net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #endif
  38
  39 #include "hci_request.h"
  40 #include "smp.h"
  41 #include "mgmt_util.h"
  42 #include "mgmt_config.h"
  43 #include "msft.h"
  44 #include "eir.h"
  45 #include "aosp.h"
  46
  47 #define MGMT_VERSION    1
  48 #define MGMT_REVISION   22
  49
  50 static const u16 mgmt_commands[] = {
  51         MGMT_OP_READ_INDEX_LIST,
  52         MGMT_OP_READ_INFO,
  53         MGMT_OP_SET_POWERED,
  54         MGMT_OP_SET_DISCOVERABLE,
  55         MGMT_OP_SET_CONNECTABLE,
  56         MGMT_OP_SET_FAST_CONNECTABLE,
  57         MGMT_OP_SET_BONDABLE,
  58         MGMT_OP_SET_LINK_SECURITY,
  59         MGMT_OP_SET_SSP,
  60         MGMT_OP_SET_HS,
  61         MGMT_OP_SET_LE,
  62         MGMT_OP_SET_DEV_CLASS,
  63         MGMT_OP_SET_LOCAL_NAME,
  64         MGMT_OP_ADD_UUID,
  65         MGMT_OP_REMOVE_UUID,
  66         MGMT_OP_LOAD_LINK_KEYS,
  67         MGMT_OP_LOAD_LONG_TERM_KEYS,
  68         MGMT_OP_DISCONNECT,
  69         MGMT_OP_GET_CONNECTIONS,
  70         MGMT_OP_PIN_CODE_REPLY,
  71         MGMT_OP_PIN_CODE_NEG_REPLY,
  72         MGMT_OP_SET_IO_CAPABILITY,
  73         MGMT_OP_PAIR_DEVICE,
  74         MGMT_OP_CANCEL_PAIR_DEVICE,
  75         MGMT_OP_UNPAIR_DEVICE,
  76         MGMT_OP_USER_CONFIRM_REPLY,
  77         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  78         MGMT_OP_USER_PASSKEY_REPLY,
  79         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  80         MGMT_OP_READ_LOCAL_OOB_DATA,
  81         MGMT_OP_ADD_REMOTE_OOB_DATA,
  82         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  83         MGMT_OP_START_DISCOVERY,
  84         MGMT_OP_STOP_DISCOVERY,
  85         MGMT_OP_CONFIRM_NAME,
  86         MGMT_OP_BLOCK_DEVICE,
  87         MGMT_OP_UNBLOCK_DEVICE,
  88         MGMT_OP_SET_DEVICE_ID,
  89         MGMT_OP_SET_ADVERTISING,
  90         MGMT_OP_SET_BREDR,
  91         MGMT_OP_SET_STATIC_ADDRESS,
  92         MGMT_OP_SET_SCAN_PARAMS,
  93         MGMT_OP_SET_SECURE_CONN,
  94         MGMT_OP_SET_DEBUG_KEYS,
  95         MGMT_OP_SET_PRIVACY,
  96         MGMT_OP_LOAD_IRKS,
  97         MGMT_OP_GET_CONN_INFO,
  98         MGMT_OP_GET_CLOCK_INFO,
  99         MGMT_OP_ADD_DEVICE,
 100         MGMT_OP_REMOVE_DEVICE,
 101         MGMT_OP_LOAD_CONN_PARAM,
 102         MGMT_OP_READ_UNCONF_INDEX_LIST,
 103         MGMT_OP_READ_CONFIG_INFO,
 104         MGMT_OP_SET_EXTERNAL_CONFIG,
 105         MGMT_OP_SET_PUBLIC_ADDRESS,
 106         MGMT_OP_START_SERVICE_DISCOVERY,
 107         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 108         MGMT_OP_READ_EXT_INDEX_LIST,
 109         MGMT_OP_READ_ADV_FEATURES,
 110         MGMT_OP_ADD_ADVERTISING,
 111         MGMT_OP_REMOVE_ADVERTISING,
 112         MGMT_OP_GET_ADV_SIZE_INFO,
 113         MGMT_OP_START_LIMITED_DISCOVERY,
 114         MGMT_OP_READ_EXT_INFO,
 115         MGMT_OP_SET_APPEARANCE,
 116         MGMT_OP_GET_PHY_CONFIGURATION,
 117         MGMT_OP_SET_PHY_CONFIGURATION,
 118         MGMT_OP_SET_BLOCKED_KEYS,
 119         MGMT_OP_SET_WIDEBAND_SPEECH,
 120         MGMT_OP_READ_CONTROLLER_CAP,
 121         MGMT_OP_READ_EXP_FEATURES_INFO,
 122         MGMT_OP_SET_EXP_FEATURE,
 123         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 124         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 125         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 126         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 127         MGMT_OP_GET_DEVICE_FLAGS,
 128         MGMT_OP_SET_DEVICE_FLAGS,
 129         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 130         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 131         MGMT_OP_REMOVE_ADV_MONITOR,
 132         MGMT_OP_ADD_EXT_ADV_PARAMS,
 133         MGMT_OP_ADD_EXT_ADV_DATA,
 134         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 135         MGMT_OP_SET_MESH_RECEIVER,
 136         MGMT_OP_MESH_READ_FEATURES,
 137         MGMT_OP_MESH_SEND,
 138         MGMT_OP_MESH_SEND_CANCEL,
 139 };
 140
 141 static const u16 mgmt_events[] = {
 142         MGMT_EV_CONTROLