns[i].length;
4439                 memcpy(p->value, patterns[i].value, p->length);
4440
4441                 INIT_LIST_HEAD(&p->list);
4442                 list_add(&p->list, &m->patterns);
4443         }
4444
4445         return MGMT_STATUS_SUCCESS;
4446 }
4447
4448 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4449                                     void *data, u16 len)
4450 {
4451         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4452         struct adv_monitor *m = NULL;
4453         u8 status = MGMT_STATUS_SUCCESS;
4454         size_t expected_size = sizeof(*cp);
4455
4456         BT_DBG("request for %s", hdev->name);
4457
4458         if (len <= sizeof(*cp)) {
4459                 status = MGMT_STATUS_INVALID_PARAMS;
4460                 goto done;
4461         }
4462
4463         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4464         if (len != expected_size) {
4465                 status = MGMT_STATUS_INVALID_PARAMS;
4466                 goto done;
4467         }
4468
4469         m = kzalloc(sizeof(*m), GFP_KERNEL);
4470         if (!m) {
4471                 status = MGMT_STATUS_NO_RESOURCES;
4472                 goto done;
4473         }
4474
4475         INIT_LIST_HEAD(&m->patterns);
4476
4477         parse_adv_monitor_rssi(m, NULL);
4478         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4479
4480 done:
4481         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4482                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4483 }
4484
4485 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4486                                          void *data, u16 len)
4487 {
4488         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4489         struct adv_monitor *m = NULL;
4490         u8 status = MGMT_STATUS_SUCCESS;
4491         size_t expected_size = sizeof(*cp);
4492
4493         BT_DBG("request for %s", hdev->name);
4494
4495         if (len <= sizeof(*cp)) {
4496                 status = MGMT_STATUS_INVALID_PARAMS;
4497                 goto done;
4498         }
4499
4500         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4501         if (len != expected_size) {
4502                 status = MGMT_STATUS_INVALID_PARAMS;
4503                 goto done;
4504         }
4505
4506         m = kzalloc(sizeof(*m), GFP_KERNEL);
4507         if (!m) {
4508                 status = MGMT_STATUS_NO_RESOURCES;
4509                 goto done;
4510         }
4511
4512         INIT_LIST_HEAD(&m->patterns);
4513
4514         parse_adv_monitor_rssi(m, &cp->rssi);
4515         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4516
4517 done:
4518         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4519                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4520 }
4521
4522 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4523 {
4524         struct mgmt_rp_remove_adv_monitor rp;
4525         struct mgmt_cp_remove_adv_monitor *cp;
4526         struct mgmt_pending_cmd *cmd;
4527         int err = 0;
4528
4529         hci_dev_lock(hdev);
4530
4531         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4532         if (!cmd)
4533                 goto done;
4534
4535         cp = cmd->param;
4536         rp.monitor_handle = cp->monitor_handle;
4537
4538         if (!status)
4539                 hci_update_background_scan(hdev);
4540
4541         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4542                                 mgmt_status(status), &rp, sizeof(rp));
4543         mgmt_pending_remove(cmd);
4544
4545 done:
4546         hci_dev_unlock(hdev);
4547         bt_dev_dbg(hdev, "remove monitor %d complete, status %u",
4548                    rp.monitor_handle, status);
4549
4550         return err;
4551 }
4552
4553 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4554                               void *data, u16 len)
4555 {
4556         struct mgmt_cp_remove_adv_monitor *cp = data;
4557         struct mgmt_rp_remove_adv_monitor rp;
4558         struct mgmt_pending_cmd *cmd;
4559         u16 handle = __le16_to_cpu(cp->monitor_handle);
4560         int err, status;
4561         bool pending;
4562
4563         BT_DBG("request for %s", hdev->name);
4564         rp.monitor_handle = cp->monitor_handle;
4565
4566         hci_dev_lock(hdev);
4567
4568         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4569             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4570             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4571             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4572                 status = MGMT_STATUS_BUSY;
4573                 goto unlock;
4574         }
4575
4576         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4577         if (!cmd) {
4578                 status = MGMT_STATUS_NO_RESOURCES;
4579                 goto unlock;
4580         }
4581
4582         if (handle)
4583                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4584         else
4585                 pending = hci_remove_all_adv_monitor(hdev, &err);
4586
4587         if (err) {
4588                 mgmt_pending_remove(cmd);
4589
4590                 if (err == -ENOENT)
4591                         status = MGMT_STATUS_INVALID_INDEX;
4592                 else
4593                         status = MGMT_STATUS_FAILED;
4594
4595                 goto unlock;
4596         }
4597
4598         /* monitor can be removed without forwarding request to controller */
4599         if (!pending) {
4600                 mgmt_pending_remove(cmd);
4601                 hci_dev_unlock(hdev);
4602
4603                 return mgmt_cmd_complete(sk, hdev->id,
4604                                          MGMT_OP_REMOVE_ADV_MONITOR,
4605                                          MGMT_STATUS_SUCCESS,
4606                                          &rp, sizeof(rp));
4607         }
4608
4609         hci_dev_unlock(hdev);
4610         return 0;
4611
4612 unlock:
4613         hci_dev_unlock(hdev);
4614         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4615                                status);
4616 }
4617
4618 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4619                                          u16 opcode, struct sk_buff *skb)
4620 {
4621         struct mgmt_rp_read_local_oob_data mgmt_rp;
4622         size_t rp_size = sizeof(mgmt_rp);
4623         struct mgmt_pending_cmd *cmd;
4624
4625         bt_dev_dbg(hdev, "status %u", status);
4626
4627         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4628         if (!cmd)
4629                 return;
4630
4631         if (status || !skb) {
4632                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4633                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4634                 goto remove;
4635         }
4636
4637         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4638
4639         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4640                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4641
4642                 if (skb->len < sizeof(*rp)) {
4643                         mgmt_cmd_status(cmd->sk, hdev->id,
4644                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4645                                         MGMT_STATUS_FAILED);
4646                         goto remove;
4647                 }
4648
4649                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4650                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4651
4652                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4653         } else {
4654                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4655
4656                 if (skb->len < sizeof(*rp)) {
4657                         mgmt_cmd_status(cmd->sk, hdev->id,
4658                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4659                                         MGMT_STATUS_FAILED);
4660                         goto remove;
4661                 }
4662
4663                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4664                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4665
4666                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4667                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4668         }
4669
4670         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4671                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4672
4673 remove:
4674         mgmt_pending_remove(cmd);
4675 }
4676
4677 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4678                                void *data, u16 data_len)
4679 {
4680         struct mgmt_pending_cmd *cmd;
4681         struct hci_request req;
4682         int err;
4683
4684         bt_dev_dbg(hdev, "sock %p", sk);
4685
4686         hci_dev_lock(hdev);
4687
4688         if (!hdev_is_powered(hdev)) {
4689                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4690                                       MGMT_STATUS_NOT_POWERED);
4691                 goto unlock;
4692         }
4693
4694         if (!lmp_ssp_capable(hdev)) {
4695                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4696                                       MGMT_STATUS_NOT_SUPPORTED);
4697                 goto unlock;
4698         }
4699
4700         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4701                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4702                                       MGMT_STATUS_BUSY);
4703                 goto unlock;
4704         }
4705
4706         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4707         if (!cmd) {
4708                 err = -ENOMEM;
4709                 goto unlock;
4710         }
4711
4712         hci_req_init(&req, hdev);
4713
4714         if (bredr_sc_enabled(hdev))
4715                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4716         else
4717                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4718
4719         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4720         if (err < 0)
4721                 mgmt_pending_remove(cmd);
4722
4723 unlock:
4724         hci_dev_unlock(hdev);
4725         return err;
4726 }
4727
4728 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4729                                void *data, u16 len)
4730 {
4731         struct mgmt_addr_info *addr = data;
4732         int err;
4733
4734         bt_dev_dbg(hdev, "sock %p", sk);
4735
4736         if (!bdaddr_type_is_valid(addr->type))
4737                 return mgmt_cmd_complete(sk, hdev->id,
4738                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4739                                          MGMT_STATUS_INVALID_PARAMS,
4740                                          addr, sizeof(*addr));
4741
4742         hci_dev_lock(hdev);
4743
4744         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4745                 struct mgmt_cp_add_remote_oob_data *cp = data;
4746                 u8 status;
4747
4748                 if (cp->addr.type != BDADDR_BREDR) {
4749                         err = mgmt_cmd_complete(sk, hdev->id,
4750                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4751                                                 MGMT_STATUS_INVALID_PARAMS,
4752                                                 &cp->addr, sizeof(cp->addr));
4753                         goto unlock;
4754                 }
4755
4756                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4757                                               cp->addr.type, cp->hash,
4758                                               cp->rand, NULL, NULL);
4759                 if (err < 0)
4760                         status = MGMT_STATUS_FAILED;
4761                 else
4762                         status = MGMT_STATUS_SUCCESS;
4763
4764                 err = mgmt_cmd_complete(sk, hdev->id,
4765                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4766                                         &cp->addr, sizeof(cp->addr));
4767         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4768                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4769                 u8 *rand192, *hash192, *rand256, *hash256;
4770                 u8 status;
4771
4772                 if (bdaddr_type_is_le(cp->addr.type)) {
4773                         /* Enforce zero-valued 192-bit parameters as
4774                          * long as legacy SMP OOB isn't implemented.
4775                          */
4776                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4777                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4778                                 err = mgmt_cmd_complete(sk, hdev->id,
4779                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4780                                                         MGMT_STATUS_INVALID_PARAMS,
4781                                                         addr, sizeof(*addr));
4782                                 goto unlock;
4783                         }
4784
4785                         rand192 = NULL;
4786                         hash192 = NULL;
4787                 } else {
4788                         /* In case one of the P-192 values is set to zero,
4789                          * then just disable OOB data for P-192.
4790                          */
4791                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4792                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4793                                 rand192 = NULL;
4794                                 hash192 = NULL;
4795                         } else {
4796                                 rand192 = cp->rand192;
4797                                 hash192 = cp->hash192;
4798                         }
4799                 }
4800
4801                 /* In case one of the P-256 values is set to zero, then just
4802                  * disable OOB data for P-256.
4803                  */
4804                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4805                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4806                         rand256 = NULL;
4807                         hash256 = NULL;
4808                 } else {
4809                         rand256 = cp->rand256;
4810                         hash256 = cp->hash256;
4811                 }
4812
4813                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4814                                               cp->addr.type, hash192, rand192,
4815                                               hash256, rand256);
4816                 if (err < 0)
4817                         status = MGMT_STATUS_FAILED;
4818                 else
4819                         status = MGMT_STATUS_SUCCESS;
4820
4821                 err = mgmt_cmd_complete(sk, hdev->id,
4822                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4823                                         status, &cp->addr, sizeof(cp->addr));
4824         } else {
4825                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4826                            len);
4827                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4828                                       MGMT_STATUS_INVALID_PARAMS);
4829         }
4830
4831 unlock:
4832         hci_dev_unlock(hdev);
4833         return err;
4834 }
4835
4836 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4837                                   void *data, u16 len)
4838 {
4839         struct mgmt_cp_remove_remote_oob_data *cp = data;
4840         u8 status;
4841         int err;
4842
4843         bt_dev_dbg(hdev, "sock %p", sk);
4844
4845         if (cp->addr.type != BDADDR_BREDR)
4846                 return mgmt_cmd_complete(sk, hdev->id,
4847                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4848                                          MGMT_STATUS_INVALID_PARAMS,
4849                                          &cp->addr, sizeof(cp->addr));
4850
4851         hci_dev_lock(hdev);
4852
4853         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4854                 hci_remote_oob_data_clear(hdev);
4855                 status = MGMT_STATUS_SUCCESS;
4856                 goto done;
4857         }
4858
4859         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4860         if (err < 0)
4861                 status = MGMT_STATUS_INVALID_PARAMS;
4862         else
4863                 status = MGMT_STATUS_SUCCESS;
4864
4865 done:
4866         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4867                                 status, &cp->addr, sizeof(cp->addr));
4868
4869         hci_dev_unlock(hdev);
4870         return err;
4871 }
4872
4873 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4874 {
4875         struct mgmt_pending_cmd *cmd;
4876
4877         bt_dev_dbg(hdev, "status %u", status);
4878
4879         hci_dev_lock(hdev);
4880
4881         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4882         if (!cmd)
4883                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4884
4885         if (!cmd)
4886                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4887
4888         if (cmd) {
4889                 cmd->cmd_complete(cmd, mgmt_status(status));
4890                 mgmt_pending_remove(cmd);
4891         }
4892
4893         hci_dev_unlock(hdev);
4894
4895         /* Handle suspend notifier */
4896         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4897                                hdev->suspend_tasks)) {
4898                 bt_dev_dbg(hdev, "Unpaused discovery");
4899                 wake_up(&hdev->suspend_wait_q);
4900         }
4901 }
4902
4903 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4904                                     uint8_t *mgmt_status)
4905 {
4906         switch (type) {
4907         case DISCOV_TYPE_LE:
4908                 *mgmt_status = mgmt_le_support(hdev);
4909                 if (*mgmt_status)
4910                         return false;
4911                 break;
4912         case DISCOV_TYPE_INTERLEAVED:
4913                 *mgmt_status = mgmt_le_support(hdev);
4914                 if (*mgmt_status)
4915                         return false;
4916                 fallthrough;
4917         case DISCOV_TYPE_BREDR:
4918                 *mgmt_status = mgmt_bredr_support(hdev);
4919                 if (*mgmt_status)
4920                         return false;
4921                 break;
4922         default:
4923                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4924                 return false;
4925         }
4926
4927         return true;
4928 }
4929
4930 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4931                                     u16 op, void *data, u16 len)
4932 {
4933         struct mgmt_cp_start_discovery *cp = data;
4934         struct mgmt_pending_cmd *cmd;
4935         u8 status;
4936         int err;
4937
4938         bt_dev_dbg(hdev, "sock %p", sk);
4939
4940         hci_dev_lock(hdev);
4941
4942         if (!hdev_is_powered(hdev)) {
4943                 err = mgmt_cmd_complete(sk, hdev->id, op,
4944                                         MGMT_STATUS_NOT_POWERED,
4945                                         &cp->type, sizeof(cp->type));
4946                 goto failed;
4947         }
4948
4949         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4950             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4951                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4952                                         &cp->type, sizeof(cp->type));
4953                 goto failed;
4954         }
4955
4956         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4957                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4958                                         &cp->type, sizeof(cp->type));
4959                 goto failed;
4960         }
4961
4962         /* Can't start discovery when it is paused */
4963         if (hdev->discovery_paused) {
4964                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4965                                         &cp->type, sizeof(cp->type));
4966                 goto failed;
4967         }
4968
4969         /* Clear the discovery filter first to free any previously
4970          * allocated memory for the UUID list.
4971          */
4972         hci_discovery_filter_clear(hdev);
4973
4974         hdev->discovery.type = cp->type;
4975         hdev->discovery.report_invalid_rssi = false;
4976         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4977                 hdev->discovery.limited = true;
4978         else
4979                 hdev->discovery.limited = false;
4980
4981         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4982         if (!cmd) {
4983                 err = -ENOMEM;
4984                 goto failed;
4985         }
4986
4987         cmd->cmd_complete = generic_cmd_complete;
4988
4989         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4990         queue_work(hdev->req_workqueue, &hdev->discov_update);
4991         err = 0;
4992
4993 failed:
4994         hci_dev_unlock(hdev);
4995         return err;
4996 }
4997
4998 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4999                            void *data, u16 len)
5000 {
5001         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5002                                         data, len);
5003 }
5004
5005 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5006                                    void *data, u16 len)
5007 {
5008         return start_discovery_internal(sk, hdev,
5009                                         MGMT_OP_START_LIMITED_DISCOVERY,
5010                                         data, len);
5011 }
5012
5013 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
5014                                           u8 status)
5015 {
5016         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
5017                                  cmd->param, 1);
5018 }
5019
5020 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5021                                    void *data, u16 len)
5022 {
5023         struct mgmt_cp_start_service_discovery *cp = data;
5024         struct mgmt_pending_cmd *cmd;
5025         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5026         u16 uuid_count, expected_len;
5027         u8 status;
5028         int err;
5029
5030         bt_dev_dbg(hdev, "sock %p", sk);
5031
5032         hci_dev_lock(hdev);
5033
5034         if (!hdev_is_powered(hdev)) {
5035                 err = mgmt_cmd_complete(sk, hdev->id,
5036                                         MGMT_OP_START_SERVICE_DISCOVERY,
5037                                         MGMT_STATUS_NOT_POWERED,
5038                                         &cp->type, sizeof(cp->type));
5039                 goto failed;
5040         }
5041
5042         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5043             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5044                 err = mgmt_cmd_complete(sk, hdev->id,
5045                                         MGMT_OP_START_SERVICE_DISCOVERY,
5046                                         MGMT_STATUS_BUSY, &cp->type,
5047                                         sizeof(cp->type));
5048                 goto failed;
5049         }
5050
5051         if (hdev->discovery_paused) {
5052                 err = mgmt_cmd_complete(sk, hdev->id,
5053                                         MGMT_OP_START_SERVICE_DISCOVERY,
5054                                         MGMT_STATUS_BUSY, &cp->type,
5055                                         sizeof(cp->type));
5056                 goto failed;
5057         }
5058
5059         uuid_count = __le16_to_cpu(cp->uuid_count);
5060         if (uuid_count > max_uuid_count) {
5061                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5062                            uuid_count);
5063                 err = mgmt_cmd_complete(sk, hdev->id,
5064                                         MGMT_OP_START_SERVICE_DISCOVERY,
5065                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5066                                         sizeof(cp->type));
5067                 goto failed;
5068         }
5069
5070         expected_len = sizeof(*cp) + uuid_count * 16;
5071         if (expected_len != len) {
5072                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5073                            expected_len, len);
5074                 err = mgmt_cmd_complete(sk, hdev->id,
5075                                         MGMT_OP_START_SERVICE_DISCOVERY,
5076                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5077                                         sizeof(cp->type));
5078                 goto failed;
5079         }
5080
5081         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5082                 err = mgmt_cmd_complete(sk, hdev->id,
5083                                         MGMT_OP_START_SERVICE_DISCOVERY,
5084                                         status, &cp->type, sizeof(cp->type));
5085                 goto failed;
5086         }
5087
5088         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5089                                hdev, data, len);
5090         if (!cmd) {
5091                 err = -ENOMEM;
5092                 goto failed;
5093         }
5094
5095         cmd->cmd_complete = service_discovery_cmd_complete;
5096
5097         /* Clear the discovery filter first to free any previously
5098          * allocated memory for the UUID list.
5099          */
5100         hci_discovery_filter_clear(hdev);
5101
5102         hdev->discovery.result_filtering = true;
5103         hdev->discovery.type = cp->type;
5104         hdev->discovery.rssi = cp->rssi;
5105         hdev->discovery.uuid_count = uuid_count;
5106
5107         if (uuid_count > 0) {
5108                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5109                                                 GFP_KERNEL);
5110                 if (!hdev->discovery.uuids) {
5111                         err = mgmt_cmd_complete(sk, hdev->id,
5112                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5113                                                 MGMT_STATUS_FAILED,
5114                                                 &cp->type, sizeof(cp->type));
5115                         mgmt_pending_remove(cmd);
5116                         goto failed;
5117                 }
5118         }
5119
5120         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5121         queue_work(hdev->req_workqueue, &hdev->discov_update);
5122         err = 0;
5123
5124 failed:
5125         hci_dev_unlock(hdev);
5126         return err;
5127 }
5128
5129 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5130 {
5131         struct mgmt_pending_cmd *cmd;
5132
5133         bt_dev_dbg(hdev, "status %u", status);
5134
5135         hci_dev_lock(hdev);
5136
5137         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5138         if (cmd) {
5139                 cmd->cmd_complete(cmd, mgmt_status(status));
5140                 mgmt_pending_remove(cmd);
5141         }
5142
5143         hci_dev_unlock(hdev);
5144
5145         /* Handle suspend notifier */
5146         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5147                 bt_dev_dbg(hdev, "Paused discovery");
5148                 wake_up(&hdev->suspend_wait_q);
5149         }
5150 }
5151
5152 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5153                           u16 len)
5154 {
5155         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5156         struct mgmt_pending_cmd *cmd;
5157         int err;
5158
5159         bt_dev_dbg(hdev, "sock %p", sk);
5160
5161         hci_dev_lock(hdev);
5162
5163         if (!hci_discovery_active(hdev)) {
5164                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5165                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5166                                         sizeof(mgmt_cp->type));
5167                 goto unlock;
5168         }
5169
5170         if (hdev->discovery.type != mgmt_cp->type) {
5171                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5172                                         MGMT_STATUS_INVALID_PARAMS,
5173                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5174                 goto unlock;
5175         }
5176
5177         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5178         if (!cmd) {
5179                 err = -ENOMEM;
5180                 goto unlock;
5181         }
5182
5183         cmd->cmd_complete = generic_cmd_complete;
5184
5185         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5186         queue_work(hdev->req_workqueue, &hdev->discov_update);
5187         err = 0;
5188
5189 unlock:
5190         hci_dev_unlock(hdev);
5191         return err;
5192 }
5193
5194 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5195                         u16 len)
5196 {
5197         struct mgmt_cp_confirm_name *cp = data;
5198         struct inquiry_entry *e;
5199         int err;
5200
5201         bt_dev_dbg(hdev, "sock %p", sk);
5202
5203         hci_dev_lock(hdev);
5204
5205         if (!hci_discovery_active(hdev)) {
5206                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5207                                         MGMT_STATUS_FAILED, &cp->addr,
5208                                         sizeof(cp->addr));
5209                 goto failed;
5210         }
5211
5212         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5213         if (!e) {
5214                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5215                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5216                                         sizeof(cp->addr));
5217                 goto failed;
5218         }
5219
5220         if (cp->name_known) {
5221                 e->name_state = NAME_KNOWN;
5222                 list_del(&e->list);
5223         } else {
5224                 e->name_state = NAME_NEEDED;
5225                 hci_inquiry_cache_update_resolve(hdev, e);
5226         }
5227
5228         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5229                                 &cp->addr, sizeof(cp->addr));
5230
5231 failed:
5232         hci_dev_unlock(hdev);
5233         return err;
5234 }
5235
5236 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5237                         u16 len)
5238 {
5239         struct mgmt_cp_block_device *cp = data;
5240         u8 status;
5241         int err;
5242
5243         bt_dev_dbg(hdev, "sock %p", sk);
5244
5245         if (!bdaddr_type_is_valid(cp->addr.type))
5246                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5247                                          MGMT_STATUS_INVALID_PARAMS,
5248                                          &cp->addr, sizeof(cp->addr));
5249
5250         hci_dev_lock(hdev);
5251
5252         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
5253                                   cp->addr.type);
5254         if (err < 0) {
5255                 status = MGMT_STATUS_FAILED;
5256                 goto done;
5257         }
5258
5259         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5260                    sk);
5261         status = MGMT_STATUS_SUCCESS;
5262
5263 done:
5264         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5265                                 &cp->addr, sizeof(cp->addr));
5266
5267         hci_dev_unlock(hdev);
5268
5269         return err;
5270 }
5271
5272 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5273                           u16 len)
5274 {
5275         struct mgmt_cp_unblock_device *cp = data;
5276         u8 status;
5277         int err;
5278
5279         bt_dev_dbg(hdev, "sock %p", sk);
5280
5281         if (!bdaddr_type_is_valid(cp->addr.type))
5282                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5283                                          MGMT_STATUS_INVALID_PARAMS,
5284                                          &cp->addr, sizeof(cp->addr));
5285
5286         hci_dev_lock(hdev);
5287
5288         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5289                                   cp->addr.type);
5290         if (err < 0) {
5291                 status = MGMT_STATUS_INVALID_PARAMS;
5292                 goto done;
5293         }
5294
5295         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5296                    sk);
5297         status = MGMT_STATUS_SUCCESS;
5298
5299 done:
5300         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5301                                 &cp->addr, sizeof(cp->addr));
5302
5303         hci_dev_unlock(hdev);
5304
5305         return err;
5306 }
5307
5308 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5309                          u16 len)
5310 {
5311         struct mgmt_cp_set_device_id *cp = data;
5312         struct hci_request req;
5313         int err;
5314         __u16 source;
5315
5316         bt_dev_dbg(hdev, "sock %p", sk);
5317
5318         source = __le16_to_cpu(cp->source);
5319
5320         if (source > 0x0002)
5321                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5322                                        MGMT_STATUS_INVALID_PARAMS);
5323
5324         hci_dev_lock(hdev);
5325
5326         hdev->devid_source = source;
5327         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5328         hdev->devid_product = __le16_to_cpu(cp->product);
5329         hdev->devid_version = __le16_to_cpu(cp->version);
5330
5331         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5332                                 NULL, 0);
5333
5334         hci_req_init(&req, hdev);
5335         __hci_req_update_eir(&req);
5336         hci_req_run(&req, NULL);
5337
5338         hci_dev_unlock(hdev);
5339
5340         return err;
5341 }
5342
5343 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5344                                         u16 opcode)
5345 {
5346         bt_dev_dbg(hdev, "status %u", status);
5347 }
5348
5349 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5350                                      u16 opcode)
5351 {
5352         struct cmd_lookup match = { NULL, hdev };
5353         struct hci_request req;
5354         u8 instance;
5355         struct adv_info *adv_instance;
5356         int err;
5357
5358         hci_dev_lock(hdev);
5359
5360         if (status) {
5361                 u8 mgmt_err = mgmt_status(status);
5362
5363                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5364                                      cmd_status_rsp, &mgmt_err);
5365                 goto unlock;
5366         }
5367
5368         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5369                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5370         else
5371                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5372
5373         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5374                              &match);
5375
5376         new_settings(hdev, match.sk);
5377
5378         if (match.sk)
5379                 sock_put(match.sk);
5380
5381         /* Handle suspend notifier */
5382         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5383                                hdev->suspend_tasks)) {
5384                 bt_dev_dbg(hdev, "Paused advertising");
5385                 wake_up(&hdev->suspend_wait_q);
5386         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5387                                       hdev->suspend_tasks)) {
5388                 bt_dev_dbg(hdev, "Unpaused advertising");
5389                 wake_up(&hdev->suspend_wait_q);
5390         }
5391
5392         /* If "Set Advertising" was just disabled and instance advertising was
5393          * set up earlier, then re-enable multi-instance advertising.
5394          */
5395         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5396             list_empty(&hdev->adv_instances))
5397                 goto unlock;
5398
5399         instance = hdev->cur_adv_instance;
5400         if (!instance) {
5401                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5402                                                         struct adv_info, list);
5403                 if (!adv_instance)
5404                         goto unlock;
5405
5406                 instance = adv_instance->instance;
5407         }
5408
5409         hci_req_init(&req, hdev);
5410
5411         err = __hci_req_schedule_adv_instance(&req, instance, true);
5412
5413         if (!err)
5414                 err = hci_req_run(&req, enable_advertising_instance);
5415
5416         if (err)
5417                 bt_dev_err(hdev, "failed to re-configure advertising");
5418
5419 unlock:
5420         hci_dev_unlock(hdev);
5421 }
5422
5423 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5424                            u16 len)
5425 {
5426         struct mgmt_mode *cp = data;
5427         struct mgmt_pending_cmd *cmd;
5428         struct hci_request req;
5429         u8 val, status;
5430         int err;
5431
5432         bt_dev_dbg(hdev, "sock %p", sk);
5433
5434         status = mgmt_le_support(hdev);
5435         if (status)
5436                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5437                                        status);
5438
5439         /* Enabling the experimental LL Privay support disables support for
5440          * advertising.
5441          */
5442         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5443                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5444                                        MGMT_STATUS_NOT_SUPPORTED);
5445
5446         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5447                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5448                                        MGMT_STATUS_INVALID_PARAMS);
5449
5450         if (hdev->advertising_paused)
5451                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5452                                        MGMT_STATUS_BUSY);
5453
5454         hci_dev_lock(hdev);
5455
5456         val = !!cp->val;
5457
5458         /* The following conditions are ones which mean that we should
5459          * not do any HCI communication but directly send a mgmt
5460          * response to user space (after toggling the flag if
5461          * necessary).
5462          */
5463         if (!hdev_is_powered(hdev) ||
5464             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5465              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5466             hci_conn_num(hdev, LE_LINK) > 0 ||
5467             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5468              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5469                 bool changed;
5470
5471                 if (cp->val) {
5472                         hdev->cur_adv_instance = 0x00;
5473                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5474                         if (cp->val == 0x02)
5475                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5476                         else
5477                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5478                 } else {
5479                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5480                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5481                 }
5482
5483                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5484                 if (err < 0)
5485                         goto unlock;
5486
5487                 if (changed)
5488                         err = new_settings(hdev, sk);
5489
5490                 goto unlock;
5491         }
5492
5493         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5494             pending_find(MGMT_OP_SET_LE, hdev)) {
5495                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5496                                       MGMT_STATUS_BUSY);
5497                 goto unlock;
5498         }
5499
5500         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5501         if (!cmd) {
5502                 err = -ENOMEM;
5503                 goto unlock;
5504         }
5505
5506         hci_req_init(&req, hdev);
5507
5508         if (cp->val == 0x02)
5509                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5510         else
5511                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5512
5513         cancel_adv_timeout(hdev);
5514
5515         if (val) {
5516                 /* Switch to instance "0" for the Set Advertising setting.
5517                  * We cannot use update_[adv|scan_rsp]_data() here as the
5518                  * HCI_ADVERTISING flag is not yet set.
5519                  */
5520                 hdev->cur_adv_instance = 0x00;
5521
5522                 if (ext_adv_capable(hdev)) {
5523                         __hci_req_start_ext_adv(&req, 0x00);
5524                 } else {
5525                         __hci_req_update_adv_data(&req, 0x00);
5526                         __hci_req_update_scan_rsp_data(&req, 0x00);
5527                         __hci_req_enable_advertising(&req);
5528                 }
5529         } else {
5530                 __hci_req_disable_advertising(&req);
5531         }
5532
5533         err = hci_req_run(&req, set_advertising_complete);
5534         if (err < 0)
5535                 mgmt_pending_remove(cmd);
5536
5537 unlock:
5538         hci_dev_unlock(hdev);
5539         return err;
5540 }
5541
5542 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5543                               void *data, u16 len)
5544 {
5545         struct mgmt_cp_set_static_address *cp = data;
5546         int err;
5547
5548         bt_dev_dbg(hdev, "sock %p", sk);
5549
5550         if (!lmp_le_capable(hdev))
5551                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5552                                        MGMT_STATUS_NOT_SUPPORTED);
5553
5554         if (hdev_is_powered(hdev))
5555                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5556                                        MGMT_STATUS_REJECTED);
5557
5558         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5559                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5560                         return mgmt_cmd_status(sk, hdev->id,
5561                                                MGMT_OP_SET_STATIC_ADDRESS,
5562                                                MGMT_STATUS_INVALID_PARAMS);
5563
5564                 /* Two most significant bits shall be set */
5565                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5566                         return mgmt_cmd_status(sk, hdev->id,
5567                                                MGMT_OP_SET_STATIC_ADDRESS,
5568                                                MGMT_STATUS_INVALID_PARAMS);
5569         }
5570
5571         hci_dev_lock(hdev);
5572
5573         bacpy(&hdev->static_addr, &cp->bdaddr);
5574
5575         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5576         if (err < 0)
5577                 goto unlock;
5578
5579         err = new_settings(hdev, sk);
5580
5581 unlock:
5582         hci_dev_unlock(hdev);
5583         return err;
5584 }
5585
5586 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5587                            void *data, u16 len)
5588 {
5589         struct mgmt_cp_set_scan_params *cp = data;
5590         __u16 interval, window;
5591         int err;
5592
5593         bt_dev_dbg(hdev, "sock %p", sk);
5594
5595         if (!lmp_le_capable(hdev))
5596                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5597                                        MGMT_STATUS_NOT_SUPPORTED);
5598
5599         interval = __le16_to_cpu(cp->interval);
5600
5601         if (interval < 0x0004 || interval > 0x4000)
5602                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5603                                        MGMT_STATUS_INVALID_PARAMS);
5604
5605         window = __le16_to_cpu(cp->window);
5606
5607         if (window < 0x0004 || window > 0x4000)
5608                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5609                                        MGMT_STATUS_INVALID_PARAMS);
5610
5611         if (window > interval)
5612                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5613                                        MGMT_STATUS_INVALID_PARAMS);
5614
5615         hci_dev_lock(hdev);
5616
5617         hdev->le_scan_interval = interval;
5618         hdev->le_scan_window = window;
5619
5620         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5621                                 NULL, 0);
5622
5623         /* If background scan is running, restart it so new parameters are
5624          * loaded.
5625          */
5626         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5627             hdev->discovery.state == DISCOVERY_STOPPED) {
5628                 struct hci_request req;
5629
5630                 hci_req_init(&req, hdev);
5631
5632                 hci_req_add_le_scan_disable(&req, false);
5633                 hci_req_add_le_passive_scan(&req);
5634
5635                 hci_req_run(&req, NULL);
5636         }
5637
5638         hci_dev_unlock(hdev);
5639
5640         return err;
5641 }
5642
5643 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5644                                       u16 opcode)
5645 {
5646         struct mgmt_pending_cmd *cmd;
5647
5648         bt_dev_dbg(hdev, "status 0x%02x", status);
5649
5650         hci_dev_lock(hdev);
5651
5652         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5653         if (!cmd)
5654                 goto unlock;
5655
5656         if (status) {
5657                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5658                                 mgmt_status(status));
5659         } else {
5660                 struct mgmt_mode *cp = cmd->param;
5661
5662                 if (cp->val)
5663                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5664                 else
5665                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5666
5667                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5668                 new_settings(hdev, cmd->sk);
5669         }
5670
5671         mgmt_pending_remove(cmd);
5672
5673 unlock:
5674         hci_dev_unlock(hdev);
5675 }
5676
5677 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5678                                 void *data, u16 len)
5679 {
5680         struct mgmt_mode *cp = data;
5681         struct mgmt_pending_cmd *cmd;
5682         struct hci_request req;
5683         int err;
5684
5685         bt_dev_dbg(hdev, "sock %p", sk);
5686
5687         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5688             hdev->hci_ver < BLUETOOTH_VER_1_2)
5689                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5690                                        MGMT_STATUS_NOT_SUPPORTED);
5691
5692         if (cp->val != 0x00 && cp->val != 0x01)
5693                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5694                                        MGMT_STATUS_INVALID_PARAMS);
5695
5696         hci_dev_lock(hdev);
5697
5698         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5699                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5700                                       MGMT_STATUS_BUSY);
5701                 goto unlock;
5702         }
5703
5704         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5705                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5706                                         hdev);
5707                 goto unlock;
5708         }
5709
5710         if (!hdev_is_powered(hdev)) {
5711                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5712                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5713                                         hdev);
5714                 new_settings(hdev, sk);
5715                 goto unlock;
5716         }
5717
5718         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5719                                data, len);
5720         if (!cmd) {
5721                 err = -ENOMEM;
5722                 goto unlock;
5723         }
5724
5725         hci_req_init(&req, hdev);
5726
5727         __hci_req_write_fast_connectable(&req, cp->val);
5728
5729         err = hci_req_run(&req, fast_connectable_complete);
5730         if (err < 0) {
5731                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5732                                       MGMT_STATUS_FAILED);
5733                 mgmt_pending_remove(cmd);
5734         }
5735
5736 unlock:
5737         hci_dev_unlock(hdev);
5738
5739         return err;
5740 }
5741
5742 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5743 {
5744         struct mgmt_pending_cmd *cmd;
5745
5746         bt_dev_dbg(hdev, "status 0x%02x", status);
5747
5748         hci_dev_lock(hdev);
5749
5750         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5751         if (!cmd)
5752                 goto unlock;
5753
5754         if (status) {
5755                 u8 mgmt_err = mgmt_status(status);
5756
5757                 /* We need to restore the flag if related HCI commands
5758                  * failed.
5759                  */
5760                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5761
5762                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5763         } else {
5764                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5765                 new_settings(hdev, cmd->sk);
5766         }
5767
5768         mgmt_pending_remove(cmd);
5769
5770 unlock:
5771         hci_dev_unlock(hdev);
5772 }
5773
5774 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5775 {
5776         struct mgmt_mode *cp = data;
5777         struct mgmt_pending_cmd *cmd;
5778         struct hci_request req;
5779         int err;
5780
5781         bt_dev_dbg(hdev, "sock %p", sk);
5782
5783         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5784                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5785                                        MGMT_STATUS_NOT_SUPPORTED);
5786
5787         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5788                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5789                                        MGMT_STATUS_REJECTED);
5790
5791         if (cp->val != 0x00 && cp->val != 0x01)
5792                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5793                                        MGMT_STATUS_INVALID_PARAMS);
5794
5795         hci_dev_lock(hdev);
5796
5797         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5798                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5799                 goto unlock;
5800         }
5801
5802         if (!hdev_is_powered(hdev)) {
5803                 if (!cp->val) {
5804                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5805                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5806                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5807                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5808                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5809                 }
5810
5811                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5812
5813                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5814                 if (err < 0)
5815                         goto unlock;
5816
5817                 err = new_settings(hdev, sk);
5818                 goto unlock;
5819         }
5820
5821         /* Reject disabling when powered on */
5822         if (!cp->val) {
5823                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5824                                       MGMT_STATUS_REJECTED);
5825                 goto unlock;
5826         } else {
5827                 /* When configuring a dual-mode controller to operate
5828                  * with LE only and using a static address, then switching
5829                  * BR/EDR back on is not allowed.
5830                  *
5831                  * Dual-mode controllers shall operate with the public
5832                  * address as its identity address for BR/EDR and LE. So
5833                  * reject the attempt to create an invalid configuration.
5834                  *
5835                  * The same restrictions applies when secure connections
5836                  * has been enabled. For BR/EDR this is a controller feature
5837                  * while for LE it is a host stack feature. This means that
5838                  * switching BR/EDR back on when secure connections has been
5839                  * enabled is not a supported transaction.
5840                  */
5841                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5842                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5843                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5844                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5845                                               MGMT_STATUS_REJECTED);
5846                         goto unlock;
5847                 }
5848         }
5849
5850         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5851                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5852                                       MGMT_STATUS_BUSY);
5853                 goto unlock;
5854         }
5855
5856         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5857         if (!cmd) {
5858                 err = -ENOMEM;
5859                 goto unlock;
5860         }
5861
5862         /* We need to flip the bit already here so that
5863          * hci_req_update_adv_data generates the correct flags.
5864          */
5865         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5866
5867         hci_req_init(&req, hdev);
5868
5869         __hci_req_write_fast_connectable(&req, false);
5870         __hci_req_update_scan(&req);
5871
5872         /* Since only the advertising data flags will change, there
5873          * is no need to update the scan response data.
5874          */
5875         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5876
5877         err = hci_req_run(&req, set_bredr_complete);
5878         if (err < 0)
5879                 mgmt_pending_remove(cmd);
5880
5881 unlock:
5882         hci_dev_unlock(hdev);
5883         return err;
5884 }
5885
5886 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5887 {
5888         struct mgmt_pending_cmd *cmd;
5889         struct mgmt_mode *cp;
5890
5891         bt_dev_dbg(hdev, "status %u", status);
5892
5893         hci_dev_lock(hdev);
5894
5895         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5896         if (!cmd)
5897                 goto unlock;
5898
5899         if (status) {
5900                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5901                                 mgmt_status(status));
5902                 goto remove;
5903         }
5904
5905         cp = cmd->param;
5906
5907         switch (cp->val) {
5908         case 0x00:
5909                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5910                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5911                 break;
5912         case 0x01:
5913                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5914                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5915                 break;
5916         case 0x02:
5917                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5918                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5919                 break;
5920         }
5921
5922         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5923         new_settings(hdev, cmd->sk);
5924
5925 remove:
5926         mgmt_pending_remove(cmd);
5927 unlock:
5928         hci_dev_unlock(hdev);
5929 }
5930
5931 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5932                            void *data, u16 len)
5933 {
5934         struct mgmt_mode *cp = data;
5935         struct mgmt_pending_cmd *cmd;
5936         struct hci_request req;
5937         u8 val;
5938         int err;
5939
5940         bt_dev_dbg(hdev, "sock %p", sk);
5941
5942         if (!lmp_sc_capable(hdev) &&
5943             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5944                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5945                                        MGMT_STATUS_NOT_SUPPORTED);
5946
5947         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5948             lmp_sc_capable(hdev) &&
5949             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5950                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5951                                        MGMT_STATUS_REJECTED);
5952
5953         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5954                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5955                                   MGMT_STATUS_INVALID_PARAMS);
5956
5957         hci_dev_lock(hdev);
5958
5959         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5960             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5961                 bool changed;
5962
5963                 if (cp->val) {
5964                         changed = !hci_dev_test_and_set_flag(hdev,
5965                                                              HCI_SC_ENABLED);
5966                         if (cp->val == 0x02)
5967                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5968                         else
5969                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5970                 } else {
5971                         changed = hci_dev_test_and_clear_flag(hdev,
5972                                                               HCI_SC_ENABLED);
5973                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5974                 }
5975
5976                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5977                 if (err < 0)
5978                         goto failed;
5979
5980                 if (changed)
5981                         err = new_settings(hdev, sk);
5982
5983                 goto failed;
5984         }
5985
5986         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5987                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5988                                       MGMT_STATUS_BUSY);
5989                 goto failed;
5990         }
5991
5992         val = !!cp->val;
5993
5994         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5995             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5996                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5997                 goto failed;
5998         }
5999
6000         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6001         if (!cmd) {
6002                 err = -ENOMEM;
6003                 goto failed;
6004         }
6005
6006         hci_req_init(&req, hdev);
6007         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
6008         err = hci_req_run(&req, sc_enable_complete);
6009         if (err < 0) {
6010                 mgmt_pending_remove(cmd);
6011                 goto failed;
6012         }
6013
6014 failed:
6015         hci_dev_unlock(hdev);
6016         return err;
6017 }
6018
6019 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6020                           void *data, u16 len)
6021 {
6022         struct mgmt_mode *cp = data;
6023         bool changed, use_changed;
6024         int err;
6025
6026         bt_dev_dbg(hdev, "sock %p", sk);
6027
6028         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6029                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6030                                        MGMT_STATUS_INVALID_PARAMS);
6031
6032         hci_dev_lock(hdev);
6033
6034         if (cp->val)
6035                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6036         else
6037                 changed = hci_dev_test_and_clear_flag(hdev,
6038                                                       HCI_KEEP_DEBUG_KEYS);
6039
6040         if (cp->val == 0x02)
6041                 use_changed = !hci_dev_test_and_set_flag(hdev,
6042                                                          HCI_USE_DEBUG_KEYS);
6043         else
6044                 use_changed = hci_dev_test_and_clear_flag(hdev,
6045                                                           HCI_USE_DEBUG_KEYS);
6046
6047         if (hdev_is_powered(hdev) && use_changed &&
6048             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6049                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6050                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6051                              sizeof(mode), &mode);
6052         }
6053
6054         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6055         if (err < 0)
6056                 goto unlock;
6057
6058         if (changed)
6059                 err = new_settings(hdev, sk);
6060
6061 unlock:
6062         hci_dev_unlock(hdev);
6063         return err;
6064 }
6065
6066 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6067                        u16 len)
6068 {
6069         struct mgmt_cp_set_privacy *cp = cp_data;
6070         bool changed;
6071         int err;
6072
6073         bt_dev_dbg(hdev, "sock %p", sk);
6074
6075         if (!lmp_le_capable(hdev))
6076                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6077                                        MGMT_STATUS_NOT_SUPPORTED);
6078
6079         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6080                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6081                                        MGMT_STATUS_INVALID_PARAMS);
6082
6083 #ifndef TIZEN_BT
6084         /* commenting out since set privacy command is always rejected
6085          * if this condition is enabled.
6086          */
6087         if (hdev_is_powered(hdev))
6088                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6089                                        MGMT_STATUS_REJECTED);
6090 #endif
6091
6092         hci_dev_lock(hdev);
6093
6094         /* If user space supports this command it is also expected to
6095          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6096          */
6097         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6098
6099         if (cp->privacy) {
6100                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6101                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6102                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6103                 hci_adv_instances_set_rpa_expired(hdev, true);
6104                 if (cp->privacy == 0x02)
6105                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6106                 else
6107                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6108         } else {
6109                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6110                 memset(hdev->irk, 0, sizeof(hdev->irk));
6111                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6112                 hci_adv_instances_set_rpa_expired(hdev, false);
6113                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6114         }
6115
6116         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6117         if (err < 0)
6118                 goto unlock;
6119
6120         if (changed)
6121                 err = new_settings(hdev, sk);
6122
6123 unlock:
6124         hci_dev_unlock(hdev);
6125         return err;
6126 }
6127
6128 static bool irk_is_valid(struct mgmt_irk_info *irk)
6129 {
6130         switch (irk->addr.type) {
6131         case BDADDR_LE_PUBLIC:
6132                 return true;
6133
6134         case BDADDR_LE_RANDOM:
6135                 /* Two most significant bits shall be set */
6136                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6137                         return false;
6138                 return true;
6139         }
6140
6141         return false;
6142 }
6143
6144 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6145                      u16 len)
6146 {
6147         struct mgmt_cp_load_irks *cp = cp_data;
6148         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6149                                    sizeof(struct mgmt_irk_info));
6150         u16 irk_count, expected_len;
6151         int i, err;
6152
6153         bt_dev_dbg(hdev, "sock %p", sk);
6154
6155         if (!lmp_le_capable(hdev))
6156                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6157                                        MGMT_STATUS_NOT_SUPPORTED);
6158
6159         irk_count = __le16_to_cpu(cp->irk_count);
6160         if (irk_count > max_irk_count) {
6161                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6162                            irk_count);
6163                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6164                                        MGMT_STATUS_INVALID_PARAMS);
6165         }
6166
6167         expected_len = struct_size(cp, irks, irk_count);
6168         if (expected_len != len) {
6169                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6170                            expected_len, len);
6171                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6172                                        MGMT_STATUS_INVALID_PARAMS);
6173         }
6174
6175         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6176
6177         for (i = 0; i < irk_count; i++) {
6178                 struct mgmt_irk_info *key = &cp->irks[i];
6179
6180                 if (!irk_is_valid(key))
6181                         return mgmt_cmd_status(sk, hdev->id,
6182                                                MGMT_OP_LOAD_IRKS,
6183                                                MGMT_STATUS_INVALID_PARAMS);
6184         }
6185
6186         hci_dev_lock(hdev);
6187
6188         hci_smp_irks_clear(hdev);
6189
6190         for (i = 0; i < irk_count; i++) {
6191                 struct mgmt_irk_info *irk = &cp->irks[i];
6192
6193                 if (hci_is_blocked_key(hdev,
6194                                        HCI_BLOCKED_KEY_TYPE_IRK,
6195                                        irk->val)) {
6196                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6197                                     &irk->addr.bdaddr);
6198                         continue;
6199                 }
6200
6201                 hci_add_irk(hdev, &irk->addr.bdaddr,
6202                             le_addr_type(irk->addr.type), irk->val,
6203                             BDADDR_ANY);
6204         }
6205
6206         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6207
6208         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6209
6210         hci_dev_unlock(hdev);
6211
6212         return err;
6213 }
6214
6215 #ifdef TIZEN_BT
6216 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
6217                         void *data, u16 len)
6218 {
6219         struct mgmt_cp_set_advertising_params *cp = data;
6220         __u16 min_interval;
6221         __u16 max_interval;
6222         int err;
6223
6224         BT_DBG("%s", hdev->name);
6225
6226         if (!lmp_le_capable(hdev))
6227                 return mgmt_cmd_status(sk, hdev->id,
6228                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6229                                 MGMT_STATUS_NOT_SUPPORTED);
6230
6231         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6232                 return mgmt_cmd_status(sk, hdev->id,
6233                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6234                                 MGMT_STATUS_BUSY);
6235
6236         min_interval = __le16_to_cpu(cp->interval_min);
6237         max_interval = __le16_to_cpu(cp->interval_max);
6238
6239         if (min_interval > max_interval ||
6240             min_interval < 0x0020 || max_interval > 0x4000)
6241                 return mgmt_cmd_status(sk, hdev->id,
6242                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6243                                 MGMT_STATUS_INVALID_PARAMS);
6244
6245         hci_dev_lock(hdev);
6246
6247         hdev->le_adv_min_interval = min_interval;
6248         hdev->le_adv_max_interval = max_interval;
6249         hdev->adv_filter_policy = cp->filter_policy;
6250         hdev->adv_type = cp->type;
6251
6252         err = mgmt_cmd_complete(sk, hdev->id,
6253                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
6254
6255         hci_dev_unlock(hdev);
6256
6257         return err;
6258 }
6259
6260 static void set_advertising_data_complete(struct hci_dev *hdev,
6261                         u8 status, u16 opcode)
6262 {
6263         struct mgmt_cp_set_advertising_data *cp;
6264         struct mgmt_pending_cmd *cmd;
6265
6266         BT_DBG("status 0x%02x", status);
6267
6268         hci_dev_lock(hdev);
6269
6270         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
6271         if (!cmd)
6272                 goto unlock;
6273
6274         cp = cmd->param;
6275
6276         if (status)
6277                 mgmt_cmd_status(cmd->sk, hdev->id,
6278                                 MGMT_OP_SET_ADVERTISING_DATA,
6279                                 mgmt_status(status));
6280         else
6281                 mgmt_cmd_complete(cmd->sk, hdev->id,
6282                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
6283                                 cp, sizeof(*cp));
6284
6285         mgmt_pending_remove(cmd);
6286
6287 unlock:
6288         hci_dev_unlock(hdev);
6289 }
6290
6291 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
6292                         void *data, u16 len)
6293 {
6294         struct mgmt_pending_cmd *cmd;
6295         struct hci_request req;
6296         struct mgmt_cp_set_advertising_data *cp = data;
6297         struct hci_cp_le_set_adv_data adv;
6298         int err;
6299
6300         BT_DBG("%s", hdev->name);
6301
6302         if (!lmp_le_capable(hdev)) {
6303                 return mgmt_cmd_status(sk, hdev->id,
6304                                 MGMT_OP_SET_ADVERTISING_DATA,
6305                                 MGMT_STATUS_NOT_SUPPORTED);
6306         }
6307
6308         hci_dev_lock(hdev);
6309
6310         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
6311                 err = mgmt_cmd_status(sk, hdev->id,
6312                                 MGMT_OP_SET_ADVERTISING_DATA,
6313                                 MGMT_STATUS_BUSY);
6314                 goto unlocked;
6315         }
6316
6317         if (len > HCI_MAX_AD_LENGTH) {
6318                 err = mgmt_cmd_status(sk, hdev->id,
6319                                 MGMT_OP_SET_ADVERTISING_DATA,
6320                                 MGMT_STATUS_INVALID_PARAMS);
6321                 goto unlocked;
6322         }
6323
6324         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
6325                                hdev, data, len);
6326         if (!cmd) {
6327                 err = -ENOMEM;
6328                 goto unlocked;
6329         }
6330
6331         hci_req_init(&req, hdev);
6332
6333         memset(&adv, 0, sizeof(adv));
6334         memcpy(adv.data, cp->data, len);
6335         adv.length = len;
6336
6337         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
6338
6339         err = hci_req_run(&req, set_advertising_data_complete);
6340         if (err < 0)
6341                 mgmt_pending_remove(cmd);
6342
6343 unlocked:
6344         hci_dev_unlock(hdev);
6345
6346         return err;
6347 }
6348
6349 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
6350                         u16 opcode)
6351 {
6352         struct mgmt_cp_set_scan_rsp_data *cp;
6353         struct mgmt_pending_cmd *cmd;
6354
6355         BT_DBG("status 0x%02x", status);
6356
6357         hci_dev_lock(hdev);
6358
6359         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
6360         if (!cmd)
6361                 goto unlock;
6362
6363         cp = cmd->param;
6364
6365         if (status)
6366                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6367                                 mgmt_status(status));
6368         else
6369                 mgmt_cmd_complete(cmd->sk, hdev->id,
6370                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
6371                                 cp, sizeof(*cp));
6372
6373         mgmt_pending_remove(cmd);
6374
6375 unlock:
6376         hci_dev_unlock(hdev);
6377 }
6378
6379 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
6380                         u16 len)
6381 {
6382         struct mgmt_pending_cmd *cmd;
6383         struct hci_request req;
6384         struct mgmt_cp_set_scan_rsp_data *cp = data;
6385         struct hci_cp_le_set_scan_rsp_data rsp;
6386         int err;
6387
6388         BT_DBG("%s", hdev->name);
6389
6390         if (!lmp_le_capable(hdev))
6391                 return mgmt_cmd_status(sk, hdev->id,
6392                                 MGMT_OP_SET_SCAN_RSP_DATA,
6393                                 MGMT_STATUS_NOT_SUPPORTED);
6394
6395         hci_dev_lock(hdev);
6396
6397         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
6398                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6399                                 MGMT_STATUS_BUSY);
6400                 goto unlocked;
6401         }
6402
6403         if (len > HCI_MAX_AD_LENGTH) {
6404                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6405                                 MGMT_STATUS_INVALID_PARAMS);
6406                 goto unlocked;
6407         }
6408
6409         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
6410         if (!cmd) {
6411                 err = -ENOMEM;
6412                 goto unlocked;
6413         }
6414
6415         hci_req_init(&req, hdev);
6416
6417         memset(&rsp, 0, sizeof(rsp));
6418         memcpy(rsp.data, cp->data, len);
6419         rsp.length = len;
6420
6421         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
6422
6423         err = hci_req_run(&req, set_scan_rsp_data_complete);
6424         if (err < 0)
6425                 mgmt_pending_remove(cmd);
6426
6427 unlocked:
6428         hci_dev_unlock(hdev);
6429
6430         return err;
6431 }
6432
6433 /* Adv White List feature */
6434 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6435 {
6436         struct mgmt_cp_add_dev_white_list *cp;
6437         struct mgmt_pending_cmd *cmd;
6438
6439         BT_DBG("status 0x%02x", status);
6440
6441         hci_dev_lock(hdev);
6442
6443         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
6444         if (!cmd)
6445                 goto unlock;
6446
6447         cp = cmd->param;
6448
6449         if (status)
6450                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6451                            mgmt_status(status));
6452         else
6453                 mgmt_cmd_complete(cmd->sk, hdev->id,
6454                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
6455
6456         mgmt_pending_remove(cmd);
6457
6458 unlock:
6459         hci_dev_unlock(hdev);
6460 }
6461
6462 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
6463                            void *data, u16 len)
6464 {
6465         struct mgmt_pending_cmd *cmd;
6466         struct mgmt_cp_add_dev_white_list *cp = data;
6467         struct hci_request req;
6468         int err;
6469
6470         BT_DBG("%s", hdev->name);
6471
6472         if (!lmp_le_capable(hdev))
6473                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6474                                   MGMT_STATUS_NOT_SUPPORTED);
6475
6476         if (!hdev_is_powered(hdev))
6477                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6478                                   MGMT_STATUS_REJECTED);
6479
6480         hci_dev_lock(hdev);
6481
6482         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
6483                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6484                                 MGMT_STATUS_BUSY);
6485                 goto unlocked;
6486         }
6487
6488         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
6489         if (!cmd) {
6490                 err = -ENOMEM;
6491                 goto unlocked;
6492         }
6493
6494         hci_req_init(&req, hdev);
6495
6496         hci_req_add(&req, HCI_OP_LE_ADD_TO_ACCEPT_LIST, sizeof(*cp), cp);
6497
6498         err = hci_req_run(&req, add_white_list_complete);
6499         if (err < 0) {
6500                 mgmt_pending_remove(cmd);
6501                 goto unlocked;
6502         }
6503
6504 unlocked:
6505         hci_dev_unlock(hdev);
6506
6507         return err;
6508 }
6509
6510 static void remove_from_white_list_complete(struct hci_dev *hdev,
6511                         u8 status, u16 opcode)
6512 {
6513         struct mgmt_cp_remove_dev_from_white_list *cp;
6514         struct mgmt_pending_cmd *cmd;
6515
6516         BT_DBG("status 0x%02x", status);
6517
6518         hci_dev_lock(hdev);
6519
6520         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
6521         if (!cmd)
6522                 goto unlock;
6523
6524         cp = cmd->param;
6525
6526         if (status)
6527                 mgmt_cmd_status(cmd->sk, hdev->id,
6528                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6529                         mgmt_status(status));
6530         else
6531                 mgmt_cmd_complete(cmd->sk, hdev->id,
6532                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
6533                         cp, sizeof(*cp));
6534
6535         mgmt_pending_remove(cmd);
6536
6537 unlock:
6538         hci_dev_unlock(hdev);
6539 }
6540
6541 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
6542                            void *data, u16 len)
6543 {
6544         struct mgmt_pending_cmd *cmd;
6545         struct mgmt_cp_remove_dev_from_white_list *cp = data;
6546         struct hci_request req;
6547         int err;
6548
6549         BT_DBG("%s", hdev->name);
6550
6551         if (!lmp_le_capable(hdev))
6552                 return mgmt_cmd_status(sk, hdev->id,
6553                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6554                                 MGMT_STATUS_NOT_SUPPORTED);
6555
6556         if (!hdev_is_powered(hdev))
6557                 return mgmt_cmd_status(sk, hdev->id,
6558                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6559                                 MGMT_STATUS_REJECTED);
6560
6561         hci_dev_lock(hdev);
6562
6563         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
6564                 err = mgmt_cmd_status(sk, hdev->id,
6565                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6566                                 MGMT_STATUS_BUSY);
6567                 goto unlocked;
6568         }
6569
6570         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6571                                 hdev, data, len);
6572         if (!cmd) {
6573                 err = -ENOMEM;
6574                 goto unlocked;
6575         }
6576
6577         hci_req_init(&req, hdev);
6578
6579         hci_req_add(&req, HCI_OP_LE_DEL_FROM_ACCEPT_LIST, sizeof(*cp), cp);
6580
6581         err = hci_req_run(&req, remove_from_white_list_complete);
6582         if (err < 0) {
6583                 mgmt_pending_remove(cmd);
6584                 goto unlocked;
6585         }
6586
6587 unlocked:
6588         hci_dev_unlock(hdev);
6589
6590         return err;
6591 }
6592
6593 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
6594                         u16 opcode)
6595 {
6596         struct mgmt_pending_cmd *cmd;
6597
6598         BT_DBG("status 0x%02x", status);
6599
6600         hci_dev_lock(hdev);
6601
6602         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
6603         if (!cmd)
6604                 goto unlock;
6605
6606         if (status)
6607                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6608                            mgmt_status(status));
6609         else
6610                 mgmt_cmd_complete(cmd->sk, hdev->id,
6611                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6612                                 0, NULL, 0);
6613
6614         mgmt_pending_remove(cmd);
6615
6616 unlock:
6617         hci_dev_unlock(hdev);
6618 }
6619
6620 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
6621                            void *data, u16 len)
6622 {
6623         struct mgmt_pending_cmd *cmd;
6624         struct hci_request req;
6625         int err;
6626
6627         BT_DBG("%s", hdev->name);
6628
6629         if (!lmp_le_capable(hdev))
6630                 return mgmt_cmd_status(sk, hdev->id,
6631                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6632                                 MGMT_STATUS_NOT_SUPPORTED);
6633
6634         if (!hdev_is_powered(hdev))
6635                 return mgmt_cmd_status(sk, hdev->id,
6636                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6637                                 MGMT_STATUS_REJECTED);
6638
6639         hci_dev_lock(hdev);
6640
6641         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
6642                 err = mgmt_cmd_status(sk, hdev->id,
6643                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6644                                 MGMT_STATUS_BUSY);
6645                 goto unlocked;
6646         }
6647
6648         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6649                                 hdev, NULL, 0);
6650         if (!cmd) {
6651                 err = -ENOMEM;
6652                 goto unlocked;
6653         }
6654
6655         hci_req_init(&req, hdev);
6656
6657         hci_req_add(&req, HCI_OP_LE_CLEAR_ACCEPT_LIST, 0, NULL);
6658
6659         err = hci_req_run(&req, clear_white_list_complete);
6660         if (err < 0) {
6661                 mgmt_pending_remove(cmd);
6662                 goto unlocked;
6663         }
6664
6665 unlocked:
6666         hci_dev_unlock(hdev);
6667
6668         return err;
6669 }
6670
6671 static void set_rssi_threshold_complete(struct hci_dev *hdev,
6672                         u8 status, u16 opcode)
6673 {
6674         struct mgmt_pending_cmd *cmd;
6675
6676         BT_DBG("status 0x%02x", status);
6677
6678         hci_dev_lock(hdev);
6679
6680         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6681         if (!cmd)
6682                 goto unlock;
6683
6684         if (status)
6685                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6686                                 mgmt_status(status));
6687         else
6688                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6689                                 NULL, 0);
6690
6691         mgmt_pending_remove(cmd);
6692
6693 unlock:
6694         hci_dev_unlock(hdev);
6695 }
6696
6697 static void set_rssi_disable_complete(struct hci_dev *hdev,
6698                         u8 status, u16 opcode)
6699 {
6700         struct mgmt_pending_cmd *cmd;
6701
6702         BT_DBG("status 0x%02x", status);
6703
6704         hci_dev_lock(hdev);
6705
6706         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6707         if (!cmd)
6708                 goto unlock;
6709
6710         if (status)
6711                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6712                                 mgmt_status(status));
6713         else
6714                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6715                                 0, NULL, 0);
6716
6717         mgmt_pending_remove(cmd);
6718
6719 unlock:
6720         hci_dev_unlock(hdev);
6721 }
6722
6723 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6724                 void *data, u16 len)
6725 {
6726         int err = 0;
6727         struct hci_cp_set_rssi_threshold th = { 0, };
6728         struct mgmt_cp_set_enable_rssi *cp = data;
6729         struct hci_conn *conn;
6730         struct mgmt_pending_cmd *cmd;
6731         struct hci_request req;
6732         __u8 dest_type;
6733
6734         hci_dev_lock(hdev);
6735
6736         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6737         if (!cmd) {
6738                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6739                                 MGMT_STATUS_FAILED);
6740                 goto unlocked;
6741         }
6742
6743         if (!lmp_le_capable(hdev)) {
6744                 mgmt_pending_remove(cmd);
6745                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6746                                 MGMT_STATUS_NOT_SUPPORTED);
6747                 goto unlocked;
6748         }
6749
6750         if (!hdev_is_powered(hdev)) {
6751                 BT_DBG("%s", hdev->name);
6752                 mgmt_pending_remove(cmd);
6753                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6754                                 MGMT_STATUS_NOT_POWERED);
6755                 goto unlocked;
6756         }
6757
6758         if (cp->link_type == 0x01)
6759                 dest_type = LE_LINK;
6760         else
6761                 dest_type = ACL_LINK;
6762
6763         /* Get LE/ACL link handle info */
6764         conn = hci_conn_hash_lookup_ba(hdev,
6765                         dest_type, &cp->bdaddr);
6766
6767         if (!conn) {
6768                 err = mgmt_cmd_complete(sk, hdev->id,
6769                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6770                 mgmt_pending_remove(cmd);
6771                 goto unlocked;
6772         }
6773
6774         hci_req_init(&req, hdev);
6775
6776         th.hci_le_ext_opcode = 0x0B;
6777         th.mode = 0x01;
6778         th.conn_handle = conn->handle;
6779         th.alert_mask = 0x07;
6780         th.low_th = cp->low_th;
6781         th.in_range_th = cp->in_range_th;
6782         th.high_th = cp->high_th;
6783
6784         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6785         err = hci_req_run(&req, set_rssi_threshold_complete);
6786
6787         if (err < 0) {
6788                 mgmt_pending_remove(cmd);
6789                 BT_ERR("Error in requesting hci_req_run");
6790                 goto unlocked;
6791         }
6792
6793 unlocked:
6794         hci_dev_unlock(hdev);
6795         return err;
6796 }
6797
6798 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6799                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6800 {
6801         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6802         struct mgmt_cp_set_enable_rssi *cp = data;
6803         struct mgmt_pending_cmd *cmd;
6804
6805         if (!cp || !rp)
6806                 goto remove_cmd;
6807
6808         mgmt_rp.status = rp->status;
6809         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6810         mgmt_rp.bt_address = cp->bdaddr;
6811         mgmt_rp.link_type = cp->link_type;
6812
6813         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6814                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6815                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6816
6817         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6818                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6819
6820         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6821         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6822                         &mgmt_rp.bt_address, true);
6823
6824 remove_cmd:
6825         hci_dev_lock(hdev);
6826         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6827         if (cmd)
6828                 mgmt_pending_remove(cmd);
6829
6830         hci_dev_unlock(hdev);
6831 }
6832
6833 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6834                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6835 {
6836         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6837         struct mgmt_cp_disable_rssi *cp = data;
6838         struct mgmt_pending_cmd *cmd;
6839
6840         if (!cp || !rp)
6841                 goto remove_cmd;
6842
6843         mgmt_rp.status = rp->status;
6844         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6845         mgmt_rp.bt_address = cp->bdaddr;
6846         mgmt_rp.link_type = cp->link_type;
6847
6848         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6849                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6850                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6851
6852         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6853                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6854
6855         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6856                         &mgmt_rp.bt_address, false);
6857
6858 remove_cmd:
6859         hci_dev_lock(hdev);
6860         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6861         if (cmd)
6862                 mgmt_pending_remove(cmd);
6863
6864         hci_dev_unlock(hdev);
6865 }
6866
6867 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6868                 void *data, u16 len)
6869 {
6870         struct mgmt_pending_cmd *cmd;
6871         struct hci_request req;
6872         struct hci_cp_set_enable_rssi cp_en = { 0, };
6873         int err;
6874
6875         BT_DBG("Set Disable RSSI.");
6876
6877         cp_en.hci_le_ext_opcode = 0x01;
6878         cp_en.le_enable_cs_Features = 0x00;
6879         cp_en.data[0] = 0x00;
6880         cp_en.data[1] = 0x00;
6881         cp_en.data[2] = 0x00;
6882
6883         hci_dev_lock(hdev);
6884
6885         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6886         if (!cmd) {
6887                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6888                                 MGMT_STATUS_FAILED);
6889                 goto unlocked;
6890         }
6891
6892         if (!lmp_le_capable(hdev)) {
6893                 mgmt_pending_remove(cmd);
6894                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6895                                 MGMT_STATUS_NOT_SUPPORTED);
6896                 goto unlocked;
6897         }
6898
6899         if (!hdev_is_powered(hdev)) {
6900                 BT_DBG("%s", hdev->name);
6901                 mgmt_pending_remove(cmd);
6902                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6903                                 MGMT_STATUS_NOT_POWERED);
6904                 goto unlocked;
6905         }
6906
6907         hci_req_init(&req, hdev);
6908
6909         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6910                         sizeof(struct hci_cp_set_enable_rssi),
6911                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6912                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6913
6914         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6915         err = hci_req_run(&req, set_rssi_disable_complete);
6916
6917         if (err < 0) {
6918                 mgmt_pending_remove(cmd);
6919                 BT_ERR("Error in requesting hci_req_run");
6920                 goto unlocked;
6921         }
6922
6923 unlocked:
6924         hci_dev_unlock(hdev);
6925         return err;
6926 }
6927
6928 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6929 {
6930         struct hci_cc_rsp_enable_rssi *rp = response;
6931         struct mgmt_pending_cmd *cmd_enable = NULL;
6932         struct mgmt_pending_cmd *cmd_disable = NULL;
6933         struct mgmt_cp_set_enable_rssi *cp_en;
6934         struct mgmt_cp_disable_rssi *cp_dis;
6935
6936         hci_dev_lock(hdev);
6937         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6938         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6939         hci_dev_unlock(hdev);
6940
6941         if (cmd_enable)
6942                 BT_DBG("Enable Request");
6943
6944         if (cmd_disable)
6945                 BT_DBG("Disable Request");
6946
6947         if (cmd_enable) {
6948                 cp_en = cmd_enable->param;
6949
6950                 if (status != 0x00)
6951                         return;
6952
6953                 switch (rp->le_ext_opcode) {
6954                 case 0x01:
6955                         BT_DBG("RSSI enabled.. Setting Threshold...");
6956                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6957                                         cp_en, sizeof(*cp_en));
6958                         break;
6959
6960                 case 0x0B:
6961                         BT_DBG("Sending RSSI enable success");
6962                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6963                                         cp_en, rp, rp->status);
6964                         break;
6965                 }
6966
6967         } else if (cmd_disable) {
6968                 cp_dis = cmd_disable->param;
6969
6970                 if (status != 0x00)
6971                         return;
6972
6973                 switch (rp->le_ext_opcode) {
6974                 case 0x01:
6975                         BT_DBG("Sending RSSI disable success");
6976                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6977                                         cp_dis, rp, rp->status);
6978                         break;
6979
6980                 case 0x0B:
6981                         /*
6982                          * Only unset RSSI Threshold values for the Link if
6983                          * RSSI is monitored for other BREDR or LE Links
6984                          */
6985                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6986                                 BT_DBG("Unset Threshold. Other links being monitored");
6987                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6988                                                 cp_dis, rp, rp->status);
6989                         } else {
6990                                 BT_DBG("Unset Threshold. Disabling...");
6991                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6992                                                 cp_dis, sizeof(*cp_dis));
6993                         }
6994                         break;
6995                 }
6996         }
6997 }
6998
6999 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
7000                 u16 opcode)
7001 {
7002         struct mgmt_pending_cmd *cmd;
7003
7004         BT_DBG("status 0x%02x", status);
7005
7006         hci_dev_lock(hdev);
7007
7008         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7009         if (!cmd)
7010                 goto unlock;
7011
7012         if (status)
7013                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7014                                 mgmt_status(status));
7015         else
7016                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7017                                 NULL, 0);
7018
7019         mgmt_pending_remove(cmd);
7020
7021 unlock:
7022         hci_dev_unlock(hdev);
7023 }
7024
7025 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7026                 void *data, u16 len)
7027 {
7028         struct mgmt_pending_cmd *cmd;
7029         struct hci_request req;
7030         struct mgmt_cp_set_enable_rssi *cp = data;
7031         struct hci_cp_set_enable_rssi cp_en = { 0, };
7032         int err;
7033
7034         BT_DBG("Set Enable RSSI.");
7035
7036         cp_en.hci_le_ext_opcode = 0x01;
7037         cp_en.le_enable_cs_Features = 0x04;
7038         cp_en.data[0] = 0x00;
7039         cp_en.data[1] = 0x00;
7040         cp_en.data[2] = 0x00;
7041
7042         hci_dev_lock(hdev);
7043
7044         if (!lmp_le_capable(hdev)) {
7045                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7046                                 MGMT_STATUS_NOT_SUPPORTED);
7047                 goto unlocked;
7048         }
7049
7050         if (!hdev_is_powered(hdev)) {
7051                 BT_DBG("%s", hdev->name);
7052                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7053                                 MGMT_STATUS_NOT_POWERED);
7054                 goto unlocked;
7055         }
7056
7057         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
7058                 BT_DBG("%s", hdev->name);
7059                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7060                                 MGMT_STATUS_BUSY);
7061                 goto unlocked;
7062         }
7063
7064         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
7065                         sizeof(*cp));
7066         if (!cmd) {
7067                 BT_DBG("%s", hdev->name);
7068                 err = -ENOMEM;
7069                 goto unlocked;
7070         }
7071
7072         /* If RSSI is already enabled directly set Threshold values */
7073         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
7074                 hci_dev_unlock(hdev);
7075                 BT_DBG("RSSI Enabled. Directly set Threshold");
7076                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
7077                 return err;
7078         }
7079
7080         hci_req_init(&req, hdev);
7081
7082         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7083                         sizeof(struct hci_cp_set_enable_rssi),
7084                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7085                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7086
7087         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7088         err = hci_req_run(&req, set_rssi_enable_complete);
7089
7090         if (err < 0) {
7091                 mgmt_pending_remove(cmd);
7092                 BT_ERR("Error in requesting hci_req_run");
7093                 goto unlocked;
7094         }
7095
7096 unlocked:
7097         hci_dev_unlock(hdev);
7098
7099         return err;
7100 }
7101
7102 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7103 {
7104         struct mgmt_pending_cmd *cmd;
7105
7106         BT_DBG("status 0x%02x", status);
7107
7108         hci_dev_lock(hdev);
7109
7110         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
7111         if (!cmd)
7112                 goto unlock;
7113
7114         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7115                         MGMT_STATUS_SUCCESS, &status, 1);
7116
7117         mgmt_pending_remove(cmd);
7118
7119 unlock:
7120         hci_dev_unlock(hdev);
7121 }
7122
7123 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
7124                         u16 len)
7125 {
7126         struct mgmt_pending_cmd *cmd;
7127         struct hci_request req;
7128         struct mgmt_cp_get_raw_rssi *cp = data;
7129         struct hci_cp_get_raw_rssi hci_cp;
7130
7131         struct hci_conn *conn;
7132         int err;
7133         __u8 dest_type;
7134
7135         BT_DBG("Get Raw RSSI.");
7136
7137         hci_dev_lock(hdev);
7138
7139         if (!lmp_le_capable(hdev)) {
7140                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7141                                 MGMT_STATUS_NOT_SUPPORTED);
7142                 goto unlocked;
7143         }
7144
7145         if (cp->link_type == 0x01)
7146                 dest_type = LE_LINK;
7147         else
7148                 dest_type = ACL_LINK;
7149
7150         /* Get LE/BREDR link handle info */
7151         conn = hci_conn_hash_lookup_ba(hdev,
7152                         dest_type, &cp->bt_address);
7153         if (!conn) {
7154                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7155                                                    MGMT_STATUS_NOT_CONNECTED);
7156                 goto unlocked;
7157         }
7158         hci_cp.conn_handle = conn->handle;
7159
7160         if (!hdev_is_powered(hdev)) {
7161                 BT_DBG("%s", hdev->name);
7162                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7163                                 MGMT_STATUS_NOT_POWERED);
7164                 goto unlocked;
7165         }
7166
7167         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
7168                 BT_DBG("%s", hdev->name);
7169                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7170                                 MGMT_STATUS_BUSY);
7171                 goto unlocked;
7172         }
7173
7174         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
7175         if (!cmd) {
7176                 BT_DBG("%s", hdev->name);
7177                 err = -ENOMEM;
7178                 goto unlocked;
7179         }
7180
7181         hci_req_init(&req, hdev);
7182
7183         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
7184         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
7185         err = hci_req_run(&req, get_raw_rssi_complete);
7186
7187         if (err < 0) {
7188                 mgmt_pending_remove(cmd);
7189                 BT_ERR("Error in requesting hci_req_run");
7190         }
7191
7192 unlocked:
7193         hci_dev_unlock(hdev);
7194
7195         return err;
7196 }
7197
7198 void mgmt_raw_rssi_response(struct hci_dev *hdev,
7199                 struct hci_cc_rp_get_raw_rssi *rp, int success)
7200 {
7201         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
7202         struct hci_conn *conn;
7203
7204         mgmt_rp.status = rp->status;
7205         mgmt_rp.rssi_dbm = rp->rssi_dbm;
7206
7207         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
7208         if (!conn)
7209                 return;
7210
7211         bacpy(&mgmt_rp.bt_address, &conn->dst);
7212         if (conn->type == LE_LINK)
7213                 mgmt_rp.link_type = 0x01;
7214         else
7215                 mgmt_rp.link_type = 0x00;
7216
7217         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
7218                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
7219 }
7220
7221 static void set_disable_threshold_complete(struct hci_dev *hdev,
7222                         u8 status, u16 opcode)
7223 {
7224         struct mgmt_pending_cmd *cmd;
7225
7226         BT_DBG("status 0x%02x", status);
7227
7228         hci_dev_lock(hdev);
7229
7230         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7231         if (!cmd)
7232                 goto unlock;
7233
7234         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7235                         MGMT_STATUS_SUCCESS, &status, 1);
7236
7237         mgmt_pending_remove(cmd);
7238
7239 unlock:
7240         hci_dev_unlock(hdev);
7241 }
7242
7243 /** Removes monitoring for a link*/
7244 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
7245                 void *data, u16 len)
7246 {
7247         int err = 0;
7248         struct hci_cp_set_rssi_threshold th = { 0, };
7249         struct mgmt_cp_disable_rssi *cp = data;
7250         struct hci_conn *conn;
7251         struct mgmt_pending_cmd *cmd;
7252         struct hci_request req;
7253         __u8 dest_type;
7254
7255         BT_DBG("Set Disable RSSI.");
7256
7257         hci_dev_lock(hdev);
7258
7259         if (!lmp_le_capable(hdev)) {
7260                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7261                                 MGMT_STATUS_NOT_SUPPORTED);
7262                 goto unlocked;
7263         }
7264
7265         /* Get LE/ACL link handle info*/
7266         if (cp->link_type == 0x01)
7267                 dest_type = LE_LINK;
7268         else
7269                 dest_type = ACL_LINK;
7270
7271         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
7272         if (!conn) {
7273                 err = mgmt_cmd_complete(sk, hdev->id,
7274                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
7275                 goto unlocked;
7276         }
7277
7278         th.hci_le_ext_opcode = 0x0B;
7279         th.mode = 0x01;
7280         th.conn_handle = conn->handle;
7281         th.alert_mask = 0x00;
7282         th.low_th = 0x00;
7283         th.in_range_th = 0x00;
7284         th.high_th = 0x00;
7285
7286         if (!hdev_is_powered(hdev)) {
7287                 BT_DBG("%s", hdev->name);
7288                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7289                                 0, data, len);
7290                 goto unlocked;
7291         }
7292
7293         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
7294                 BT_DBG("%s", hdev->name);
7295                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7296                                 MGMT_STATUS_BUSY);
7297                 goto unlocked;
7298         }
7299
7300         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
7301                         sizeof(*cp));
7302         if (!cmd) {
7303                 BT_DBG("%s", hdev->name);
7304                 err = -ENOMEM;
7305                 goto unlocked;
7306         }
7307
7308         hci_req_init(&req, hdev);
7309
7310         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7311         err = hci_req_run(&req, set_disable_threshold_complete);
7312         if (err < 0) {
7313                 mgmt_pending_remove(cmd);
7314                 BT_ERR("Error in requesting hci_req_run");
7315                 goto unlocked;
7316         }
7317
7318 unlocked:
7319         hci_dev_unlock(hdev);
7320
7321         return err;
7322 }
7323
7324 void mgmt_rssi_alert_evt(struct hci_dev *hdev, u16 conn_handle,
7325                 s8 alert_type, s8 rssi_dbm)
7326 {
7327         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
7328         struct hci_conn *conn;
7329
7330         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
7331                         conn_handle, alert_type, rssi_dbm);
7332
7333         conn = hci_conn_hash_lookup_handle(hdev, conn_handle);
7334
7335         if (!conn) {
7336                 BT_ERR("RSSI alert Error: Device not found for handle");
7337                 return;
7338         }
7339         bacpy(&mgmt_ev.bdaddr, &conn->dst);
7340
7341         if (conn->type == LE_LINK)
7342                 mgmt_ev.link_type = 0x01;
7343         else
7344                 mgmt_ev.link_type = 0x00;
7345
7346         mgmt_ev.alert_type = alert_type;
7347         mgmt_ev.rssi_dbm = rssi_dbm;
7348
7349         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
7350                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
7351                         NULL);
7352 }
7353
7354 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
7355 {
7356         struct mgmt_pending_cmd *cmd;
7357         u8 type;
7358         int err;
7359
7360         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7361
7362         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7363         if (!cmd)
7364                 return -ENOENT;
7365
7366         type = hdev->le_discovery.type;
7367
7368         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7369                                 mgmt_status(status), &type, sizeof(type));
7370         mgmt_pending_remove(cmd);
7371
7372         return err;
7373 }
7374
7375 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
7376                 u16 opcode)
7377 {
7378         unsigned long timeout = 0;
7379
7380         BT_DBG("status %d", status);
7381
7382         if (status) {
7383                 hci_dev_lock(hdev);
7384                 mgmt_start_le_discovery_failed(hdev, status);
7385                 hci_dev_unlock(hdev);
7386                 return;
7387         }
7388
7389         hci_dev_lock(hdev);
7390         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
7391         hci_dev_unlock(hdev);
7392
7393         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
7394                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
7395
7396         if (!timeout)
7397                 return;
7398
7399         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
7400 }
7401
7402 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
7403                 void *data, u16 len)
7404 {
7405         struct mgmt_cp_start_le_discovery *cp = data;
7406         struct mgmt_pending_cmd *cmd;
7407         struct hci_cp_le_set_scan_param param_cp;
7408         struct hci_cp_le_set_scan_enable enable_cp;
7409         struct hci_request req;
7410         u8 status, own_addr_type;
7411         int err;
7412
7413         BT_DBG("%s", hdev->name);
7414
7415         hci_dev_lock(hdev);
7416
7417         if (!hdev_is_powered(hdev)) {
7418                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7419                                 MGMT_STATUS_NOT_POWERED);
7420                 goto unlock;
7421         }
7422
7423         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
7424                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7425                                 MGMT_STATUS_BUSY);
7426                 goto unlock;
7427         }
7428
7429         if (cp->type != DISCOV_TYPE_LE) {
7430                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7431                                 MGMT_STATUS_INVALID_PARAMS);
7432                 goto unlock;
7433         }
7434
7435         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
7436         if (!cmd) {
7437                 err = -ENOMEM;
7438                 goto unlock;
7439         }
7440
7441         hdev->le_discovery.type = cp->type;
7442
7443         hci_req_init(&req, hdev);
7444
7445         status = mgmt_le_support(hdev);
7446         if (status) {
7447                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7448                                 status);
7449                 mgmt_pending_remove(cmd);
7450                 goto unlock;
7451         }
7452
7453         /* If controller is scanning, it means the background scanning
7454          * is running. Thus, we should temporarily stop it in order to
7455          * set the discovery scanning parameters.
7456          */
7457         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
7458                 hci_req_add_le_scan_disable(&req, false);
7459
7460         memset(&param_cp, 0, sizeof(param_cp));
7461
7462         /* All active scans will be done with either a resolvable
7463          * private address (when privacy feature has been enabled)
7464          * or unresolvable private address.
7465          */
7466         err = hci_update_random_address(&req, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
7467         if (err < 0) {
7468                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7469                                 MGMT_STATUS_FAILED);
7470                 mgmt_pending_remove(cmd);
7471                 goto unlock;
7472         }
7473
7474         param_cp.type = hdev->le_scan_type;
7475         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
7476         param_cp.window = cpu_to_le16(hdev->le_scan_window);
7477         param_cp.own_address_type = own_addr_type;
7478         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
7479                     &param_cp);
7480
7481         memset(&enable_cp, 0, sizeof(enable_cp));
7482         enable_cp.enable = LE_SCAN_ENABLE;
7483         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
7484
7485         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
7486                     &enable_cp);
7487
7488         err = hci_req_run(&req, start_le_discovery_complete);
7489         if (err < 0)
7490                 mgmt_pending_remove(cmd);
7491         else
7492                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
7493
7494 unlock:
7495         hci_dev_unlock(hdev);
7496         return err;
7497 }
7498
7499 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
7500 {
7501         struct mgmt_pending_cmd *cmd;
7502         int err;
7503
7504         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7505         if (!cmd)
7506                 return -ENOENT;
7507
7508         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7509                                 mgmt_status(status), &hdev->le_discovery.type,
7510                                 sizeof(hdev->le_discovery.type));
7511         mgmt_pending_remove(cmd);
7512
7513         return err;
7514 }
7515
7516 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
7517                 u16 opcode)
7518 {
7519         BT_DBG("status %d", status);
7520
7521         hci_dev_lock(hdev);
7522
7523         if (status) {
7524                 mgmt_stop_le_discovery_failed(hdev, status);
7525                 goto unlock;
7526         }
7527
7528         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7529
7530 unlock:
7531         hci_dev_unlock(hdev);
7532 }
7533
7534 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
7535                 void *data, u16 len)
7536 {
7537         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
7538         struct mgmt_pending_cmd *cmd;
7539         struct hci_request req;
7540         int err;
7541
7542         BT_DBG("%s", hdev->name);
7543
7544         hci_dev_lock(hdev);
7545
7546         if (!hci_le_discovery_active(hdev)) {
7547                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7548                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
7549                                         sizeof(mgmt_cp->type));
7550                 goto unlock;
7551         }
7552
7553         if (hdev->le_discovery.type != mgmt_cp->type) {
7554                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7555                                         MGMT_STATUS_INVALID_PARAMS,
7556                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
7557                 goto unlock;
7558         }
7559
7560         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
7561         if (!cmd) {
7562                 err = -ENOMEM;
7563                 goto unlock;
7564         }
7565
7566         hci_req_init(&req, hdev);
7567
7568         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
7569                 BT_DBG("unknown le discovery state %u",
7570                                         hdev->le_discovery.state);
7571
7572                 mgmt_pending_remove(cmd);
7573                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7574                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
7575                                         sizeof(mgmt_cp->type));
7576                 goto unlock;
7577         }
7578
7579         cancel_delayed_work(&hdev->le_scan_disable);
7580         hci_req_add_le_scan_disable(&req, false);
7581
7582         err = hci_req_run(&req, stop_le_discovery_complete);
7583         if (err < 0)
7584                 mgmt_pending_remove(cmd);
7585         else
7586                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
7587
7588 unlock:
7589         hci_dev_unlock(hdev);
7590         return err;
7591 }
7592
7593 /* Separate LE discovery */
7594 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
7595 {
7596         struct mgmt_ev_discovering ev;
7597         struct mgmt_pending_cmd *cmd;
7598
7599         BT_DBG("%s le discovering %u", hdev->name, discovering);
7600
7601         if (discovering)
7602                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7603         else
7604                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7605
7606         if (cmd) {
7607                 u8 type = hdev->le_discovery.type;
7608
7609                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
7610                                   sizeof(type));
7611                 mgmt_pending_remove(cmd);
7612         }
7613
7614         memset(&ev, 0, sizeof(ev));
7615         ev.type = hdev->le_discovery.type;
7616         ev.discovering = discovering;
7617
7618         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7619 }
7620
7621 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
7622                         void *data, u16 len)
7623 {
7624         int err;
7625
7626         BT_DBG("%s", hdev->name);
7627
7628         hci_dev_lock(hdev);
7629
7630         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
7631         if (err < 0)
7632                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
7633
7634         hci_dev_unlock(hdev);
7635
7636         return err;
7637 }
7638
7639 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
7640                 u16 to_multiplier)
7641 {
7642         u16 max_latency;
7643
7644         if (min > max || min < 6 || max > 3200)
7645                 return -EINVAL;
7646
7647         if (to_multiplier < 10 || to_multiplier > 3200)
7648                 return -EINVAL;
7649
7650         if (max >= to_multiplier * 8)
7651                 return -EINVAL;
7652
7653         max_latency = (to_multiplier * 8 / max) - 1;
7654
7655         if (latency > 499 || latency > max_latency)
7656                 return -EINVAL;
7657
7658         return 0;
7659 }
7660
7661 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
7662                 u16 len)
7663 {
7664         struct mgmt_cp_le_conn_update *cp = data;
7665
7666         struct hci_conn *conn;
7667         u16 min, max, latency, supervision_timeout;
7668         int err = -1;
7669
7670         if (!hdev_is_powered(hdev))
7671                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7672                                 MGMT_STATUS_NOT_POWERED);
7673
7674         min = __le16_to_cpu(cp->conn_interval_min);
7675         max = __le16_to_cpu(cp->conn_interval_max);
7676         latency = __le16_to_cpu(cp->conn_latency);
7677         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
7678
7679         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
7680                         min, max, latency, supervision_timeout);
7681
7682         err = check_le_conn_update_param(min, max, latency,
7683                         supervision_timeout);
7684
7685         if (err < 0)
7686                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7687                                 MGMT_STATUS_INVALID_PARAMS);
7688
7689         hci_dev_lock(hdev);
7690
7691         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
7692         if (!conn) {
7693                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7694                                 MGMT_STATUS_NOT_CONNECTED);
7695                 hci_dev_unlock(hdev);
7696                 return err;
7697         }
7698
7699         hci_dev_unlock(hdev);
7700
7701         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
7702
7703         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
7704                                  NULL, 0);
7705 }
7706
7707 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
7708                 u16 opcode)
7709 {
7710         struct mgmt_cp_set_manufacturer_data *cp;
7711         struct mgmt_pending_cmd *cmd;
7712
7713         BT_DBG("status 0x%02x", status);
7714
7715         hci_dev_lock(hdev);
7716
7717         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
7718         if (!cmd)
7719                 goto unlock;
7720
7721         cp = cmd->param;
7722
7723         if (status)
7724                 mgmt_cmd_status(cmd->sk, hdev->id,
7725                                 MGMT_OP_SET_MANUFACTURER_DATA,
7726                                 mgmt_status(status));
7727         else
7728                 mgmt_cmd_complete(cmd->sk, hdev->id,
7729                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
7730                                   cp, sizeof(*cp));
7731
7732         mgmt_pending_remove(cmd);
7733
7734 unlock:
7735         hci_dev_unlock(hdev);
7736 }
7737
7738 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
7739                 void *data, u16 len)
7740 {
7741         struct mgmt_pending_cmd *cmd;
7742         struct hci_request req;
7743         struct mgmt_cp_set_manufacturer_data *cp = data;
7744         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
7745         u8 old_len;
7746         int err;
7747
7748         BT_DBG("%s", hdev->name);
7749
7750         if (!lmp_bredr_capable(hdev))
7751                 return mgmt_cmd_status(sk, hdev->id,
7752                                 MGMT_OP_SET_MANUFACTURER_DATA,
7753                                 MGMT_STATUS_NOT_SUPPORTED);
7754
7755         if (cp->data[0] == 0 ||
7756                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
7757                 return mgmt_cmd_status(sk, hdev->id,
7758                                 MGMT_OP_SET_MANUFACTURER_DATA,
7759                                 MGMT_STATUS_INVALID_PARAMS);
7760
7761         if (cp->data[1] != 0xFF)
7762                 return mgmt_cmd_status(sk, hdev->id,
7763                                 MGMT_OP_SET_MANUFACTURER_DATA,
7764                                 MGMT_STATUS_NOT_SUPPORTED);
7765
7766         hci_dev_lock(hdev);
7767
7768         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
7769                 err = mgmt_cmd_status(sk, hdev->id,
7770                                 MGMT_OP_SET_MANUFACTURER_DATA,
7771                                 MGMT_STATUS_BUSY);
7772                 goto unlocked;
7773         }
7774
7775         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
7776                         len);
7777         if (!cmd) {
7778                 err = -ENOMEM;
7779                 goto unlocked;
7780         }
7781
7782         hci_req_init(&req, hdev);
7783
7784         /* if new data is same as previous data then return command
7785          * complete event
7786          */
7787         if (hdev->manufacturer_len == cp->data[0] - 1 &&
7788             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
7789                 mgmt_pending_remove(cmd);
7790                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
7791                                   0, cp, sizeof(*cp));
7792                 err = 0;
7793                 goto unlocked;
7794         }
7795
7796         old_len = hdev->manufacturer_len;
7797         if (old_len > 0)
7798                 memcpy(old_data, hdev->manufacturer_data, old_len);
7799
7800         hdev->manufacturer_len = cp->data[0] - 1;
7801         if (hdev->manufacturer_len > 0)
7802                 memcpy(hdev->manufacturer_data, cp->data + 2,
7803                                 hdev->manufacturer_len);
7804
7805         __hci_req_update_eir(&req);
7806
7807         err = hci_req_run(&req, set_manufacturer_data_complete);
7808         if (err < 0) {
7809                 mgmt_pending_remove(cmd);
7810                 goto failed;
7811         }
7812
7813 unlocked:
7814         hci_dev_unlock(hdev);
7815
7816         return err;
7817
7818 failed:
7819         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
7820         hdev->manufacturer_len = old_len;
7821         if (hdev->manufacturer_len > 0)
7822                 memcpy(hdev->manufacturer_data, old_data,
7823                        hdev->manufacturer_len);
7824         hci_dev_unlock(hdev);
7825         return err;
7826 }
7827
7828 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
7829                 void *data, u16 len)
7830 {
7831         struct mgmt_cp_le_set_scan_params *cp = data;
7832         __u16 interval, window;
7833         int err;
7834
7835         BT_DBG("%s", hdev->name);
7836
7837         if (!lmp_le_capable(hdev))
7838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7839                                 MGMT_STATUS_NOT_SUPPORTED);
7840
7841         interval = __le16_to_cpu(cp->interval);
7842
7843         if (interval < 0x0004 || interval > 0x4000)
7844                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7845                                 MGMT_STATUS_INVALID_PARAMS);
7846
7847         window = __le16_to_cpu(cp->window);
7848
7849         if (window < 0x0004 || window > 0x4000)
7850                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7851                                 MGMT_STATUS_INVALID_PARAMS);
7852
7853         if (window > interval)
7854                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7855                                 MGMT_STATUS_INVALID_PARAMS);
7856
7857         hci_dev_lock(hdev);
7858
7859         hdev->le_scan_type = cp->type;
7860         hdev->le_scan_interval = interval;
7861         hdev->le_scan_window = window;
7862
7863         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
7864                                 NULL, 0);
7865
7866         /* If background scan is running, restart it so new parameters are
7867          * loaded.
7868          */
7869         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
7870             hdev->discovery.state == DISCOVERY_STOPPED) {
7871                 struct hci_request req;
7872
7873                 hci_req_init(&req, hdev);
7874
7875                 hci_req_add_le_scan_disable(&req, false);
7876                 hci_req_add_le_passive_scan(&req);
7877
7878                 hci_req_run(&req, NULL);
7879         }
7880
7881         hci_dev_unlock(hdev);
7882
7883         return err;
7884 }
7885
7886 static int set_voice_setting(struct sock *sk, struct hci_dev *hdev,
7887                 void *data, u16 len)
7888 {
7889         struct mgmt_cp_set_voice_setting *cp = data;
7890         struct hci_conn *conn;
7891         struct hci_conn *sco_conn;
7892
7893         int err;
7894
7895         BT_DBG("%s", hdev->name);
7896
7897         if (!lmp_bredr_capable(hdev)) {
7898                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING,
7899                                 MGMT_STATUS_NOT_SUPPORTED);
7900         }
7901
7902         hci_dev_lock(hdev);
7903
7904         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
7905         if (!conn) {
7906                 err = mgmt_cmd_complete(sk, hdev->id,
7907                                 MGMT_OP_SET_VOICE_SETTING, 0, NULL, 0);
7908                 goto unlock;
7909         }
7910
7911         conn->voice_setting = cp->voice_setting;
7912         conn->sco_role = cp->sco_role;
7913
7914         sco_conn = hci_conn_hash_lookup_sco(hdev);
7915         if (sco_conn && bacmp(&sco_conn->dst, &cp->bdaddr) != 0) {
7916                 BT_ERR("There is other SCO connection.");
7917                 goto done;
7918         }
7919
7920         if (conn->sco_role == MGMT_SCO_ROLE_HANDSFREE) {
7921                 if (conn->voice_setting == 0x0063)
7922                         sco_connect_set_wbc(hdev);
7923                 else
7924                         sco_connect_set_nbc(hdev);
7925         } else {
7926                 if (conn->voice_setting == 0x0063)
7927                         sco_connect_set_gw_wbc(hdev);
7928                 else
7929                         sco_connect_set_gw_nbc(hdev);
7930         }
7931
7932 done:
7933         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
7934                         cp, sizeof(cp));
7935
7936 unlock:
7937         hci_dev_unlock(hdev);
7938         return err;
7939 }
7940
7941 static int get_adv_tx_power(struct sock *sk, struct hci_dev *hdev,
7942                 void *data, u16 len)
7943 {
7944         struct mgmt_rp_get_adv_tx_power *rp;
7945         size_t rp_len;
7946         int err;
7947
7948         BT_DBG("%s", hdev->name);
7949
7950         hci_dev_lock(hdev);
7951
7952         rp_len = sizeof(*rp);
7953         rp = kmalloc(rp_len, GFP_KERNEL);
7954         if (!rp) {
7955                 err = -ENOMEM;
7956                 goto unlock;
7957         }
7958
7959         rp->adv_tx_power = hdev->adv_tx_power;
7960
7961         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_TX_POWER, 0, rp,
7962                                 rp_len);
7963
7964         kfree(rp);
7965
7966 unlock:
7967         hci_dev_unlock(hdev);
7968
7969         return err;
7970 }
7971
7972 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
7973 {
7974         struct mgmt_ev_hardware_error ev;
7975
7976         ev.error_code = err_code;
7977         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
7978 }
7979
7980 void mgmt_tx_timeout_error(struct hci_dev *hdev)
7981 {
7982         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
7983 }
7984
7985 void mgmt_multi_adv_state_change_evt(struct hci_dev *hdev, u8 adv_instance,
7986                 u8 state_change_reason, u16 connection_handle)
7987 {
7988         struct mgmt_ev_vendor_specific_multi_adv_state_changed mgmt_ev;
7989
7990         BT_DBG("Multi adv state changed [%2.2X %2.2X %2.2X]",
7991                adv_instance, state_change_reason, connection_handle);
7992
7993         mgmt_ev.adv_instance = adv_instance;
7994         mgmt_ev.state_change_reason = state_change_reason;
7995         mgmt_ev.connection_handle = connection_handle;
7996
7997         mgmt_event(MGMT_EV_MULTI_ADV_STATE_CHANGED, hdev, &mgmt_ev,
7998                 sizeof(struct mgmt_ev_vendor_specific_multi_adv_state_changed),
7999                 NULL);
8000 }
8001
8002 static int enable_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8003                 void *data, u16 len)
8004 {
8005         int err;
8006         struct mgmt_cp_enable_6lowpan *cp = data;
8007
8008         BT_DBG("%s", hdev->name);
8009
8010         hci_dev_lock(hdev);
8011
8012         if (!hdev_is_powered(hdev)) {
8013                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8014                                       MGMT_STATUS_NOT_POWERED);
8015                 goto unlocked;
8016         }
8017
8018         if (!lmp_le_capable(hdev)) {
8019                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8020                                       MGMT_STATUS_NOT_SUPPORTED);
8021                 goto unlocked;
8022         }
8023
8024         if (cp->enable_6lowpan)
8025                 bt_6lowpan_enable();
8026         else
8027                 bt_6lowpan_disable();
8028
8029         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8030                                 MGMT_STATUS_SUCCESS, NULL, 0);
8031 unlocked:
8032         hci_dev_unlock(hdev);
8033         return err;
8034 }
8035
8036 static int connect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8037                 void *data, u16 len)
8038 {
8039         struct mgmt_cp_connect_6lowpan *cp = data;
8040         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
8041         int err;
8042
8043         BT_DBG("%s", hdev->name);
8044
8045         hci_dev_lock(hdev);
8046
8047         if (!lmp_le_capable(hdev)) {
8048                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8049                                       MGMT_STATUS_NOT_SUPPORTED);
8050                 goto unlocked;
8051         }
8052
8053         if (!hdev_is_powered(hdev)) {
8054                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8055                                       MGMT_STATUS_REJECTED);
8056                 goto unlocked;
8057         }
8058
8059         if (bdaddr_type_is_le(cp->addr.type)) {
8060                 if (cp->addr.type == BDADDR_LE_PUBLIC)
8061                         addr_type = ADDR_LE_DEV_PUBLIC;
8062                 else
8063                         addr_type = ADDR_LE_DEV_RANDOM;
8064         } else {
8065                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8066                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
8067                 goto unlocked;
8068         }
8069
8070         hci_dev_unlock(hdev);
8071
8072         /* 6lowpan Connect */
8073         err = _bt_6lowpan_connect(&cp->addr.bdaddr, cp->addr.type);
8074
8075         hci_dev_lock(hdev);
8076
8077         if (err < 0) {
8078                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8079                                         MGMT_STATUS_REJECTED, NULL, 0);
8080
8081                 goto unlocked;
8082         }
8083
8084         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
8085                                 NULL, 0);
8086 unlocked:
8087         hci_dev_unlock(hdev);
8088         return err;
8089 }
8090
8091 static int disconnect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8092                 void *data, u16 len)
8093 {
8094         struct mgmt_cp_disconnect_6lowpan *cp = data;
8095         struct hci_conn *conn = NULL;
8096         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
8097         int err;
8098
8099         BT_DBG("%s", hdev->name);
8100
8101         hci_dev_lock(hdev);
8102
8103         if (!lmp_le_capable(hdev)) {
8104                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
8105                                       MGMT_STATUS_NOT_SUPPORTED);
8106                 goto unlocked;
8107         }
8108
8109         if (!hdev_is_powered(hdev)) {
8110                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
8111                                       MGMT_STATUS_REJECTED);
8112                 goto unlocked;
8113         }
8114
8115         if (bdaddr_type_is_le(cp->addr.type)) {
8116                 if (cp->addr.type == BDADDR_LE_PUBLIC)
8117                         addr_type = ADDR_LE_DEV_PUBLIC;
8118                 else
8119                         addr_type = ADDR_LE_DEV_RANDOM;
8120         } else {
8121                 err = mgmt_cmd_complete(sk, hdev->id,
8122                                         MGMT_OP_DISCONNECT_6LOWPAN,
8123                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
8124                 goto unlocked;
8125         }
8126
8127         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8128         if (!conn) {
8129                 err = mgmt_cmd_complete(sk, hdev->id,
8130                                         MGMT_OP_DISCONNECT_6LOWPAN,
8131                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
8132                 goto unlocked;
8133         }
8134
8135         if (conn->dst_type != addr_type) {
8136                 err = mgmt_cmd_complete(sk, hdev->id,
8137                                         MGMT_OP_DISCONNECT_6LOWPAN,
8138                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
8139                 goto unlocked;
8140         }
8141
8142         if (conn->state != BT_CONNECTED) {
8143                 err = mgmt_cmd_complete(sk, hdev->id,
8144                                         MGMT_OP_DISCONNECT_6LOWPAN,
8145                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
8146                 goto unlocked;
8147         }
8148
8149         /* 6lowpan Disconnect */
8150         err = _bt_6lowpan_disconnect(conn->l2cap_data, cp->addr.type);
8151         if (err < 0) {
8152                 err = mgmt_cmd_complete(sk, hdev->id,
8153                                         MGMT_OP_DISCONNECT_6LOWPAN,
8154                                         MGMT_STATUS_REJECTED, NULL, 0);
8155                 goto unlocked;
8156         }
8157
8158         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
8159                                 NULL, 0);
8160
8161 unlocked:
8162         hci_dev_unlock(hdev);
8163         return err;
8164 }
8165
8166 void mgmt_6lowpan_conn_changed(struct hci_dev *hdev, char if_name[16],
8167                 bdaddr_t *bdaddr, u8 addr_type, bool connected)
8168 {
8169         char buf[512];
8170         struct mgmt_ev_6lowpan_conn_state_changed *ev = (void *)buf;
8171         size_t ev_size;
8172
8173         memset(buf, 0, sizeof(buf));
8174         bacpy(&ev->addr.bdaddr, bdaddr);
8175         ev->addr.type = addr_type;
8176         ev->connected = connected;
8177         memcpy(ev->ifname, (__u8 *)if_name, 16);
8178
8179         ev_size = sizeof(*ev);
8180
8181         mgmt_event(MGMT_EV_6LOWPAN_CONN_STATE_CHANGED, hdev, ev, ev_size, NULL);
8182 }
8183
8184 void mgmt_le_read_maximum_data_length_complete(struct hci_dev *hdev, u8 status)
8185 {
8186         struct mgmt_pending_cmd *cmd;
8187         struct mgmt_rp_le_read_maximum_data_length rp;
8188
8189         BT_DBG("%s status %u", hdev->name, status);
8190
8191         cmd = pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev);
8192         if (!cmd)
8193                 return;
8194
8195         if (status)
8196                 mgmt_cmd_status(cmd->sk, hdev->id,
8197                                 MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8198                                 mgmt_status(status));
8199
8200         memset(&rp, 0, sizeof(rp));
8201
8202         rp.max_tx_octets = cpu_to_le16(hdev->le_max_tx_len);
8203         rp.max_tx_time = cpu_to_le16(hdev->le_max_tx_time);
8204         rp.max_rx_octets = cpu_to_le16(hdev->le_max_rx_len);
8205         rp.max_rx_time = cpu_to_le16(hdev->le_max_rx_time);
8206
8207         mgmt_cmd_complete(cmd->sk, hdev->id,
8208                           MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, 0,
8209                           &rp, sizeof(rp));
8210
8211         mgmt_pending_remove(cmd);
8212 }
8213
8214 static int read_maximum_le_data_length(struct sock *sk,
8215                 struct hci_dev *hdev, void *data, u16 len)
8216 {
8217         struct mgmt_pending_cmd *cmd;
8218         int err;
8219
8220         BT_DBG("read_maximum_le_data_length  %s", hdev->name);
8221
8222         hci_dev_lock(hdev);
8223
8224         if (!hdev_is_powered(hdev)) {
8225                 err = mgmt_cmd_status(sk, hdev->id,
8226                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8227                                       MGMT_STATUS_NOT_POWERED);
8228                 goto unlock;
8229         }
8230
8231         if (!lmp_le_capable(hdev)) {
8232                 err = mgmt_cmd_status(sk, hdev->id,
8233                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8234                                       MGMT_STATUS_NOT_SUPPORTED);
8235                 goto unlock;
8236         }
8237
8238         if (pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev)) {
8239                 err = mgmt_cmd_status(sk, hdev->id,
8240                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8241                                       MGMT_STATUS_BUSY);
8242                 goto unlock;
8243         }
8244
8245         cmd = mgmt_pending_add(sk, MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8246                                hdev, data, len);
8247         if (!cmd) {
8248                 err = -ENOMEM;
8249                 goto unlock;
8250         }
8251
8252         err = hci_send_cmd(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
8253         if (err < 0)
8254                 mgmt_pending_remove(cmd);
8255
8256 unlock:
8257         hci_dev_unlock(hdev);
8258         return err;
8259 }
8260
8261 void mgmt_le_write_host_suggested_data_length_complete(struct hci_dev *hdev,
8262                 u8 status)
8263 {
8264         struct mgmt_pending_cmd *cmd;
8265
8266         BT_DBG("status 0x%02x", status);
8267
8268         hci_dev_lock(hdev);
8269
8270         cmd = pending_find(MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH, hdev);
8271         if (!cmd) {
8272                 BT_ERR("cmd not found in the pending list");
8273                 goto unlock;
8274         }
8275
8276         if (status)
8277                 mgmt_cmd_status(cmd->sk, hdev->id,
8278                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8279                                 mgmt_status(status));
8280         else
8281                 mgmt_cmd_complete(cmd->sk, hdev->id,
8282                                   MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8283                                   0, NULL, 0);
8284
8285         mgmt_pending_remove(cmd);
8286
8287 unlock:
8288         hci_dev_unlock(hdev);
8289 }
8290
8291 static int write_host_suggested_le_data_length(struct sock *sk,
8292                 struct hci_dev *hdev, void *data, u16 len)
8293 {
8294         struct mgmt_pending_cmd *cmd;
8295         struct mgmt_cp_le_write_host_suggested_data_length *cp = data;
8296         struct hci_cp_le_write_def_data_len hci_data;
8297         int err = 0;
8298
8299         BT_DBG("Write host suggested data length request for %s", hdev->name);
8300
8301         hci_dev_lock(hdev);
8302
8303         if (!hdev_is_powered(hdev)) {
8304                 err = mgmt_cmd_status(sk, hdev->id,
8305                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8306                                 MGMT_STATUS_NOT_POWERED);
8307                 goto unlock;
8308         }
8309
8310         if (!lmp_le_capable(hdev)) {
8311                 err = mgmt_cmd_status(sk, hdev->id,
8312                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8313                                 MGMT_STATUS_NOT_SUPPORTED);
8314                 goto unlock;
8315         }
8316
8317         if (pending_find(MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH, hdev)) {
8318                 err = mgmt_cmd_status(sk, hdev->id,
8319                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8320                                 MGMT_STATUS_BUSY);
8321                 goto unlock;
8322         }
8323
8324         cmd = mgmt_pending_add(sk, MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
8325                                hdev, data, len);
8326         if (!cmd) {
8327                 err = -ENOMEM;
8328                 goto unlock;
8329         }
8330
8331         hci_data.tx_len = cp->def_tx_octets;
8332         hci_data.tx_time = cp->def_tx_time;
8333
8334         err = hci_send_cmd(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN,
8335                            sizeof(hci_data), &hci_data);
8336         if (err < 0)
8337                 mgmt_pending_remove(cmd);
8338
8339 unlock:
8340         hci_dev_unlock(hdev);
8341
8342         return err;
8343 }
8344
8345 void mgmt_le_read_host_suggested_data_length_complete(struct hci_dev *hdev,
8346                 u8 status)
8347 {
8348         struct mgmt_pending_cmd *cmd;
8349         struct mgmt_rp_le_read_host_suggested_data_length rp;
8350
8351         BT_DBG("%s status %u", hdev->name, status);
8352
8353         cmd = pending_find(MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, hdev);
8354         if (!cmd) {
8355                 BT_ERR("cmd not found in the pending list");
8356                 return;
8357         }
8358
8359         if (status)
8360                 mgmt_cmd_status(cmd->sk, hdev->id,
8361                         MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
8362                         mgmt_status(status));
8363
8364         memset(&rp, 0, sizeof(rp));
8365
8366         rp.def_tx_octets = cpu_to_le16(hdev->le_def_tx_len);
8367         rp.def_tx_time = cpu_to_le16(hdev->le_def_tx_time);
8368
8369         mgmt_cmd_complete(cmd->sk, hdev->id,
8370                           MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, 0,
8371                           &rp, sizeof(rp));
8372
8373         mgmt_pending_remove(cmd);
8374 }
8375
8376 static int read_host_suggested_data_length(struct sock *sk,
8377                 struct hci_dev *hdev, void *data, u16 len)
8378 {
8379         struct mgmt_pending_cmd *cmd;
8380         int err;
8381
8382         BT_DBG("read_host_suggested_data_length %s", hdev->name);
8383
8384         hci_dev_lock(hdev);
8385
8386         if (!hdev_is_powered(hdev)) {
8387                 err = mgmt_cmd_status(sk, hdev->id,
8388                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
8389                                 MGMT_STATUS_NOT_POWERED);
8390                 goto unlock;
8391         }
8392
8393         if (!lmp_le_capable(hdev)) {
8394                 err = mgmt_cmd_status(sk, hdev->id,
8395                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
8396                                 MGMT_STATUS_NOT_SUPPORTED);
8397                 goto unlock;
8398         }
8399
8400         if (pending_find(MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, hdev)) {
8401                 err = mgmt_cmd_status(sk, hdev->id,
8402                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
8403                                 MGMT_STATUS_BUSY);
8404                 goto unlock;
8405         }
8406
8407         cmd = mgmt_pending_add(sk, MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
8408                                hdev, data, len);
8409         if (!cmd) {
8410                 err = -ENOMEM;
8411                 goto unlock;
8412         }
8413
8414         err = hci_send_cmd(hdev, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
8415         if (err < 0)
8416                 mgmt_pending_remove(cmd);
8417
8418 unlock:
8419         hci_dev_unlock(hdev);
8420
8421         return err;
8422 }
8423
8424 static int set_le_data_length_params(struct sock *sk, struct hci_dev *hdev,
8425                 void *data, u16 len)
8426 {
8427         struct mgmt_cp_le_set_data_length *cp = data;
8428         struct mgmt_rp_le_set_data_length *rp;
8429         struct mgmt_pending_cmd *cmd;
8430         struct hci_conn *conn;
8431         int err = 0;
8432         u16 max_tx_octets, max_tx_time;
8433         size_t rp_len;
8434
8435         BT_INFO("Set Data length for the device %s", hdev->name);
8436
8437         hci_dev_lock(hdev);
8438
8439         rp_len = sizeof(*rp);
8440         rp = kmalloc(rp_len, GFP_KERNEL);
8441         if (!rp) {
8442                 err = -ENOMEM;
8443                 goto unlock;
8444         }
8445
8446         if (!hdev_is_powered(hdev)) {
8447                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
8448                                       MGMT_STATUS_NOT_POWERED);
8449                 goto unlock;
8450         }
8451
8452         if (!lmp_le_capable(hdev)) {
8453                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
8454                                       MGMT_STATUS_NOT_SUPPORTED);
8455                 goto unlock;
8456         }
8457
8458         if (pending_find(MGMT_OP_LE_SET_DATA_LENGTH, hdev)) {
8459                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
8460                                       MGMT_STATUS_BUSY);
8461                 goto unlock;
8462         }
8463
8464         cmd = mgmt_pending_add(sk, MGMT_OP_LE_SET_DATA_LENGTH, hdev, data, len);
8465         if (!cmd) {
8466                 err = -ENOMEM;
8467                 goto unlock;
8468         }
8469
8470         max_tx_octets = __le16_to_cpu(cp->max_tx_octets);
8471         max_tx_time = __le16_to_cpu(cp->max_tx_time);
8472
8473         BT_DBG("max_tx_octets 0x%4.4x max_tx_time 0x%4.4x latency",
8474                max_tx_octets, max_tx_time);
8475
8476         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
8477         if (!conn) {
8478                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
8479                                 MGMT_STATUS_NOT_CONNECTED);
8480                 goto unlock;
8481         }
8482
8483         hci_dev_unlock(hdev);
8484
8485         err = hci_le_set_data_length(conn, max_tx_octets, max_tx_time);
8486         if (err < 0)
8487                 mgmt_pending_remove(cmd);
8488
8489         rp->handle = conn->handle;
8490         rp->status = 0;
8491
8492         hci_dev_lock(hdev);
8493         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH, 0,
8494                                 rp, rp_len);
8495 unlock:
8496         kfree(rp);
8497         hci_dev_unlock(hdev);
8498
8499         return err;
8500 }
8501
8502 void mgmt_le_data_length_change_complete(struct hci_dev *hdev,
8503                 bdaddr_t *bdaddr, u16 tx_octets, u16 tx_time,
8504                 u16 rx_octets, u16 rx_time)
8505 {
8506         struct mgmt_ev_le_data_length_changed ev;
8507
8508         bacpy(&ev.addr.bdaddr, bdaddr);
8509         ev.max_tx_octets = tx_octets;
8510         ev.max_tx_time = tx_time;
8511         ev.max_rx_octets = rx_octets;
8512         ev.max_rx_time = rx_time;
8513
8514         mgmt_event(MGMT_EV_LE_DATA_LENGTH_CHANGED, hdev, &ev, sizeof(ev), NULL);
8515 }
8516 #endif /* TIZEN_BT */
8517
8518 static bool ltk_is_valid(struct mgmt_ltk_info *key)
8519 {
8520         if (key->initiator != 0x00 && key->initiator != 0x01)
8521                 return false;
8522
8523         switch (key->addr.type) {
8524         case BDADDR_LE_PUBLIC:
8525                 return true;
8526
8527         case BDADDR_LE_RANDOM:
8528                 /* Two most significant bits shall be set */
8529                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
8530                         return false;
8531                 return true;
8532         }
8533
8534         return false;
8535 }
8536
8537 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
8538                                void *cp_data, u16 len)
8539 {
8540         struct mgmt_cp_load_long_term_keys *cp = cp_data;
8541         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
8542                                    sizeof(struct mgmt_ltk_info));
8543         u16 key_count, expected_len;
8544         int i, err;
8545
8546         bt_dev_dbg(hdev, "sock %p", sk);
8547
8548         if (!lmp_le_capable(hdev))
8549                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8550                                        MGMT_STATUS_NOT_SUPPORTED);
8551
8552         key_count = __le16_to_cpu(cp->key_count);
8553         if (key_count > max_key_count) {
8554                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
8555                            key_count);
8556                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8557                                        MGMT_STATUS_INVALID_PARAMS);
8558         }
8559
8560         expected_len = struct_size(cp, keys, key_count);
8561         if (expected_len != len) {
8562                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
8563                            expected_len, len);
8564                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8565                                        MGMT_STATUS_INVALID_PARAMS);
8566         }
8567
8568         bt_dev_dbg(hdev, "key_count %u", key_count);
8569
8570         for (i = 0; i < key_count; i++) {
8571                 struct mgmt_ltk_info *key = &cp->keys[i];
8572
8573                 if (!ltk_is_valid(key))
8574                         return mgmt_cmd_status(sk, hdev->id,
8575                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
8576                                                MGMT_STATUS_INVALID_PARAMS);
8577         }
8578
8579         hci_dev_lock(hdev);
8580
8581         hci_smp_ltks_clear(hdev);
8582
8583         for (i = 0; i < key_count; i++) {
8584                 struct mgmt_ltk_info *key = &cp->keys[i];
8585                 u8 type, authenticated;
8586
8587                 if (hci_is_blocked_key(hdev,
8588                                        HCI_BLOCKED_KEY_TYPE_LTK,
8589                                        key->val)) {
8590                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
8591                                     &key->addr.bdaddr);
8592                         continue;
8593                 }
8594
8595                 switch (key->type) {
8596                 case MGMT_LTK_UNAUTHENTICATED:
8597                         authenticated = 0x00;
8598                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8599                         break;
8600                 case MGMT_LTK_AUTHENTICATED:
8601                         authenticated = 0x01;
8602                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8603                         break;
8604                 case MGMT_LTK_P256_UNAUTH:
8605                         authenticated = 0x00;
8606                         type = SMP_LTK_P256;
8607                         break;
8608                 case MGMT_LTK_P256_AUTH:
8609                         authenticated = 0x01;
8610                         type = SMP_LTK_P256;
8611                         break;
8612                 case MGMT_LTK_P256_DEBUG:
8613                         authenticated = 0x00;
8614                         type = SMP_LTK_P256_DEBUG;
8615                         fallthrough;
8616                 default:
8617                         continue;
8618                 }
8619
8620                 hci_add_ltk(hdev, &key->addr.bdaddr,
8621                             le_addr_type(key->addr.type), type, authenticated,
8622                             key->val, key->enc_size, key->ediv, key->rand);
8623         }
8624
8625         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
8626                            NULL, 0);
8627
8628         hci_dev_unlock(hdev);
8629
8630         return err;
8631 }
8632
8633 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8634 {
8635         struct hci_conn *conn = cmd->user_data;
8636         struct mgmt_rp_get_conn_info rp;
8637         int err;
8638
8639         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8640
8641         if (status == MGMT_STATUS_SUCCESS) {
8642                 rp.rssi = conn->rssi;
8643                 rp.tx_power = conn->tx_power;
8644                 rp.max_tx_power = conn->max_tx_power;
8645         } else {
8646                 rp.rssi = HCI_RSSI_INVALID;
8647                 rp.tx_power = HCI_TX_POWER_INVALID;
8648                 rp.max_tx_power = HCI_TX_POWER_INVALID;
8649         }
8650
8651         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
8652                                 status, &rp, sizeof(rp));
8653
8654         hci_conn_drop(conn);
8655         hci_conn_put(conn);
8656
8657         return err;
8658 }
8659
8660 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
8661                                        u16 opcode)
8662 {
8663         struct hci_cp_read_rssi *cp;
8664         struct mgmt_pending_cmd *cmd;
8665         struct hci_conn *conn;
8666         u16 handle;
8667         u8 status;
8668
8669         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
8670
8671         hci_dev_lock(hdev);
8672
8673         /* Commands sent in request are either Read RSSI or Read Transmit Power
8674          * Level so we check which one was last sent to retrieve connection
8675          * handle.  Both commands have handle as first parameter so it's safe to
8676          * cast data on the same command struct.
8677          *
8678          * First command sent is always Read RSSI and we fail only if it fails.
8679          * In other case we simply override error to indicate success as we
8680          * already remembered if TX power value is actually valid.
8681          */
8682         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
8683         if (!cp) {
8684                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
8685                 status = MGMT_STATUS_SUCCESS;
8686         } else {
8687                 status = mgmt_status(hci_status);
8688         }
8689
8690         if (!cp) {
8691                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
8692                 goto unlock;
8693         }
8694
8695         handle = __le16_to_cpu(cp->handle);
8696         conn = hci_conn_hash_lookup_handle(hdev, handle);
8697         if (!conn) {
8698                 bt_dev_err(hdev, "unknown handle (%u) in conn_info response",
8699                            handle);
8700                 goto unlock;
8701         }
8702
8703         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
8704         if (!cmd)
8705                 goto unlock;
8706
8707         cmd->cmd_complete(cmd, status);
8708         mgmt_pending_remove(cmd);
8709
8710 unlock:
8711         hci_dev_unlock(hdev);
8712 }
8713
8714 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
8715                          u16 len)
8716 {
8717         struct mgmt_cp_get_conn_info *cp = data;
8718         struct mgmt_rp_get_conn_info rp;
8719         struct hci_conn *conn;
8720         unsigned long conn_info_age;
8721         int err = 0;
8722
8723         bt_dev_dbg(hdev, "sock %p", sk);
8724
8725         memset(&rp, 0, sizeof(rp));
8726         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8727         rp.addr.type = cp->addr.type;
8728
8729         if (!bdaddr_type_is_valid(cp->addr.type))
8730                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8731                                          MGMT_STATUS_INVALID_PARAMS,
8732                                          &rp, sizeof(rp));
8733
8734         hci_dev_lock(hdev);
8735
8736         if (!hdev_is_powered(hdev)) {
8737                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8738                                         MGMT_STATUS_NOT_POWERED, &rp,
8739                                         sizeof(rp));
8740                 goto unlock;
8741         }
8742
8743         if (cp->addr.type == BDADDR_BREDR)
8744                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8745                                                &cp->addr.bdaddr);
8746         else
8747                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8748
8749         if (!conn || conn->state != BT_CONNECTED) {
8750                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8751                                         MGMT_STATUS_NOT_CONNECTED, &rp,
8752                                         sizeof(rp));
8753                 goto unlock;
8754         }
8755
8756         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
8757                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8758                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
8759                 goto unlock;
8760         }
8761
8762         /* To avoid client trying to guess when to poll again for information we
8763          * calculate conn info age as random value between min/max set in hdev.
8764          */
8765         conn_info_age = hdev->conn_info_min_age +
8766                         prandom_u32_max(hdev->conn_info_max_age -
8767                                         hdev->conn_info_min_age);
8768
8769         /* Query controller to refresh cached values if they are too old or were
8770          * never read.
8771          */
8772         if (time_after(jiffies, conn->conn_info_timestamp +
8773                        msecs_to_jiffies(conn_info_age)) ||
8774             !conn->conn_info_timestamp) {
8775                 struct hci_request req;
8776                 struct hci_cp_read_tx_power req_txp_cp;
8777                 struct hci_cp_read_rssi req_rssi_cp;
8778                 struct mgmt_pending_cmd *cmd;
8779
8780                 hci_req_init(&req, hdev);
8781                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
8782                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
8783                             &req_rssi_cp);
8784
8785                 /* For LE links TX power does not change thus we don't need to
8786                  * query for it once value is known.
8787                  */
8788                 if (!bdaddr_type_is_le(cp->addr.type) ||
8789                     conn->tx_power == HCI_TX_POWER_INVALID) {
8790                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8791                         req_txp_cp.type = 0x00;
8792                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8793                                     sizeof(req_txp_cp), &req_txp_cp);
8794                 }
8795
8796                 /* Max TX power needs to be read only once per connection */
8797                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
8798                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8799                         req_txp_cp.type = 0x01;
8800                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8801                                     sizeof(req_txp_cp), &req_txp_cp);
8802                 }
8803
8804                 err = hci_req_run(&req, conn_info_refresh_complete);
8805                 if (err < 0)
8806                         goto unlock;
8807
8808                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
8809                                        data, len);
8810                 if (!cmd) {
8811                         err = -ENOMEM;
8812                         goto unlock;
8813                 }
8814
8815                 hci_conn_hold(conn);
8816                 cmd->user_data = hci_conn_get(conn);
8817                 cmd->cmd_complete = conn_info_cmd_complete;
8818
8819                 conn->conn_info_timestamp = jiffies;
8820         } else {
8821                 /* Cache is valid, just reply with values cached in hci_conn */
8822                 rp.rssi = conn->rssi;
8823                 rp.tx_power = conn->tx_power;
8824                 rp.max_tx_power = conn->max_tx_power;
8825
8826                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8827                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8828         }
8829
8830 unlock:
8831         hci_dev_unlock(hdev);
8832         return err;
8833 }
8834
8835 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8836 {
8837         struct hci_conn *conn = cmd->user_data;
8838         struct mgmt_rp_get_clock_info rp;
8839         struct hci_dev *hdev;
8840         int err;
8841
8842         memset(&rp, 0, sizeof(rp));
8843         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8844
8845         if (status)
8846                 goto complete;
8847
8848         hdev = hci_dev_get(cmd->index);
8849         if (hdev) {
8850                 rp.local_clock = cpu_to_le32(hdev->clock);
8851                 hci_dev_put(hdev);
8852         }
8853
8854         if (conn) {
8855                 rp.piconet_clock = cpu_to_le32(conn->clock);
8856                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
8857         }
8858
8859 complete:
8860         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
8861                                 sizeof(rp));
8862
8863         if (conn) {
8864                 hci_conn_drop(conn);
8865                 hci_conn_put(conn);
8866         }
8867
8868         return err;
8869 }
8870
8871 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8872 {
8873         struct hci_cp_read_clock *hci_cp;
8874         struct mgmt_pending_cmd *cmd;
8875         struct hci_conn *conn;
8876
8877         bt_dev_dbg(hdev, "status %u", status);
8878
8879         hci_dev_lock(hdev);
8880
8881         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
8882         if (!hci_cp)
8883                 goto unlock;
8884
8885         if (hci_cp->which) {
8886                 u16 handle = __le16_to_cpu(hci_cp->handle);
8887                 conn = hci_conn_hash_lookup_handle(hdev, handle);
8888         } else {
8889                 conn = NULL;
8890         }
8891
8892         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
8893         if (!cmd)
8894                 goto unlock;
8895
8896         cmd->cmd_complete(cmd, mgmt_status(status));
8897         mgmt_pending_remove(cmd);
8898
8899 unlock:
8900         hci_dev_unlock(hdev);
8901 }
8902
8903 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8904                          u16 len)
8905 {
8906         struct mgmt_cp_get_clock_info *cp = data;
8907         struct mgmt_rp_get_clock_info rp;
8908         struct hci_cp_read_clock hci_cp;
8909         struct mgmt_pending_cmd *cmd;
8910         struct hci_request req;
8911         struct hci_conn *conn;
8912         int err;
8913
8914         bt_dev_dbg(hdev, "sock %p", sk);
8915
8916         memset(&rp, 0, sizeof(rp));
8917         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8918         rp.addr.type = cp->addr.type;
8919
8920         if (cp->addr.type != BDADDR_BREDR)
8921                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8922                                          MGMT_STATUS_INVALID_PARAMS,
8923                                          &rp, sizeof(rp));
8924
8925         hci_dev_lock(hdev);
8926
8927         if (!hdev_is_powered(hdev)) {
8928                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8929                                         MGMT_STATUS_NOT_POWERED, &rp,
8930                                         sizeof(rp));
8931                 goto unlock;
8932         }
8933
8934         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8935                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8936                                                &cp->addr.bdaddr);
8937                 if (!conn || conn->state != BT_CONNECTED) {
8938                         err = mgmt_cmd_complete(sk, hdev->id,
8939                                                 MGMT_OP_GET_CLOCK_INFO,
8940                                                 MGMT_STATUS_NOT_CONNECTED,
8941                                                 &rp, sizeof(rp));
8942                         goto unlock;
8943                 }
8944         } else {
8945                 conn = NULL;
8946         }
8947
8948         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8949         if (!cmd) {
8950                 err = -ENOMEM;
8951                 goto unlock;
8952         }
8953
8954         cmd->cmd_complete = clock_info_cmd_complete;
8955
8956         hci_req_init(&req, hdev);
8957
8958         memset(&hci_cp, 0, sizeof(hci_cp));
8959         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8960
8961         if (conn) {
8962                 hci_conn_hold(conn);
8963                 cmd->user_data = hci_conn_get(conn);
8964
8965                 hci_cp.handle = cpu_to_le16(conn->handle);
8966                 hci_cp.which = 0x01; /* Piconet clock */
8967                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8968         }
8969
8970         err = hci_req_run(&req, get_clock_info_complete);
8971         if (err < 0)
8972                 mgmt_pending_remove(cmd);
8973
8974 unlock:
8975         hci_dev_unlock(hdev);
8976         return err;
8977 }
8978
8979 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8980 {
8981         struct hci_conn *conn;
8982
8983         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8984         if (!conn)
8985                 return false;
8986
8987         if (conn->dst_type != type)
8988                 return false;
8989
8990         if (conn->state != BT_CONNECTED)
8991                 return false;
8992
8993         return true;
8994 }
8995
8996 /* This function requires the caller holds hdev->lock */
8997 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
8998                                u8 addr_type, u8 auto_connect)
8999 {
9000         struct hci_conn_params *params;
9001
9002         params = hci_conn_params_add(hdev, addr, addr_type);
9003         if (!params)
9004                 return -EIO;
9005
9006         if (params->auto_connect == auto_connect)
9007                 return 0;
9008
9009         list_del_init(&params->action);
9010
9011         switch (auto_connect) {
9012         case HCI_AUTO_CONN_DISABLED:
9013         case HCI_AUTO_CONN_LINK_LOSS:
9014                 /* If auto connect is being disabled when we're trying to
9015                  * connect to device, keep connecting.
9016                  */
9017                 if (params->explicit_connect)
9018                         list_add(&params->action, &hdev->pend_le_conns);
9019                 break;
9020         case HCI_AUTO_CONN_REPORT:
9021                 if (params->explicit_connect)
9022                         list_add(&params->action, &hdev->pend_le_conns);
9023                 else
9024                         list_add(&params->action, &hdev->pend_le_reports);
9025                 break;
9026         case HCI_AUTO_CONN_DIRECT:
9027         case HCI_AUTO_CONN_ALWAYS:
9028                 if (!is_connected(hdev, addr, addr_type))
9029                         list_add(&params->action, &hdev->pend_le_conns);
9030                 break;
9031         }
9032
9033         params->auto_connect = auto_connect;
9034
9035         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
9036                    addr, addr_type, auto_connect);
9037
9038         return 0;
9039 }
9040
9041 static void device_added(struct sock *sk, struct hci_dev *hdev,
9042                          bdaddr_t *bdaddr, u8 type, u8 action)
9043 {
9044         struct mgmt_ev_device_added ev;
9045
9046         bacpy(&ev.addr.bdaddr, bdaddr);
9047         ev.addr.type = type;
9048         ev.action = action;
9049
9050         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
9051 }
9052
9053 static int add_device(struct sock *sk, struct hci_dev *hdev,
9054                       void *data, u16 len)
9055 {
9056         struct mgmt_cp_add_device *cp = data;
9057         u8 auto_conn, addr_type;
9058         struct hci_conn_params *params;
9059         int err;
9060         u32 current_flags = 0;
9061
9062         bt_dev_dbg(hdev, "sock %p", sk);
9063
9064         if (!bdaddr_type_is_valid(cp->addr.type) ||
9065             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
9066                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9067                                          MGMT_STATUS_INVALID_PARAMS,
9068                                          &cp->addr, sizeof(cp->addr));
9069
9070         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
9071                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9072                                          MGMT_STATUS_INVALID_PARAMS,
9073                                          &cp->addr, sizeof(cp->addr));
9074
9075         hci_dev_lock(hdev);
9076
9077         if (cp->addr.type == BDADDR_BREDR) {
9078                 /* Only incoming connections action is supported for now */
9079                 if (cp->action != 0x01) {
9080                         err = mgmt_cmd_complete(sk, hdev->id,
9081                                                 MGMT_OP_ADD_DEVICE,
9082                                                 MGMT_STATUS_INVALID_PARAMS,
9083                                                 &cp->addr, sizeof(cp->addr));
9084                         goto unlock;
9085                 }
9086
9087                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
9088                                                      &cp->addr.bdaddr,
9089                                                      cp->addr.type, 0);
9090                 if (err)
9091                         goto unlock;
9092
9093                 hci_req_update_scan(hdev);
9094
9095                 goto added;
9096         }
9097
9098         addr_type = le_addr_type(cp->addr.type);
9099
9100         if (cp->action == 0x02)
9101                 auto_conn = HCI_AUTO_CONN_ALWAYS;
9102         else if (cp->action == 0x01)
9103                 auto_conn = HCI_AUTO_CONN_DIRECT;
9104         else
9105                 auto_conn = HCI_AUTO_CONN_REPORT;
9106
9107         /* Kernel internally uses conn_params with resolvable private
9108          * address, but Add Device allows only identity addresses.
9109          * Make sure it is enforced before calling
9110          * hci_conn_params_lookup.
9111          */
9112         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9113                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9114                                         MGMT_STATUS_INVALID_PARAMS,
9115                                         &cp->addr, sizeof(cp->addr));
9116                 goto unlock;
9117         }
9118
9119         /* If the connection parameters don't exist for this device,
9120          * they will be created and configured with defaults.
9121          */
9122         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
9123                                 auto_conn) < 0) {
9124                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9125                                         MGMT_STATUS_FAILED, &cp->addr,
9126                                         sizeof(cp->addr));
9127                 goto unlock;
9128         } else {
9129                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9130                                                 addr_type);
9131                 if (params)
9132                         current_flags = params->current_flags;
9133         }
9134
9135         hci_update_background_scan(hdev);
9136
9137 added:
9138         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
9139         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
9140                              SUPPORTED_DEVICE_FLAGS(), current_flags);
9141
9142         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9143                                 MGMT_STATUS_SUCCESS, &cp->addr,
9144                                 sizeof(cp->addr));
9145
9146 unlock:
9147         hci_dev_unlock(hdev);
9148         return err;
9149 }
9150
9151 static void device_removed(struct sock *sk, struct hci_dev *hdev,
9152                            bdaddr_t *bdaddr, u8 type)
9153 {
9154         struct mgmt_ev_device_removed ev;
9155
9156         bacpy(&ev.addr.bdaddr, bdaddr);
9157         ev.addr.type = type;
9158
9159         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
9160 }
9161
9162 static int remove_device(struct sock *sk, struct hci_dev *hdev,
9163                          void *data, u16 len)
9164 {
9165         struct mgmt_cp_remove_device *cp = data;
9166         int err;
9167
9168         bt_dev_dbg(hdev, "sock %p", sk);
9169
9170         hci_dev_lock(hdev);
9171
9172         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
9173                 struct hci_conn_params *params;
9174                 u8 addr_type;
9175
9176                 if (!bdaddr_type_is_valid(cp->addr.type)) {
9177                         err = mgmt_cmd_complete(sk, hdev->id,
9178                                                 MGMT_OP_REMOVE_DEVICE,
9179                                                 MGMT_STATUS_INVALID_PARAMS,
9180                                                 &cp->addr, sizeof(cp->addr));
9181                         goto unlock;
9182                 }
9183
9184                 if (cp->addr.type == BDADDR_BREDR) {
9185                         err = hci_bdaddr_list_del(&hdev->accept_list,
9186                                                   &cp->addr.bdaddr,
9187                                                   cp->addr.type);
9188                         if (err) {
9189                                 err = mgmt_cmd_complete(sk, hdev->id,
9190                                                         MGMT_OP_REMOVE_DEVICE,
9191                                                         MGMT_STATUS_INVALID_PARAMS,
9192                                                         &cp->addr,
9193                                                         sizeof(cp->addr));
9194                                 goto unlock;
9195                         }
9196
9197                         hci_req_update_scan(hdev);
9198
9199                         device_removed(sk, hdev, &cp->addr.bdaddr,
9200                                        cp->addr.type);
9201                         goto complete;
9202                 }
9203
9204                 addr_type = le_addr_type(cp->addr.type);
9205
9206                 /* Kernel internally uses conn_params with resolvable private
9207                  * address, but Remove Device allows only identity addresses.
9208                  * Make sure it is enforced before calling
9209                  * hci_conn_params_lookup.
9210                  */
9211                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9212                         err = mgmt_cmd_complete(sk, hdev->id,
9213                                                 MGMT_OP_REMOVE_DEVICE,
9214                                                 MGMT_STATUS_INVALID_PARAMS,
9215                                                 &cp->addr, sizeof(cp->addr));
9216                         goto unlock;
9217                 }
9218
9219                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9220                                                 addr_type);
9221                 if (!params) {
9222                         err = mgmt_cmd_complete(sk, hdev->id,
9223                                                 MGMT_OP_REMOVE_DEVICE,
9224                                                 MGMT_STATUS_INVALID_PARAMS,
9225                                                 &cp->addr, sizeof(cp->addr));
9226                         goto unlock;
9227                 }
9228
9229                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
9230                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
9231                         err = mgmt_cmd_complete(sk, hdev->id,
9232                                                 MGMT_OP_REMOVE_DEVICE,
9233                                                 MGMT_STATUS_INVALID_PARAMS,
9234                                                 &cp->addr, sizeof(cp->addr));
9235                         goto unlock;
9236                 }
9237
9238                 list_del(&params->action);
9239                 list_del(&params->list);
9240                 kfree(params);
9241                 hci_update_background_scan(hdev);
9242
9243                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
9244         } else {
9245                 struct hci_conn_params *p, *tmp;
9246                 struct bdaddr_list *b, *btmp;
9247
9248                 if (cp->addr.type) {
9249                         err = mgmt_cmd_complete(sk, hdev->id,
9250                                                 MGMT_OP_REMOVE_DEVICE,
9251                                                 MGMT_STATUS_INVALID_PARAMS,
9252                                                 &cp->addr, sizeof(cp->addr));
9253                         goto unlock;
9254                 }
9255
9256                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
9257                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
9258                         list_del(&b->list);
9259                         kfree(b);
9260                 }
9261
9262                 hci_req_update_scan(hdev);
9263
9264                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
9265                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
9266                                 continue;
9267                         device_removed(sk, hdev, &p->addr, p->addr_type);
9268                         if (p->explicit_connect) {
9269                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
9270                                 continue;
9271                         }
9272                         list_del(&p->action);
9273                         list_del(&p->list);
9274                         kfree(p);
9275                 }
9276
9277                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
9278
9279                 hci_update_background_scan(hdev);
9280         }
9281
9282 complete:
9283         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
9284                                 MGMT_STATUS_SUCCESS, &cp->addr,
9285                                 sizeof(cp->addr));
9286 unlock:
9287         hci_dev_unlock(hdev);
9288         return err;
9289 }
9290
9291 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
9292                            u16 len)
9293 {
9294         struct mgmt_cp_load_conn_param *cp = data;
9295         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
9296                                      sizeof(struct mgmt_conn_param));
9297         u16 param_count, expected_len;
9298         int i;
9299
9300         if (!lmp_le_capable(hdev))
9301                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9302                                        MGMT_STATUS_NOT_SUPPORTED);
9303
9304         param_count = __le16_to_cpu(cp->param_count);
9305         if (param_count > max_param_count) {
9306                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
9307                            param_count);
9308                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9309                                        MGMT_STATUS_INVALID_PARAMS);
9310         }
9311
9312         expected_len = struct_size(cp, params, param_count);
9313         if (expected_len != len) {
9314                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
9315                            expected_len, len);
9316                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9317                                        MGMT_STATUS_INVALID_PARAMS);
9318         }
9319
9320         bt_dev_dbg(hdev, "param_count %u", param_count);
9321
9322         hci_dev_lock(hdev);
9323
9324         hci_conn_params_clear_disabled(hdev);
9325
9326         for (i = 0; i < param_count; i++) {
9327                 struct mgmt_conn_param *param = &cp->params[i];
9328                 struct hci_conn_params *hci_param;
9329                 u16 min, max, latency, timeout;
9330                 u8 addr_type;
9331
9332                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
9333                            param->addr.type);
9334
9335                 if (param->addr.type == BDADDR_LE_PUBLIC) {
9336                         addr_type = ADDR_LE_DEV_PUBLIC;
9337                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
9338                         addr_type = ADDR_LE_DEV_RANDOM;
9339                 } else {
9340                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9341                         continue;
9342                 }
9343
9344                 min = le16_to_cpu(param->min_interval);
9345                 max = le16_to_cpu(param->max_interval);
9346                 latency = le16_to_cpu(param->latency);
9347                 timeout = le16_to_cpu(param->timeout);
9348
9349                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
9350                            min, max, latency, timeout);
9351
9352                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
9353                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9354                         continue;
9355                 }
9356
9357                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
9358                                                 addr_type);
9359                 if (!hci_param) {
9360                         bt_dev_err(hdev, "failed to add connection parameters");
9361                         continue;
9362                 }
9363
9364                 hci_param->conn_min_interval = min;
9365                 hci_param->conn_max_interval = max;
9366                 hci_param->conn_latency = latency;
9367                 hci_param->supervision_timeout = timeout;
9368         }
9369
9370         hci_dev_unlock(hdev);
9371
9372         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
9373                                  NULL, 0);
9374 }
9375
9376 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
9377                                void *data, u16 len)
9378 {
9379         struct mgmt_cp_set_external_config *cp = data;
9380         bool changed;
9381         int err;
9382
9383         bt_dev_dbg(hdev, "sock %p", sk);
9384
9385         if (hdev_is_powered(hdev))
9386                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9387                                        MGMT_STATUS_REJECTED);
9388
9389         if (cp->config != 0x00 && cp->config != 0x01)
9390                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9391                                          MGMT_STATUS_INVALID_PARAMS);
9392
9393         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
9394                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9395                                        MGMT_STATUS_NOT_SUPPORTED);
9396
9397         hci_dev_lock(hdev);
9398
9399         if (cp->config)
9400                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
9401         else
9402                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
9403
9404         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
9405         if (err < 0)
9406                 goto unlock;
9407
9408         if (!changed)
9409                 goto unlock;
9410
9411         err = new_options(hdev, sk);
9412
9413         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
9414                 mgmt_index_removed(hdev);
9415
9416                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
9417                         hci_dev_set_flag(hdev, HCI_CONFIG);
9418                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9419
9420                         queue_work(hdev->req_workqueue, &hdev->power_on);
9421                 } else {
9422                         set_bit(HCI_RAW, &hdev->flags);
9423                         mgmt_index_added(hdev);
9424                 }
9425         }
9426
9427 unlock:
9428         hci_dev_unlock(hdev);
9429         return err;
9430 }
9431
9432 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
9433                               void *data, u16 len)
9434 {
9435         struct mgmt_cp_set_public_address *cp = data;
9436         bool changed;
9437         int err;
9438
9439         bt_dev_dbg(hdev, "sock %p", sk);
9440
9441         if (hdev_is_powered(hdev))
9442                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9443                                        MGMT_STATUS_REJECTED);
9444
9445         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
9446                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9447                                        MGMT_STATUS_INVALID_PARAMS);
9448
9449         if (!hdev->set_bdaddr)
9450                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9451                                        MGMT_STATUS_NOT_SUPPORTED);
9452
9453         hci_dev_lock(hdev);
9454
9455         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
9456         bacpy(&hdev->public_addr, &cp->bdaddr);
9457
9458         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
9459         if (err < 0)
9460                 goto unlock;
9461
9462         if (!changed)
9463                 goto unlock;
9464
9465         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9466                 err = new_options(hdev, sk);
9467
9468         if (is_configured(hdev)) {
9469                 mgmt_index_removed(hdev);
9470
9471                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9472
9473                 hci_dev_set_flag(hdev, HCI_CONFIG);
9474                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9475
9476                 queue_work(hdev->req_workqueue, &hdev->power_on);
9477         }
9478
9479 unlock:
9480         hci_dev_unlock(hdev);
9481         return err;
9482 }
9483
9484 #ifdef TIZEN_BT
9485 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
9486                             u8 name_len)
9487 {
9488         char buf[512];
9489         struct mgmt_ev_device_name_update *ev = (void *)buf;
9490         u16 eir_len = 0;
9491
9492         if (name_len <= 0)
9493                 return -EINVAL;
9494
9495         bacpy(&ev->addr.bdaddr, bdaddr);
9496         ev->addr.type = BDADDR_BREDR;
9497
9498         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9499                                   name_len);
9500
9501         ev->eir_len = cpu_to_le16(eir_len);
9502
9503         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
9504                           sizeof(*ev) + eir_len, NULL);
9505 }
9506
9507 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9508                                u8 link_type, u8 addr_type, u8 status)
9509 {
9510         struct mgmt_ev_conn_update_failed ev;
9511
9512         bacpy(&ev.addr.bdaddr, bdaddr);
9513         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9514         ev.status = status;
9515
9516         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
9517                                 &ev, sizeof(ev), NULL);
9518 }
9519
9520 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
9521                          u8 link_type, u8 addr_type, u16 conn_interval,
9522                          u16 conn_latency, u16 supervision_timeout)
9523 {
9524         struct mgmt_ev_conn_updated ev;
9525
9526         bacpy(&ev.addr.bdaddr, bdaddr);
9527         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9528         ev.conn_interval = cpu_to_le16(conn_interval);
9529         ev.conn_latency = cpu_to_le16(conn_latency);
9530         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
9531
9532         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
9533                                 &ev, sizeof(ev), NULL);
9534 }
9535
9536 /* le device found event - Pass adv type */
9537 void mgmt_le_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9538                 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, u8 *eir,
9539                 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, u8 adv_type)
9540 {
9541         char buf[512];
9542         struct mgmt_ev_le_device_found *ev = (void *)buf;
9543         size_t ev_size;
9544
9545         if (!hci_discovery_active(hdev) && !hci_le_discovery_active(hdev))
9546                 return;
9547
9548         /* Make sure that the buffer is big enough. The 5 extra bytes
9549          * are for the potential CoD field.
9550          */
9551         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9552                 return;
9553
9554         memset(buf, 0, sizeof(buf));
9555
9556         bacpy(&ev->addr.bdaddr, bdaddr);
9557         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9558         ev->rssi = rssi;
9559         ev->flags = cpu_to_le32(flags);
9560         ev->adv_type = adv_type;
9561
9562         if (eir_len > 0)
9563                 memcpy(ev->eir, eir, eir_len);
9564
9565         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, NULL))
9566                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9567                                           dev_class, 3);
9568
9569         if (scan_rsp_len > 0)
9570                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9571
9572         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9573         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9574
9575         mgmt_event(MGMT_EV_LE_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9576 }
9577 #endif
9578
9579 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
9580                                              u16 opcode, struct sk_buff *skb)
9581 {
9582         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
9583         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
9584         u8 *h192, *r192, *h256, *r256;
9585         struct mgmt_pending_cmd *cmd;
9586         u16 eir_len;
9587         int err;
9588
9589         bt_dev_dbg(hdev, "status %u", status);
9590
9591         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
9592         if (!cmd)
9593                 return;
9594
9595         mgmt_cp = cmd->param;
9596
9597         if (status) {
9598                 status = mgmt_status(status);
9599                 eir_len = 0;
9600
9601                 h192 = NULL;
9602                 r192 = NULL;
9603                 h256 = NULL;
9604                 r256 = NULL;
9605         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
9606                 struct hci_rp_read_local_oob_data *rp;
9607
9608                 if (skb->len != sizeof(*rp)) {
9609                         status = MGMT_STATUS_FAILED;
9610                         eir_len = 0;
9611                 } else {
9612                         status = MGMT_STATUS_SUCCESS;
9613                         rp = (void *)skb->data;
9614
9615                         eir_len = 5 + 18 + 18;
9616                         h192 = rp->hash;
9617                         r192 = rp->rand;
9618                         h256 = NULL;
9619                         r256 = NULL;
9620                 }
9621         } else {
9622                 struct hci_rp_read_local_oob_ext_data *rp;
9623
9624                 if (skb->len != sizeof(*rp)) {
9625                         status = MGMT_STATUS_FAILED;
9626                         eir_len = 0;
9627                 } else {
9628                         status = MGMT_STATUS_SUCCESS;
9629                         rp = (void *)skb->data;
9630
9631                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
9632                                 eir_len = 5 + 18 + 18;
9633                                 h192 = NULL;
9634                                 r192 = NULL;
9635                         } else {
9636                                 eir_len = 5 + 18 + 18 + 18 + 18;
9637                                 h192 = rp->hash192;
9638                                 r192 = rp->rand192;
9639                         }
9640
9641                         h256 = rp->hash256;
9642                         r256 = rp->rand256;
9643                 }
9644         }
9645
9646         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
9647         if (!mgmt_rp)
9648                 goto done;
9649
9650         if (eir_len == 0)
9651                 goto send_rsp;
9652
9653         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
9654                                   hdev->dev_class, 3);
9655
9656         if (h192 && r192) {
9657                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9658                                           EIR_SSP_HASH_C192, h192, 16);
9659                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9660                                           EIR_SSP_RAND_R192, r192, 16);
9661         }
9662
9663         if (h256 && r256) {
9664                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9665                                           EIR_SSP_HASH_C256, h256, 16);
9666                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9667                                           EIR_SSP_RAND_R256, r256, 16);
9668         }
9669
9670 send_rsp:
9671         mgmt_rp->type = mgmt_cp->type;
9672         mgmt_rp->eir_len = cpu_to_le16(eir_len);
9673
9674         err = mgmt_cmd_complete(cmd->sk, hdev->id,
9675                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
9676                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
9677         if (err < 0 || status)
9678                 goto done;
9679
9680         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
9681
9682         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9683                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
9684                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
9685 done:
9686         kfree(mgmt_rp);
9687         mgmt_pending_remove(cmd);
9688 }
9689
9690 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
9691                                   struct mgmt_cp_read_local_oob_ext_data *cp)
9692 {
9693         struct mgmt_pending_cmd *cmd;
9694         struct hci_request req;
9695         int err;
9696
9697         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
9698                                cp, sizeof(*cp));
9699         if (!cmd)
9700                 return -ENOMEM;
9701
9702         hci_req_init(&req, hdev);
9703
9704         if (bredr_sc_enabled(hdev))
9705                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
9706         else
9707                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
9708
9709         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
9710         if (err < 0) {
9711                 mgmt_pending_remove(cmd);
9712                 return err;
9713         }
9714
9715         return 0;
9716 }
9717
9718 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
9719                                    void *data, u16 data_len)
9720 {
9721         struct mgmt_cp_read_local_oob_ext_data *cp = data;
9722         struct mgmt_rp_read_local_oob_ext_data *rp;
9723         size_t rp_len;
9724         u16 eir_len;
9725         u8 status, flags, role, addr[7], hash[16], rand[16];
9726         int err;
9727
9728         bt_dev_dbg(hdev, "sock %p", sk);
9729
9730         if (hdev_is_powered(hdev)) {
9731                 switch (cp->type) {
9732                 case BIT(BDADDR_BREDR):
9733                         status = mgmt_bredr_support(hdev);
9734                         if (status)
9735                                 eir_len = 0;
9736                         else
9737                                 eir_len = 5;
9738                         break;
9739                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9740                         status = mgmt_le_support(hdev);
9741                         if (status)
9742                                 eir_len = 0;
9743                         else
9744                                 eir_len = 9 + 3 + 18 + 18 + 3;
9745                         break;
9746                 default:
9747                         status = MGMT_STATUS_INVALID_PARAMS;
9748                         eir_len = 0;
9749                         break;
9750                 }
9751         } else {
9752                 status = MGMT_STATUS_NOT_POWERED;
9753                 eir_len = 0;
9754         }
9755
9756         rp_len = sizeof(*rp) + eir_len;
9757         rp = kmalloc(rp_len, GFP_ATOMIC);
9758         if (!rp)
9759                 return -ENOMEM;
9760
9761         if (status)
9762                 goto complete;
9763
9764         hci_dev_lock(hdev);
9765
9766         eir_len = 0;
9767         switch (cp->type) {
9768         case BIT(BDADDR_BREDR):
9769                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9770                         err = read_local_ssp_oob_req(hdev, sk, cp);
9771                         hci_dev_unlock(hdev);
9772                         if (!err)
9773                                 goto done;
9774
9775                         status = MGMT_STATUS_FAILED;
9776                         goto complete;
9777                 } else {
9778                         eir_len = eir_append_data(rp->eir, eir_len,
9779                                                   EIR_CLASS_OF_DEV,
9780                                                   hdev->dev_class, 3);
9781                 }
9782                 break;
9783         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9784                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
9785                     smp_generate_oob(hdev, hash, rand) < 0) {
9786                         hci_dev_unlock(hdev);
9787                         status = MGMT_STATUS_FAILED;
9788                         goto complete;
9789                 }
9790
9791                 /* This should return the active RPA, but since the RPA
9792                  * is only programmed on demand, it is really hard to fill
9793                  * this in at the moment. For now disallow retrieving
9794                  * local out-of-band data when privacy is in use.
9795                  *
9796                  * Returning the identity address will not help here since
9797                  * pairing happens before the identity resolving key is
9798                  * known and thus the connection establishment happens
9799                  * based on the RPA and not the identity address.
9800                  */
9801                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
9802                         hci_dev_unlock(hdev);
9803                         status = MGMT_STATUS_REJECTED;
9804                         goto complete;
9805                 }
9806
9807                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
9808                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
9809                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
9810                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
9811                         memcpy(addr, &hdev->static_addr, 6);
9812                         addr[6] = 0x01;
9813                 } else {
9814                         memcpy(addr, &hdev->bdaddr, 6);
9815                         addr[6] = 0x00;
9816                 }
9817
9818                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
9819                                           addr, sizeof(addr));
9820
9821                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
9822                         role = 0x02;
9823                 else
9824                         role = 0x01;
9825
9826                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
9827                                           &role, sizeof(role));
9828
9829                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
9830                         eir_len = eir_append_data(rp->eir, eir_len,
9831                                                   EIR_LE_SC_CONFIRM,
9832                                                   hash, sizeof(hash));
9833
9834                         eir_len = eir_append_data(rp->eir, eir_len,
9835                                                   EIR_LE_SC_RANDOM,
9836                                                   rand, sizeof(rand));
9837                 }
9838
9839                 flags = mgmt_get_adv_discov_flags(hdev);
9840
9841                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9842                         flags |= LE_AD_NO_BREDR;
9843
9844                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
9845                                           &flags, sizeof(flags));
9846                 break;
9847         }
9848
9849         hci_dev_unlock(hdev);
9850
9851         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
9852
9853         status = MGMT_STATUS_SUCCESS;
9854
9855 complete:
9856         rp->type = cp->type;
9857         rp->eir_len = cpu_to_le16(eir_len);
9858
9859         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
9860                                 status, rp, sizeof(*rp) + eir_len);
9861         if (err < 0 || status)
9862                 goto done;
9863
9864         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9865                                  rp, sizeof(*rp) + eir_len,
9866                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
9867
9868 done:
9869         kfree(rp);
9870
9871         return err;
9872 }
9873
9874 static u32 get_supported_adv_flags(struct hci_dev *hdev)
9875 {
9876         u32 flags = 0;
9877
9878         flags |= MGMT_ADV_FLAG_CONNECTABLE;
9879         flags |= MGMT_ADV_FLAG_DISCOV;
9880         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
9881         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
9882         flags |= MGMT_ADV_FLAG_APPEARANCE;
9883         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
9884         flags |= MGMT_ADV_PARAM_DURATION;
9885         flags |= MGMT_ADV_PARAM_TIMEOUT;
9886         flags |= MGMT_ADV_PARAM_INTERVALS;
9887         flags |= MGMT_ADV_PARAM_TX_POWER;
9888         flags |= MGMT_ADV_PARAM_SCAN_RSP;
9889
9890         /* In extended adv TX_POWER returned from Set Adv Param
9891          * will be always valid.
9892          */
9893         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
9894             ext_adv_capable(hdev))
9895                 flags |= MGMT_ADV_FLAG_TX_POWER;
9896
9897         if (ext_adv_capable(hdev)) {
9898                 flags |= MGMT_ADV_FLAG_SEC_1M;
9899                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
9900                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
9901
9902                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
9903                         flags |= MGMT_ADV_FLAG_SEC_2M;
9904
9905                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
9906                         flags |= MGMT_ADV_FLAG_SEC_CODED;
9907         }
9908
9909         return flags;
9910 }
9911
9912 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
9913                              void *data, u16 data_len)
9914 {
9915         struct mgmt_rp_read_adv_features *rp;
9916         size_t rp_len;
9917         int err;
9918         struct adv_info *adv_instance;
9919         u32 supported_flags;
9920         u8 *instance;
9921
9922         bt_dev_dbg(hdev, "sock %p", sk);
9923
9924         if (!lmp_le_capable(hdev))
9925                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9926                                        MGMT_STATUS_REJECTED);
9927
9928         /* Enabling the experimental LL Privay support disables support for
9929          * advertising.
9930          */
9931         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9932                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9933                                        MGMT_STATUS_NOT_SUPPORTED);
9934
9935         hci_dev_lock(hdev);
9936
9937         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
9938         rp = kmalloc(rp_len, GFP_ATOMIC);
9939         if (!rp) {
9940                 hci_dev_unlock(hdev);
9941                 return -ENOMEM;
9942         }
9943
9944         supported_flags = get_supported_adv_flags(hdev);
9945
9946         rp->supported_flags = cpu_to_le32(supported_flags);
9947         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
9948         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
9949         rp->max_instances = hdev->le_num_of_adv_sets;
9950         rp->num_instances = hdev->adv_instance_cnt;
9951
9952         instance = rp->instance;
9953         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9954                 *instance = adv_instance->instance;
9955                 instance++;
9956         }
9957
9958         hci_dev_unlock(hdev);
9959
9960         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9961                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9962
9963         kfree(rp);
9964
9965         return err;
9966 }
9967
9968 static u8 calculate_name_len(struct hci_dev *hdev)
9969 {
9970         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9971
9972         return append_local_name(hdev, buf, 0);
9973 }
9974
9975 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9976                            bool is_adv_data)
9977 {
9978         u8 max_len = HCI_MAX_AD_LENGTH;
9979
9980         if (is_adv_data) {
9981                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9982                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9983                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9984                         max_len -= 3;
9985
9986                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9987                         max_len -= 3;
9988         } else {
9989                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9990                         max_len -= calculate_name_len(hdev);
9991
9992                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9993                         max_len -= 4;
9994         }
9995
9996         return max_len;
9997 }
9998
9999 static bool flags_managed(u32 adv_flags)
10000 {
10001         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
10002                             MGMT_ADV_FLAG_LIMITED_DISCOV |
10003                             MGMT_ADV_FLAG_MANAGED_FLAGS);
10004 }
10005
10006 static bool tx_power_managed(u32 adv_flags)
10007 {
10008         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
10009 }
10010
10011 static bool name_managed(u32 adv_flags)
10012 {
10013         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
10014 }
10015
10016 static bool appearance_managed(u32 adv_flags)
10017 {
10018         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
10019 }
10020
10021 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
10022                               u8 len, bool is_adv_data)
10023 {
10024         int i, cur_len;
10025         u8 max_len;
10026
10027         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
10028
10029         if (len > max_len)
10030                 return false;
10031
10032         /* Make sure that the data is correctly formatted. */
10033         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
10034                 cur_len = data[i];
10035
10036                 if (!cur_len)
10037                         continue;
10038
10039                 if (data[i + 1] == EIR_FLAGS &&
10040                     (!is_adv_data || flags_managed(adv_flags)))
10041                         return false;
10042
10043                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
10044                         return false;
10045
10046                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
10047                         return false;
10048
10049                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
10050                         return false;
10051
10052                 if (data[i + 1] == EIR_APPEARANCE &&
10053                     appearance_managed(adv_flags))
10054                         return false;
10055
10056                 /* If the current field length would exceed the total data
10057                  * length, then it's invalid.
10058                  */
10059                 if (i + cur_len >= len)
10060                         return false;
10061         }
10062
10063         return true;
10064 }
10065
10066 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
10067 {
10068         u32 supported_flags, phy_flags;
10069
10070         /* The current implementation only supports a subset of the specified
10071          * flags. Also need to check mutual exclusiveness of sec flags.
10072          */
10073         supported_flags = get_supported_adv_flags(hdev);
10074         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
10075         if (adv_flags & ~supported_flags ||
10076             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
10077                 return false;
10078
10079         return true;
10080 }
10081
10082 static bool adv_busy(struct hci_dev *hdev)
10083 {
10084         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
10085                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
10086                 pending_find(MGMT_OP_SET_LE, hdev) ||
10087                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
10088                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
10089 }
10090
10091 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
10092                                      u16 opcode)
10093 {
10094         struct mgmt_pending_cmd *cmd;
10095         struct mgmt_cp_add_advertising *cp;
10096         struct mgmt_rp_add_advertising rp;
10097         struct adv_info *adv_instance, *n;
10098         u8 instance;
10099
10100         bt_dev_dbg(hdev, "status %u", status);
10101
10102         hci_dev_lock(hdev);
10103
10104         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
10105         if (!cmd)
10106                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
10107
10108         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
10109                 if (!adv_instance->pending)
10110                         continue;
10111
10112                 if (!status) {
10113                         adv_instance->pending = false;
10114                         continue;
10115                 }
10116
10117                 instance = adv_instance->instance;
10118
10119                 if (hdev->cur_adv_instance == instance)
10120                         cancel_adv_timeout(hdev);
10121
10122                 hci_remove_adv_instance(hdev, instance);
10123                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
10124         }
10125
10126         if (!cmd)
10127                 goto unlock;
10128
10129         cp = cmd->param;
10130         rp.instance = cp->instance;
10131
10132         if (status)
10133                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10134                                 mgmt_status(status));
10135         else
10136                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10137                                   mgmt_status(status), &rp, sizeof(rp));
10138
10139         mgmt_pending_remove(cmd);
10140
10141 unlock:
10142         hci_dev_unlock(hdev);
10143 }
10144
10145 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
10146                            void *data, u16 data_len)
10147 {
10148         struct mgmt_cp_add_advertising *cp = data;
10149         struct mgmt_rp_add_advertising rp;
10150         u32 flags;
10151         u8 status;
10152         u16 timeout, duration;
10153         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
10154         u8 schedule_instance = 0;
10155         struct adv_info *next_instance;
10156         int err;
10157         struct mgmt_pending_cmd *cmd;
10158         struct hci_request req;
10159
10160         bt_dev_dbg(hdev, "sock %p", sk);
10161
10162         status = mgmt_le_support(hdev);
10163         if (status)
10164                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10165                                        status);
10166
10167         /* Enabling the experimental LL Privay support disables support for
10168          * advertising.
10169          */
10170         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
10171                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10172                                        MGMT_STATUS_NOT_SUPPORTED);
10173
10174         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10175                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10176                                        MGMT_STATUS_INVALID_PARAMS);
10177
10178         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
10179                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10180                                        MGMT_STATUS_INVALID_PARAMS);
10181
10182         flags = __le32_to_cpu(cp->flags);
10183         timeout = __le16_to_cpu(cp->timeout);
10184         duration = __le16_to_cpu(cp->duration);
10185
10186         if (!requested_adv_flags_are_valid(hdev, flags))
10187                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10188                                        MGMT_STATUS_INVALID_PARAMS);
10189
10190         hci_dev_lock(hdev);
10191
10192         if (timeout && !hdev_is_powered(hdev)) {
10193                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10194                                       MGMT_STATUS_REJECTED);
10195                 goto unlock;
10196         }
10197
10198         if (adv_busy(hdev)) {
10199                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10200                                       MGMT_STATUS_BUSY);
10201                 goto unlock;
10202         }
10203
10204         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
10205             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
10206                                cp->scan_rsp_len, false)) {
10207                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10208                                       MGMT_STATUS_INVALID_PARAMS);
10209                 goto unlock;
10210         }
10211
10212         err = hci_add_adv_instance(hdev, cp->instance, flags,
10213                                    cp->adv_data_len, cp->data,
10214                                    cp->scan_rsp_len,
10215                                    cp->data + cp->adv_data_len,
10216                                    timeout, duration,
10217                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
10218                                    hdev->le_adv_min_interval,
10219                                    hdev->le_adv_max_interval);
10220         if (err < 0) {
10221                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10222                                       MGMT_STATUS_FAILED);
10223                 goto unlock;
10224         }
10225
10226         /* Only trigger an advertising added event if a new instance was
10227          * actually added.
10228          */
10229         if (hdev->adv_instance_cnt > prev_instance_cnt)
10230                 mgmt_advertising_added(sk, hdev, cp->instance);
10231
10232         if (hdev->cur_adv_instance == cp->instance) {
10233                 /* If the currently advertised instance is being changed then
10234                  * cancel the current advertising and schedule the next
10235                  * instance. If there is only one instance then the overridden
10236                  * advertising data will be visible right away.
10237                  */
10238                 cancel_adv_timeout(hdev);
10239
10240                 next_instance = hci_get_next_instance(hdev, cp->instance);
10241                 if (next_instance)
10242                         schedule_instance = next_instance->instance;
10243         } else if (!hdev->adv_instance_timeout) {
10244                 /* Immediately advertise the new instance if no other
10245                  * instance is currently being advertised.
10246                  */
10247                 schedule_instance = cp->instance;
10248         }
10249
10250         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
10251          * there is no instance to be advertised then we have no HCI
10252          * communication to make. Simply return.
10253          */
10254         if (!hdev_is_powered(hdev) ||
10255             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
10256             !schedule_instance) {
10257                 rp.instance = cp->instance;
10258                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10259                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10260                 goto unlock;
10261         }
10262
10263         /* We're good to go, update advertising data, parameters, and start
10264          * advertising.
10265          */
10266         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
10267                                data_len);
10268         if (!cmd) {
10269                 err = -ENOMEM;
10270                 goto unlock;
10271         }
10272
10273         hci_req_init(&req, hdev);
10274
10275         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
10276
10277         if (!err)
10278                 err = hci_req_run(&req, add_advertising_complete);
10279
10280         if (err < 0) {
10281                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10282                                       MGMT_STATUS_FAILED);
10283                 mgmt_pending_remove(cmd);
10284         }
10285
10286 unlock:
10287         hci_dev_unlock(hdev);
10288
10289         return err;
10290 }
10291
10292 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
10293                                         u16 opcode)
10294 {
10295         struct mgmt_pending_cmd *cmd;
10296         struct mgmt_cp_add_ext_adv_params *cp;
10297         struct mgmt_rp_add_ext_adv_params rp;
10298         struct adv_info *adv_instance;
10299         u32 flags;
10300
10301         BT_DBG("%s", hdev->name);
10302
10303         hci_dev_lock(hdev);
10304
10305         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
10306         if (!cmd)
10307                 goto unlock;
10308
10309         cp = cmd->param;
10310         adv_instance = hci_find_adv_instance(hdev, cp->instance);
10311         if (!adv_instance)
10312                 goto unlock;
10313
10314         rp.instance = cp->instance;
10315         rp.tx_power = adv_instance->tx_power;
10316
10317         /* While we're at it, inform userspace of the available space for this
10318          * advertisement, given the flags that will be used.
10319          */
10320         flags = __le32_to_cpu(cp->flags);
10321         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10322         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10323
10324         if (status) {
10325                 /* If this advertisement was previously advertising and we
10326                  * failed to update it, we signal that it has been removed and
10327                  * delete its structure
10328                  */
10329                 if (!adv_instance->pending)
10330                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
10331
10332                 hci_remove_adv_instance(hdev, cp->instance);
10333
10334                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10335                                 mgmt_status(status));
10336
10337         } else {
10338                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10339                                   mgmt_status(status), &rp, sizeof(rp));
10340         }
10341
10342 unlock:
10343         if (cmd)
10344                 mgmt_pending_remove(cmd);
10345
10346         hci_dev_unlock(hdev);
10347 }
10348
10349 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
10350                               void *data, u16 data_len)
10351 {
10352         struct mgmt_cp_add_ext_adv_params *cp = data;
10353         struct mgmt_rp_add_ext_adv_params rp;
10354         struct mgmt_pending_cmd *cmd = NULL;
10355         struct adv_info *adv_instance;
10356         struct hci_request req;
10357         u32 flags, min_interval, max_interval;
10358         u16 timeout, duration;
10359         u8 status;
10360         s8 tx_power;
10361         int err;
10362
10363         BT_DBG("%s", hdev->name);
10364
10365         status = mgmt_le_support(hdev);
10366         if (status)
10367                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10368                                        status);
10369
10370         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10371                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10372                                        MGMT_STATUS_INVALID_PARAMS);
10373
10374         /* The purpose of breaking add_advertising into two separate MGMT calls
10375          * for params and data is to allow more parameters to be added to this
10376          * structure in the future. For this reason, we verify that we have the
10377          * bare minimum structure we know of when the interface was defined. Any
10378          * extra parameters we don't know about will be ignored in this request.
10379          */
10380         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
10381                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10382                                        MGMT_STATUS_INVALID_PARAMS);
10383
10384         flags = __le32_to_cpu(cp->flags);
10385
10386         if (!requested_adv_flags_are_valid(hdev, flags))
10387                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10388                                        MGMT_STATUS_INVALID_PARAMS);
10389
10390         hci_dev_lock(hdev);
10391
10392         /* In new interface, we require that we are powered to register */
10393         if (!hdev_is_powered(hdev)) {
10394                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10395                                       MGMT_STATUS_REJECTED);
10396                 goto unlock;
10397         }
10398
10399         if (adv_busy(hdev)) {
10400                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10401                                       MGMT_STATUS_BUSY);
10402                 goto unlock;
10403         }
10404
10405         /* Parse defined parameters from request, use defaults otherwise */
10406         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
10407                   __le16_to_cpu(cp->timeout) : 0;
10408
10409         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
10410                    __le16_to_cpu(cp->duration) :
10411                    hdev->def_multi_adv_rotation_duration;
10412
10413         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10414                        __le32_to_cpu(cp->min_interval) :
10415                        hdev->le_adv_min_interval;
10416
10417         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10418                        __le32_to_cpu(cp->max_interval) :
10419                        hdev->le_adv_max_interval;
10420
10421         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
10422                    cp->tx_power :
10423                    HCI_ADV_TX_POWER_NO_PREFERENCE;
10424
10425         /* Create advertising instance with no advertising or response data */
10426         err = hci_add_adv_instance(hdev, cp->instance, flags,
10427                                    0, NULL, 0, NULL, timeout, duration,
10428                                    tx_power, min_interval, max_interval);
10429
10430         if (err < 0) {
10431                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10432                                       MGMT_STATUS_FAILED);
10433                 goto unlock;
10434         }
10435
10436         /* Submit request for advertising params if ext adv available */
10437         if (ext_adv_capable(hdev)) {
10438                 hci_req_init(&req, hdev);
10439                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
10440
10441                 /* Updating parameters of an active instance will return a
10442                  * Command Disallowed error, so we must first disable the
10443                  * instance if it is active.
10444                  */
10445                 if (!adv_instance->pending)
10446                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
10447
10448                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
10449
10450                 err = hci_req_run(&req, add_ext_adv_params_complete);
10451
10452                 if (!err)
10453                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
10454                                                hdev, data, data_len);
10455                 if (!cmd) {
10456                         err = -ENOMEM;
10457                         hci_remove_adv_instance(hdev, cp->instance);
10458                         goto unlock;
10459                 }
10460
10461         } else {
10462                 rp.instance = cp->instance;
10463                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
10464                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10465                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10466                 err = mgmt_cmd_complete(sk, hdev->id,
10467                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
10468                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10469         }
10470
10471 unlock:
10472         hci_dev_unlock(hdev);
10473
10474         return err;
10475 }
10476
10477 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
10478                             u16 data_len)
10479 {
10480         struct mgmt_cp_add_ext_adv_data *cp = data;
10481         struct mgmt_rp_add_ext_adv_data rp;
10482         u8 schedule_instance = 0;
10483         struct adv_info *next_instance;
10484         struct adv_info *adv_instance;
10485         int err = 0;
10486         struct mgmt_pending_cmd *cmd;
10487         struct hci_request req;
10488
10489         BT_DBG("%s", hdev->name);
10490
10491         hci_dev_lock(hdev);
10492
10493         adv_instance = hci_find_adv_instance(hdev, cp->instance);
10494
10495         if (!adv_instance) {
10496                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10497                                       MGMT_STATUS_INVALID_PARAMS);
10498                 goto unlock;
10499         }
10500
10501         /* In new interface, we require that we are powered to register */
10502         if (!hdev_is_powered(hdev)) {
10503                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10504                                       MGMT_STATUS_REJECTED);
10505                 goto clear_new_instance;
10506         }
10507
10508         if (adv_busy(hdev)) {
10509                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10510                                       MGMT_STATUS_BUSY);
10511                 goto clear_new_instance;
10512         }
10513
10514         /* Validate new data */
10515         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
10516                                cp->adv_data_len, true) ||
10517             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
10518                                cp->adv_data_len, cp->scan_rsp_len, false)) {
10519                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10520                                       MGMT_STATUS_INVALID_PARAMS);
10521                 goto clear_new_instance;
10522         }
10523
10524         /* Set the data in the advertising instance */
10525         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
10526                                   cp->data, cp->scan_rsp_len,
10527                                   cp->data + cp->adv_data_len);
10528
10529         /* We're good to go, update advertising data, parameters, and start
10530          * advertising.
10531          */
10532
10533         hci_req_init(&req, hdev);
10534
10535         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
10536
10537         if (ext_adv_capable(hdev)) {
10538                 __hci_req_update_adv_data(&req, cp->instance);
10539                 __hci_req_update_scan_rsp_data(&req, cp->instance);
10540                 __hci_req_enable_ext_advertising(&req, cp->instance);
10541
10542         } else {
10543                 /* If using software rotation, determine next instance to use */
10544
10545                 if (hdev->cur_adv_instance == cp->instance) {
10546                         /* If the currently advertised instance is being changed
10547                          * then cancel the current advertising and schedule the
10548                          * next instance. If there is only one instance then the
10549                          * overridden advertising data will be visible right
10550                          * away
10551                          */
10552                         cancel_adv_timeout(hdev);
10553
10554                         next_instance = hci_get_next_instance(hdev,
10555                                                               cp->instance);
10556                         if (next_instance)
10557                                 schedule_instance = next_instance->instance;
10558                 } else if (!hdev->adv_instance_timeout) {
10559                         /* Immediately advertise the new instance if no other
10560                          * instance is currently being advertised.
10561                          */
10562                         schedule_instance = cp->instance;
10563                 }
10564
10565                 /* If the HCI_ADVERTISING flag is set or there is no instance to
10566                  * be advertised then we have no HCI communication to make.
10567                  * Simply return.
10568                  */
10569                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
10570                     !schedule_instance) {
10571                         if (adv_instance->pending) {
10572                                 mgmt_advertising_added(sk, hdev, cp->instance);
10573                                 adv_instance->pending = false;
10574                         }
10575                         rp.instance = cp->instance;
10576                         err = mgmt_cmd_complete(sk, hdev->id,
10577                                                 MGMT_OP_ADD_EXT_ADV_DATA,
10578                                                 MGMT_STATUS_SUCCESS, &rp,
10579                                                 sizeof(rp));
10580                         goto unlock;
10581                 }
10582
10583                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
10584                                                       true);
10585         }
10586
10587         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
10588                                data_len);
10589         if (!cmd) {
10590                 err = -ENOMEM;
10591                 goto clear_new_instance;
10592         }
10593
10594         if (!err)
10595                 err = hci_req_run(&req, add_advertising_complete);
10596
10597         if (err < 0) {
10598                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10599                                       MGMT_STATUS_FAILED);
10600                 mgmt_pending_remove(cmd);
10601                 goto clear_new_instance;
10602         }
10603
10604         /* We were successful in updating data, so trigger advertising_added
10605          * event if this is an instance that wasn't previously advertising. If
10606          * a failure occurs in the requests we initiated, we will remove the
10607          * instance again in add_advertising_complete
10608          */
10609         if (adv_instance->pending)
10610                 mgmt_advertising_added(sk, hdev, cp->instance);
10611
10612         goto unlock;
10613
10614 clear_new_instance:
10615         hci_remove_adv_instance(hdev, cp->instance);
10616
10617 unlock:
10618         hci_dev_unlock(hdev);
10619
10620         return err;
10621 }
10622
10623 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
10624                                         u16 opcode)
10625 {
10626         struct mgmt_pending_cmd *cmd;
10627         struct mgmt_cp_remove_advertising *cp;
10628         struct mgmt_rp_remove_advertising rp;
10629
10630         bt_dev_dbg(hdev, "status %u", status);
10631
10632         hci_dev_lock(hdev);
10633
10634         /* A failure status here only means that we failed to disable
10635          * advertising. Otherwise, the advertising instance has been removed,
10636          * so report success.
10637          */
10638         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
10639         if (!cmd)
10640                 goto unlock;
10641
10642         cp = cmd->param;
10643         rp.instance = cp->instance;
10644
10645         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
10646                           &rp, sizeof(rp));
10647         mgmt_pending_remove(cmd);
10648
10649 unlock:
10650         hci_dev_unlock(hdev);
10651 }
10652
10653 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
10654                               void *data, u16 data_len)
10655 {
10656         struct mgmt_cp_remove_advertising *cp = data;
10657         struct mgmt_rp_remove_advertising rp;
10658         struct mgmt_pending_cmd *cmd;
10659         struct hci_request req;
10660         int err;
10661
10662         bt_dev_dbg(hdev, "sock %p", sk);
10663
10664         /* Enabling the experimental LL Privay support disables support for
10665          * advertising.
10666          */
10667         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
10668                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
10669                                        MGMT_STATUS_NOT_SUPPORTED);
10670
10671         hci_dev_lock(hdev);
10672
10673         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
10674                 err = mgmt_cmd_status(sk, hdev->id,
10675                                       MGMT_OP_REMOVE_ADVERTISING,
10676                                       MGMT_STATUS_INVALID_PARAMS);
10677                 goto unlock;
10678         }
10679
10680         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
10681             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
10682             pending_find(MGMT_OP_SET_LE, hdev)) {
10683                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10684                                       MGMT_STATUS_BUSY);
10685                 goto unlock;
10686         }
10687
10688         if (list_empty(&hdev->adv_instances)) {
10689                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10690                                       MGMT_STATUS_INVALID_PARAMS);
10691                 goto unlock;
10692         }
10693
10694         hci_req_init(&req, hdev);
10695
10696         /* If we use extended advertising, instance is disabled and removed */
10697         if (ext_adv_capable(hdev)) {
10698                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
10699                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
10700         }
10701
10702         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
10703
10704         if (list_empty(&hdev->adv_instances))
10705                 __hci_req_disable_advertising(&req);
10706
10707         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
10708          * flag is set or the device isn't powered then we have no HCI
10709          * communication to make. Simply return.
10710          */
10711         if (skb_queue_empty(&req.cmd_q) ||
10712             !hdev_is_powered(hdev) ||
10713             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
10714                 hci_req_purge(&req);
10715                 rp.instance = cp->instance;
10716                 err = mgmt_cmd_complete(sk, hdev->id,
10717                                         MGMT_OP_REMOVE_ADVERTISING,
10718                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10719                 goto unlock;
10720         }
10721
10722         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
10723                                data_len);
10724         if (!cmd) {
10725                 err = -ENOMEM;
10726                 goto unlock;
10727         }
10728
10729         err = hci_req_run(&req, remove_advertising_complete);
10730         if (err < 0)
10731                 mgmt_pending_remove(cmd);
10732
10733 unlock:
10734         hci_dev_unlock(hdev);
10735
10736         return err;
10737 }
10738
10739 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
10740                              void *data, u16 data_len)
10741 {
10742         struct mgmt_cp_get_adv_size_info *cp = data;
10743         struct mgmt_rp_get_adv_size_info rp;
10744         u32 flags, supported_flags;
10745         int err;
10746
10747         bt_dev_dbg(hdev, "sock %p", sk);
10748
10749         if (!lmp_le_capable(hdev))
10750                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10751                                        MGMT_STATUS_REJECTED);
10752
10753         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10754                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10755                                        MGMT_STATUS_INVALID_PARAMS);
10756
10757         flags = __le32_to_cpu(cp->flags);
10758
10759         /* The current implementation only supports a subset of the specified
10760          * flags.
10761          */
10762         supported_flags = get_supported_adv_flags(hdev);
10763         if (flags & ~supported_flags)
10764                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10765                                        MGMT_STATUS_INVALID_PARAMS);
10766
10767         rp.instance = cp->instance;
10768         rp.flags = cp->flags;
10769         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10770         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10771
10772         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10773                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10774
10775         return err;
10776 }
10777
10778 static const struct hci_mgmt_handler mgmt_handlers[] = {
10779         { NULL }, /* 0x0000 (no command) */
10780         { read_version,            MGMT_READ_VERSION_SIZE,
10781                                                 HCI_MGMT_NO_HDEV |
10782                                                 HCI_MGMT_UNTRUSTED },
10783         { read_commands,           MGMT_READ_COMMANDS_SIZE,
10784                                                 HCI_MGMT_NO_HDEV |
10785                                                 HCI_MGMT_UNTRUSTED },
10786         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
10787                                                 HCI_MGMT_NO_HDEV |
10788                                                 HCI_MGMT_UNTRUSTED },
10789         { read_controller_info,    MGMT_READ_INFO_SIZE,
10790                                                 HCI_MGMT_UNTRUSTED },
10791         { set_powered,             MGMT_SETTING_SIZE },
10792         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
10793         { set_connectable,         MGMT_SETTING_SIZE },
10794         { set_fast_connectable,    MGMT_SETTING_SIZE },
10795         { set_bondable,            MGMT_SETTING_SIZE },
10796         { set_link_security,       MGMT_SETTING_SIZE },
10797         { set_ssp,                 MGMT_SETTING_SIZE },
10798         { set_hs,                  MGMT_SETTING_SIZE },
10799         { set_le,                  MGMT_SETTING_SIZE },
10800         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
10801         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
10802         { add_uuid,                MGMT_ADD_UUID_SIZE },
10803         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
10804         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
10805                                                 HCI_MGMT_VAR_LEN },
10806         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
10807                                                 HCI_MGMT_VAR_LEN },
10808         { disconnect,              MGMT_DISCONNECT_SIZE },
10809         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
10810         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
10811         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
10812         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
10813         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
10814         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
10815         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
10816         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
10817         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
10818         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
10819         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
10820         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
10821         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
10822                                                 HCI_MGMT_VAR_LEN },
10823         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
10824         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
10825         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
10826         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
10827         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
10828         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
10829         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
10830         { set_advertising,         MGMT_SETTING_SIZE },
10831         { set_bredr,               MGMT_SETTING_SIZE },
10832         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
10833         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
10834         { set_secure_conn,         MGMT_SETTING_SIZE },
10835         { set_debug_keys,          MGMT_SETTING_SIZE },
10836         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
10837         { load_irks,               MGMT_LOAD_IRKS_SIZE,
10838                                                 HCI_MGMT_VAR_LEN },
10839         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
10840         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
10841         { add_device,              MGMT_ADD_DEVICE_SIZE },
10842         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
10843         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
10844                                                 HCI_MGMT_VAR_LEN },
10845         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
10846                                                 HCI_MGMT_NO_HDEV |
10847                                                 HCI_MGMT_UNTRUSTED },
10848         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
10849                                                 HCI_MGMT_UNCONFIGURED |
10850                                                 HCI_MGMT_UNTRUSTED },
10851         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
10852                                                 HCI_MGMT_UNCONFIGURED },
10853         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
10854                                                 HCI_MGMT_UNCONFIGURED },
10855         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
10856                                                 HCI_MGMT_VAR_LEN },
10857         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
10858         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
10859                                                 HCI_MGMT_NO_HDEV |
10860                                                 HCI_MGMT_UNTRUSTED },
10861         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
10862         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
10863                                                 HCI_MGMT_VAR_LEN },
10864         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
10865         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
10866         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
10867         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
10868                                                 HCI_MGMT_UNTRUSTED },
10869         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
10870         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
10871         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
10872         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
10873                                                 HCI_MGMT_VAR_LEN },
10874         { set_wideband_speech,     MGMT_SETTING_SIZE },
10875         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
10876                                                 HCI_MGMT_UNTRUSTED },
10877         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
10878                                                 HCI_MGMT_UNTRUSTED |
10879                                                 HCI_MGMT_HDEV_OPTIONAL },
10880         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
10881                                                 HCI_MGMT_VAR_LEN |
10882                                                 HCI_MGMT_HDEV_OPTIONAL },
10883         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
10884                                                 HCI_MGMT_UNTRUSTED },
10885         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
10886                                                 HCI_MGMT_VAR_LEN },
10887         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
10888                                                 HCI_MGMT_UNTRUSTED },
10889         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
10890                                                 HCI_MGMT_VAR_LEN },
10891         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
10892         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
10893         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
10894         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
10895                                                 HCI_MGMT_VAR_LEN },
10896         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
10897         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
10898                                                 HCI_MGMT_VAR_LEN },
10899         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
10900                                                 HCI_MGMT_VAR_LEN },
10901         { add_adv_patterns_monitor_rssi,
10902                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
10903                                                 HCI_MGMT_VAR_LEN },
10904 };
10905
10906 #ifdef TIZEN_BT
10907 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
10908         { NULL }, /* 0x0000 (no command) */
10909         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
10910         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
10911                                                 HCI_MGMT_VAR_LEN },
10912         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
10913                                                 HCI_MGMT_VAR_LEN },
10914         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
10915         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
10916         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
10917         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
10918         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
10919         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
10920         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
10921         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
10922         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
10923         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
10924         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
10925         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
10926         { set_voice_setting,       MGMT_SET_VOICE_SETTING_SIZE },
10927         { get_adv_tx_power,        MGMT_GET_ADV_TX_POWER_SIZE },
10928         { enable_bt_6lowpan,       MGMT_ENABLE_BT_6LOWPAN_SIZE },
10929         { connect_bt_6lowpan,      MGMT_CONNECT_6LOWPAN_SIZE },
10930         { disconnect_bt_6lowpan,   MGMT_DISCONNECT_6LOWPAN_SIZE },
10931         { read_maximum_le_data_length,
10932                                    MGMT_LE_READ_MAXIMUM_DATA_LENGTH_SIZE },
10933         { write_host_suggested_le_data_length,
10934                                    MGMT_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH_SIZE },
10935         { read_host_suggested_data_length,
10936                                    MGMT_LE_READ_HOST_SUGGESTED_DATA_LENGTH_SIZE },
10937         { set_le_data_length_params,
10938                                    MGMT_LE_SET_DATA_LENGTH_SIZE },
10939 };
10940 #endif
10941
10942 void mgmt_index_added(struct hci_dev *hdev)
10943 {
10944         struct mgmt_ev_ext_index ev;
10945
10946         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10947                 return;
10948
10949         switch (hdev->dev_type) {
10950         case HCI_PRIMARY:
10951                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10952                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
10953                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10954                         ev.type = 0x01;
10955                 } else {
10956                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
10957                                          HCI_MGMT_INDEX_EVENTS);
10958                         ev.type = 0x00;
10959                 }
10960                 break;
10961         case HCI_AMP:
10962                 ev.type = 0x02;
10963                 break;
10964         default:
10965                 return;
10966         }
10967
10968         ev.bus = hdev->bus;
10969
10970         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
10971                          HCI_MGMT_EXT_INDEX_EVENTS);
10972 }
10973
10974 void mgmt_index_removed(struct hci_dev *hdev)
10975 {
10976         struct mgmt_ev_ext_index ev;
10977         u8 status = MGMT_STATUS_INVALID_INDEX;
10978
10979         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10980                 return;
10981
10982         switch (hdev->dev_type) {
10983         case HCI_PRIMARY:
10984                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10985
10986                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10987                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
10988                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10989                         ev.type = 0x01;
10990                 } else {
10991                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
10992                                          HCI_MGMT_INDEX_EVENTS);
10993                         ev.type = 0x00;
10994                 }
10995                 break;
10996         case HCI_AMP:
10997                 ev.type = 0x02;
10998                 break;
10999         default:
11000                 return;
11001         }
11002
11003         ev.bus = hdev->bus;
11004
11005         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
11006                          HCI_MGMT_EXT_INDEX_EVENTS);
11007 }
11008
11009 /* This function requires the caller holds hdev->lock */
11010 static void restart_le_actions(struct hci_dev *hdev)
11011 {
11012         struct hci_conn_params *p;
11013
11014         list_for_each_entry(p, &hdev->le_conn_params, list) {
11015                 /* Needed for AUTO_OFF case where might not "really"
11016                  * have been powered off.
11017                  */
11018                 list_del_init(&p->action);
11019
11020                 switch (p->auto_connect) {
11021                 case HCI_AUTO_CONN_DIRECT:
11022                 case HCI_AUTO_CONN_ALWAYS:
11023                         list_add(&p->action, &hdev->pend_le_conns);
11024                         break;
11025                 case HCI_AUTO_CONN_REPORT:
11026                         list_add(&p->action, &hdev->pend_le_reports);
11027                         break;
11028                 default:
11029                         break;
11030                 }
11031         }
11032 }
11033
11034 void mgmt_power_on(struct hci_dev *hdev, int err)
11035 {
11036         struct cmd_lookup match = { NULL, hdev };
11037
11038         bt_dev_dbg(hdev, "err %d", err);
11039
11040         hci_dev_lock(hdev);
11041
11042         if (!err) {
11043                 restart_le_actions(hdev);
11044                 hci_update_background_scan(hdev);
11045         }
11046
11047         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
11048
11049         new_settings(hdev, match.sk);
11050
11051         if (match.sk)
11052                 sock_put(match.sk);
11053
11054         hci_dev_unlock(hdev);
11055 }
11056
11057 void __mgmt_power_off(struct hci_dev *hdev)
11058 {
11059         struct cmd_lookup match = { NULL, hdev };
11060         u8 status, zero_cod[] = { 0, 0, 0 };
11061
11062         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
11063
11064         /* If the power off is because of hdev unregistration let
11065          * use the appropriate INVALID_INDEX status. Otherwise use
11066          * NOT_POWERED. We cover both scenarios here since later in
11067          * mgmt_index_removed() any hci_conn callbacks will have already
11068          * been triggered, potentially causing misleading DISCONNECTED
11069          * status responses.
11070          */
11071         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
11072                 status = MGMT_STATUS_INVALID_INDEX;
11073         else
11074                 status = MGMT_STATUS_NOT_POWERED;
11075
11076         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
11077
11078         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
11079                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
11080                                    zero_cod, sizeof(zero_cod),
11081                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11082                 ext_info_changed(hdev, NULL);
11083         }
11084
11085         new_settings(hdev, match.sk);
11086
11087         if (match.sk)
11088                 sock_put(match.sk);
11089 }
11090
11091 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
11092 {
11093         struct mgmt_pending_cmd *cmd;
11094         u8 status;
11095
11096         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11097         if (!cmd)
11098                 return;
11099
11100         if (err == -ERFKILL)
11101                 status = MGMT_STATUS_RFKILLED;
11102         else
11103                 status = MGMT_STATUS_FAILED;
11104
11105         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
11106
11107         mgmt_pending_remove(cmd);
11108 }
11109
11110 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
11111                        bool persistent)
11112 {
11113         struct mgmt_ev_new_link_key ev;
11114
11115         memset(&ev, 0, sizeof(ev));
11116
11117         ev.store_hint = persistent;
11118         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11119         ev.key.addr.type = BDADDR_BREDR;
11120         ev.key.type = key->type;
11121         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
11122         ev.key.pin_len = key->pin_len;
11123
11124         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
11125 }
11126
11127 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
11128 {
11129         switch (ltk->type) {
11130         case SMP_LTK:
11131         case SMP_LTK_RESPONDER:
11132                 if (ltk->authenticated)
11133                         return MGMT_LTK_AUTHENTICATED;
11134                 return MGMT_LTK_UNAUTHENTICATED;
11135         case SMP_LTK_P256:
11136                 if (ltk->authenticated)
11137                         return MGMT_LTK_P256_AUTH;
11138                 return MGMT_LTK_P256_UNAUTH;
11139         case SMP_LTK_P256_DEBUG:
11140                 return MGMT_LTK_P256_DEBUG;
11141         }
11142
11143         return MGMT_LTK_UNAUTHENTICATED;
11144 }
11145
11146 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
11147 {
11148         struct mgmt_ev_new_long_term_key ev;
11149
11150         memset(&ev, 0, sizeof(ev));
11151
11152         /* Devices using resolvable or non-resolvable random addresses
11153          * without providing an identity resolving key don't require
11154          * to store long term keys. Their addresses will change the
11155          * next time around.
11156          *
11157          * Only when a remote device provides an identity address
11158          * make sure the long term key is stored. If the remote
11159          * identity is known, the long term keys are internally
11160          * mapped to the identity address. So allow static random
11161          * and public addresses here.
11162          */
11163         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11164             (key->bdaddr.b[5] & 0xc0) != 0xc0)
11165                 ev.store_hint = 0x00;
11166         else
11167                 ev.store_hint = persistent;
11168
11169         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11170         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
11171         ev.key.type = mgmt_ltk_type(key);
11172         ev.key.enc_size = key->enc_size;
11173         ev.key.ediv = key->ediv;
11174         ev.key.rand = key->rand;
11175
11176         if (key->type == SMP_LTK)
11177                 ev.key.initiator = 1;
11178
11179         /* Make sure we copy only the significant bytes based on the
11180          * encryption key size, and set the rest of the value to zeroes.
11181          */
11182         memcpy(ev.key.val, key->val, key->enc_size);
11183         memset(ev.key.val + key->enc_size, 0,
11184                sizeof(ev.key.val) - key->enc_size);
11185
11186         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
11187 }
11188
11189 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
11190 {
11191         struct mgmt_ev_new_irk ev;
11192
11193         memset(&ev, 0, sizeof(ev));
11194
11195         ev.store_hint = persistent;
11196
11197         bacpy(&ev.rpa, &irk->rpa);
11198         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
11199         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
11200         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
11201
11202         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
11203 }
11204
11205 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
11206                    bool persistent)
11207 {
11208         struct mgmt_ev_new_csrk ev;
11209
11210         memset(&ev, 0, sizeof(ev));
11211
11212         /* Devices using resolvable or non-resolvable random addresses
11213          * without providing an identity resolving key don't require
11214          * to store signature resolving keys. Their addresses will change
11215          * the next time around.
11216          *
11217          * Only when a remote device provides an identity address
11218          * make sure the signature resolving key is stored. So allow
11219          * static random and public addresses here.
11220          */
11221         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11222             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
11223                 ev.store_hint = 0x00;
11224         else
11225                 ev.store_hint = persistent;
11226
11227         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
11228         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
11229         ev.key.type = csrk->type;
11230         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
11231
11232         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
11233 }
11234
11235 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
11236                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
11237                          u16 max_interval, u16 latency, u16 timeout)
11238 {
11239         struct mgmt_ev_new_conn_param ev;
11240
11241         if (!hci_is_identity_address(bdaddr, bdaddr_type))
11242                 return;
11243
11244         memset(&ev, 0, sizeof(ev));
11245         bacpy(&ev.addr.bdaddr, bdaddr);
11246         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
11247         ev.store_hint = store_hint;
11248         ev.min_interval = cpu_to_le16(min_interval);
11249         ev.max_interval = cpu_to_le16(max_interval);
11250         ev.latency = cpu_to_le16(latency);
11251         ev.timeout = cpu_to_le16(timeout);
11252
11253         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
11254 }
11255
11256 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
11257                            u8 *name, u8 name_len)
11258 {
11259         char buf[512];
11260         struct mgmt_ev_device_connected *ev = (void *) buf;
11261         u16 eir_len = 0;
11262         u32 flags = 0;
11263
11264         bacpy(&ev->addr.bdaddr, &conn->dst);
11265         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11266
11267         if (conn->out)
11268                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
11269
11270         ev->flags = __cpu_to_le32(flags);
11271
11272         /* We must ensure that the EIR Data fields are ordered and
11273          * unique. Keep it simple for now and avoid the problem by not
11274          * adding any BR/EDR data to the LE adv.
11275          */
11276         if (conn->le_adv_data_len > 0) {
11277                 memcpy(&ev->eir[eir_len],
11278                        conn->le_adv_data, conn->le_adv_data_len);
11279                 eir_len = conn->le_adv_data_len;
11280         } else {
11281                 if (name_len > 0)
11282                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
11283                                                   name, name_len);
11284
11285                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
11286                         eir_len = eir_append_data(ev->eir, eir_len,
11287                                                   EIR_CLASS_OF_DEV,
11288                                                   conn->dev_class, 3);
11289         }
11290
11291         ev->eir_len = cpu_to_le16(eir_len);
11292
11293         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
11294                     sizeof(*ev) + eir_len, NULL);
11295 }
11296
11297 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
11298 {
11299         struct sock **sk = data;
11300
11301         cmd->cmd_complete(cmd, 0);
11302
11303         *sk = cmd->sk;
11304         sock_hold(*sk);
11305
11306         mgmt_pending_remove(cmd);
11307 }
11308
11309 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
11310 {
11311         struct hci_dev *hdev = data;
11312         struct mgmt_cp_unpair_device *cp = cmd->param;
11313
11314         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
11315
11316         cmd->cmd_complete(cmd, 0);
11317         mgmt_pending_remove(cmd);
11318 }
11319
11320 bool mgmt_powering_down(struct hci_dev *hdev)
11321 {
11322         struct mgmt_pending_cmd *cmd;
11323         struct mgmt_mode *cp;
11324
11325         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11326         if (!cmd)
11327                 return false;
11328
11329         cp = cmd->param;
11330         if (!cp->val)
11331                 return true;
11332
11333         return false;
11334 }
11335
11336 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
11337                               u8 link_type, u8 addr_type, u8 reason,
11338                               bool mgmt_connected)
11339 {
11340         struct mgmt_ev_device_disconnected ev;
11341         struct sock *sk = NULL;
11342
11343         /* The connection is still in hci_conn_hash so test for 1
11344          * instead of 0 to know if this is the last one.
11345          */
11346         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11347                 cancel_delayed_work(&hdev->power_off);
11348                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11349         }
11350
11351         if (!mgmt_connected)
11352                 return;
11353
11354         if (link_type != ACL_LINK && link_type != LE_LINK)
11355                 return;
11356
11357         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
11358
11359         bacpy(&ev.addr.bdaddr, bdaddr);
11360         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11361         ev.reason = reason;
11362
11363         /* Report disconnects due to suspend */
11364         if (hdev->suspended)
11365                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
11366
11367         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
11368
11369         if (sk)
11370                 sock_put(sk);
11371
11372         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11373                              hdev);
11374 }
11375
11376 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
11377                             u8 link_type, u8 addr_type, u8 status)
11378 {
11379         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
11380         struct mgmt_cp_disconnect *cp;
11381         struct mgmt_pending_cmd *cmd;
11382
11383         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11384                              hdev);
11385
11386         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
11387         if (!cmd)
11388                 return;
11389
11390         cp = cmd->param;
11391
11392         if (bacmp(bdaddr, &cp->addr.bdaddr))
11393                 return;
11394
11395         if (cp->addr.type != bdaddr_type)
11396                 return;
11397
11398         cmd->cmd_complete(cmd, mgmt_status(status));
11399         mgmt_pending_remove(cmd);
11400 }
11401
11402 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11403                          u8 addr_type, u8 status)
11404 {
11405         struct mgmt_ev_connect_failed ev;
11406
11407         /* The connection is still in hci_conn_hash so test for 1
11408          * instead of 0 to know if this is the last one.
11409          */
11410         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11411                 cancel_delayed_work(&hdev->power_off);
11412                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11413         }
11414
11415         bacpy(&ev.addr.bdaddr, bdaddr);
11416         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11417         ev.status = mgmt_status(status);
11418
11419         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
11420 }
11421
11422 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
11423 {
11424         struct mgmt_ev_pin_code_request ev;
11425
11426         bacpy(&ev.addr.bdaddr, bdaddr);
11427         ev.addr.type = BDADDR_BREDR;
11428         ev.secure = secure;
11429
11430         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
11431 }
11432
11433 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11434                                   u8 status)
11435 {
11436         struct mgmt_pending_cmd *cmd;
11437
11438         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
11439         if (!cmd)
11440                 return;
11441
11442         cmd->cmd_complete(cmd, mgmt_status(status));
11443         mgmt_pending_remove(cmd);
11444 }
11445
11446 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11447                                       u8 status)
11448 {
11449         struct mgmt_pending_cmd *cmd;
11450
11451         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
11452         if (!cmd)
11453                 return;
11454
11455         cmd->cmd_complete(cmd, mgmt_status(status));
11456         mgmt_pending_remove(cmd);
11457 }
11458
11459 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11460                               u8 link_type, u8 addr_type, u32 value,
11461                               u8 confirm_hint)
11462 {
11463         struct mgmt_ev_user_confirm_request ev;
11464
11465         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11466
11467         bacpy(&ev.addr.bdaddr, bdaddr);
11468         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11469         ev.confirm_hint = confirm_hint;
11470         ev.value = cpu_to_le32(value);
11471
11472         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
11473                           NULL);
11474 }
11475
11476 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11477                               u8 link_type, u8 addr_type)
11478 {
11479         struct mgmt_ev_user_passkey_request ev;
11480
11481         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11482
11483         bacpy(&ev.addr.bdaddr, bdaddr);
11484         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11485
11486         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
11487                           NULL);
11488 }
11489
11490 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11491                                       u8 link_type, u8 addr_type, u8 status,
11492                                       u8 opcode)
11493 {
11494         struct mgmt_pending_cmd *cmd;
11495
11496         cmd = pending_find(opcode, hdev);
11497         if (!cmd)
11498                 return -ENOENT;
11499
11500         cmd->cmd_complete(cmd, mgmt_status(status));
11501         mgmt_pending_remove(cmd);
11502
11503         return 0;
11504 }
11505
11506 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11507                                      u8 link_type, u8 addr_type, u8 status)
11508 {
11509         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11510                                           status, MGMT_OP_USER_CONFIRM_REPLY);
11511 }
11512
11513 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11514                                          u8 link_type, u8 addr_type, u8 status)
11515 {
11516         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11517                                           status,
11518                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
11519 }
11520
11521 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11522                                      u8 link_type, u8 addr_type, u8 status)
11523 {
11524         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11525                                           status, MGMT_OP_USER_PASSKEY_REPLY);
11526 }
11527
11528 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11529                                          u8 link_type, u8 addr_type, u8 status)
11530 {
11531         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11532                                           status,
11533                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
11534 }
11535
11536 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
11537                              u8 link_type, u8 addr_type, u32 passkey,
11538                              u8 entered)
11539 {
11540         struct mgmt_ev_passkey_notify ev;
11541
11542         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11543
11544         bacpy(&ev.addr.bdaddr, bdaddr);
11545         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11546         ev.passkey = __cpu_to_le32(passkey);
11547         ev.entered = entered;
11548
11549         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
11550 }
11551
11552 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
11553 {
11554         struct mgmt_ev_auth_failed ev;
11555         struct mgmt_pending_cmd *cmd;
11556         u8 status = mgmt_status(hci_status);
11557
11558         bacpy(&ev.addr.bdaddr, &conn->dst);
11559         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11560         ev.status = status;
11561
11562         cmd = find_pairing(conn);
11563
11564         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
11565                     cmd ? cmd->sk : NULL);
11566
11567         if (cmd) {
11568                 cmd->cmd_complete(cmd, status);
11569                 mgmt_pending_remove(cmd);
11570         }
11571 }
11572
11573 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
11574 {
11575         struct cmd_lookup match = { NULL, hdev };
11576         bool changed;
11577
11578         if (status) {
11579                 u8 mgmt_err = mgmt_status(status);
11580                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
11581                                      cmd_status_rsp, &mgmt_err);
11582                 return;
11583         }
11584
11585         if (test_bit(HCI_AUTH, &hdev->flags))
11586                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
11587         else
11588                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
11589
11590         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
11591                              &match);
11592
11593         if (changed)
11594                 new_settings(hdev, match.sk);
11595
11596         if (match.sk)
11597                 sock_put(match.sk);
11598 }
11599
11600 static void clear_eir(struct hci_request *req)
11601 {
11602         struct hci_dev *hdev = req->hdev;
11603         struct hci_cp_write_eir cp;
11604
11605         if (!lmp_ext_inq_capable(hdev))
11606                 return;
11607
11608         memset(hdev->eir, 0, sizeof(hdev->eir));
11609
11610         memset(&cp, 0, sizeof(cp));
11611
11612         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
11613 }
11614
11615 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
11616 {
11617         struct cmd_lookup match = { NULL, hdev };
11618         struct hci_request req;
11619         bool changed = false;
11620
11621         if (status) {
11622                 u8 mgmt_err = mgmt_status(status);
11623
11624                 if (enable && hci_dev_test_and_clear_flag(hdev,
11625                                                           HCI_SSP_ENABLED)) {
11626                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
11627                         new_settings(hdev, NULL);
11628                 }
11629
11630                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
11631                                      &mgmt_err);
11632                 return;
11633         }
11634
11635         if (enable) {
11636                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
11637         } else {
11638                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
11639                 if (!changed)
11640                         changed = hci_dev_test_and_clear_flag(hdev,
11641                                                               HCI_HS_ENABLED);
11642                 else
11643                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
11644         }
11645
11646         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
11647
11648         if (changed)
11649                 new_settings(hdev, match.sk);
11650
11651         if (match.sk)
11652                 sock_put(match.sk);
11653
11654         hci_req_init(&req, hdev);
11655
11656         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
11657                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
11658                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
11659                                     sizeof(enable), &enable);
11660                 __hci_req_update_eir(&req);
11661         } else {
11662                 clear_eir(&req);
11663         }
11664
11665         hci_req_run(&req, NULL);
11666 }
11667
11668 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
11669 {
11670         struct cmd_lookup *match = data;
11671
11672         if (match->sk == NULL) {
11673                 match->sk = cmd->sk;
11674                 sock_hold(match->sk);
11675         }
11676 }
11677
11678 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
11679                                     u8 status)
11680 {
11681         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
11682
11683         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
11684         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
11685         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
11686
11687         if (!status) {
11688                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
11689                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11690                 ext_info_changed(hdev, NULL);
11691         }
11692
11693         if (match.sk)
11694                 sock_put(match.sk);
11695 }
11696
11697 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
11698 {
11699         struct mgmt_cp_set_local_name ev;
11700         struct mgmt_pending_cmd *cmd;
11701
11702         if (status)
11703                 return;
11704
11705         memset(&ev, 0, sizeof(ev));
11706         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
11707         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
11708
11709         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
11710         if (!cmd) {
11711                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
11712
11713                 /* If this is a HCI command related to powering on the
11714                  * HCI dev don't send any mgmt signals.
11715                  */
11716                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
11717                         return;
11718         }
11719
11720         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
11721                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
11722         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
11723 }
11724
11725 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
11726 {
11727         int i;
11728
11729         for (i = 0; i < uuid_count; i++) {
11730                 if (!memcmp(uuid, uuids[i], 16))
11731                         return true;
11732         }
11733
11734         return false;
11735 }
11736
11737 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
11738 {
11739         u16 parsed = 0;
11740
11741         while (parsed < eir_len) {
11742                 u8 field_len = eir[0];
11743                 u8 uuid[16];
11744                 int i;
11745
11746                 if (field_len == 0)
11747                         break;
11748
11749                 if (eir_len - parsed < field_len + 1)
11750                         break;
11751
11752                 switch (eir[1]) {
11753                 case EIR_UUID16_ALL:
11754                 case EIR_UUID16_SOME:
11755                         for (i = 0; i + 3 <= field_len; i += 2) {
11756                                 memcpy(uuid, bluetooth_base_uuid, 16);
11757                                 uuid[13] = eir[i + 3];
11758                                 uuid[12] = eir[i + 2];
11759                                 if (has_uuid(uuid, uuid_count, uuids))
11760                                         return true;
11761                         }
11762                         break;
11763                 case EIR_UUID32_ALL:
11764                 case EIR_UUID32_SOME:
11765                         for (i = 0; i + 5 <= field_len; i += 4) {
11766                                 memcpy(uuid, bluetooth_base_uuid, 16);
11767                                 uuid[15] = eir[i + 5];
11768                                 uuid[14] = eir[i + 4];
11769                                 uuid[13] = eir[i + 3];
11770                                 uuid[12] = eir[i + 2];
11771                                 if (has_uuid(uuid, uuid_count, uuids))
11772                                         return true;
11773                         }
11774                         break;
11775                 case EIR_UUID128_ALL:
11776                 case EIR_UUID128_SOME:
11777                         for (i = 0; i + 17 <= field_len; i += 16) {
11778                                 memcpy(uuid, eir + i + 2, 16);
11779                                 if (has_uuid(uuid, uuid_count, uuids))
11780                                         return true;
11781                         }
11782                         break;
11783                 }
11784
11785                 parsed += field_len + 1;
11786                 eir += field_len + 1;
11787         }
11788
11789         return false;
11790 }
11791
11792 static void restart_le_scan(struct hci_dev *hdev)
11793 {
11794         /* If controller is not scanning we are done. */
11795         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
11796                 return;
11797
11798         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
11799                        hdev->discovery.scan_start +
11800                        hdev->discovery.scan_duration))
11801                 return;
11802
11803         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
11804                            DISCOV_LE_RESTART_DELAY);
11805 }
11806
11807 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
11808                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11809 {
11810         /* If a RSSI threshold has been specified, and
11811          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
11812          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
11813          * is set, let it through for further processing, as we might need to
11814          * restart the scan.
11815          *
11816          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
11817          * the results are also dropped.
11818          */
11819         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11820             (rssi == HCI_RSSI_INVALID ||
11821             (rssi < hdev->discovery.rssi &&
11822              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
11823                 return  false;
11824
11825         if (hdev->discovery.uuid_count != 0) {
11826                 /* If a list of UUIDs is provided in filter, results with no
11827                  * matching UUID should be dropped.
11828                  */
11829                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
11830                                    hdev->discovery.uuids) &&
11831                     !eir_has_uuids(scan_rsp, scan_rsp_len,
11832                                    hdev->discovery.uuid_count,
11833                                    hdev->discovery.uuids))
11834                         return false;
11835         }
11836
11837         /* If duplicate filtering does not report RSSI changes, then restart
11838          * scanning to ensure updated result with updated RSSI values.
11839          */
11840         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
11841                 restart_le_scan(hdev);
11842
11843                 /* Validate RSSI value against the RSSI threshold once more. */
11844                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11845                     rssi < hdev->discovery.rssi)
11846                         return false;
11847         }
11848
11849         return true;
11850 }
11851
11852 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11853                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
11854                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11855 {
11856         char buf[512];
11857         struct mgmt_ev_device_found *ev = (void *)buf;
11858         size_t ev_size;
11859
11860         /* Don't send events for a non-kernel initiated discovery. With
11861          * LE one exception is if we have pend_le_reports > 0 in which
11862          * case we're doing passive scanning and want these events.
11863          */
11864         if (!hci_discovery_active(hdev)) {
11865                 if (link_type == ACL_LINK)
11866                         return;
11867                 if (link_type == LE_LINK &&
11868                     list_empty(&hdev->pend_le_reports) &&
11869                     !hci_is_adv_monitoring(hdev)) {
11870                         return;
11871                 }
11872         }
11873
11874         if (hdev->discovery.result_filtering) {
11875                 /* We are using service discovery */
11876                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
11877                                      scan_rsp_len))
11878                         return;
11879         }
11880
11881         if (hdev->discovery.limited) {
11882                 /* Check for limited discoverable bit */
11883                 if (dev_class) {
11884                         if (!(dev_class[1] & 0x20))
11885                                 return;
11886                 } else {
11887                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
11888                         if (!flags || !(flags[0] & LE_AD_LIMITED))
11889                                 return;
11890                 }
11891         }
11892
11893         /* Make sure that the buffer is big enough. The 5 extra bytes
11894          * are for the potential CoD field.
11895          */
11896         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
11897                 return;
11898
11899         memset(buf, 0, sizeof(buf));
11900
11901         /* In case of device discovery with BR/EDR devices (pre 1.2), the
11902          * RSSI value was reported as 0 when not available. This behavior
11903          * is kept when using device discovery. This is required for full
11904          * backwards compatibility with the API.
11905          *
11906          * However when using service discovery, the value 127 will be
11907          * returned when the RSSI is not available.
11908          */
11909         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
11910             link_type == ACL_LINK)
11911                 rssi = 0;
11912
11913         bacpy(&ev->addr.bdaddr, bdaddr);
11914         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11915         ev->rssi = rssi;
11916         ev->flags = cpu_to_le32(flags);
11917
11918         if (eir_len > 0)
11919                 /* Copy EIR or advertising data into event */
11920                 memcpy(ev->eir, eir, eir_len);
11921
11922         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11923                                        NULL))
11924                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11925                                           dev_class, 3);
11926
11927         if (scan_rsp_len > 0)
11928                 /* Append scan response data to event */
11929                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
11930
11931         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11932         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
11933
11934         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
11935 }
11936
11937 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11938                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
11939 {
11940         struct mgmt_ev_device_found *ev;
11941         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
11942         u16 eir_len;
11943
11944         ev = (struct mgmt_ev_device_found *) buf;
11945
11946         memset(buf, 0, sizeof(buf));
11947
11948         bacpy(&ev->addr.bdaddr, bdaddr);
11949         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11950         ev->rssi = rssi;
11951
11952         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
11953                                   name_len);
11954
11955         ev->eir_len = cpu_to_le16(eir_len);
11956
11957         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
11958 }
11959
11960 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
11961 {
11962         struct mgmt_ev_discovering ev;
11963
11964         bt_dev_dbg(hdev, "discovering %u", discovering);
11965
11966         memset(&ev, 0, sizeof(ev));
11967         ev.type = hdev->discovery.type;
11968         ev.discovering = discovering;
11969
11970         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
11971 }
11972
11973 void mgmt_suspending(struct hci_dev *hdev, u8 state)
11974 {
11975         struct mgmt_ev_controller_suspend ev;
11976
11977         ev.suspend_state = state;
11978         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
11979 }
11980
11981 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
11982                    u8 addr_type)
11983 {
11984         struct mgmt_ev_controller_resume ev;
11985
11986         ev.wake_reason = reason;
11987         if (bdaddr) {
11988                 bacpy(&ev.addr.bdaddr, bdaddr);
11989                 ev.addr.type = addr_type;
11990         } else {
11991                 memset(&ev.addr, 0, sizeof(ev.addr));
11992         }
11993
11994         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
11995 }
11996
11997 static struct hci_mgmt_chan chan = {
11998         .channel        = HCI_CHANNEL_CONTROL,
11999         .handler_count  = ARRAY_SIZE(mgmt_handlers),
12000         .handlers       = mgmt_handlers,
12001 #ifdef TIZEN_BT
12002         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
12003         .tizen_handlers = tizen_mgmt_handlers,
12004 #endif
12005         .hdev_init      = mgmt_init_hdev,
12006 };
12007
12008 int mgmt_init(void)
12009 {
12010         return hci_mgmt_chan_register(&chan);
12011 }
12012
12013 void mgmt_exit(void)
12014 {
12015         hci_mgmt_chan_unregister(&chan);
12016 }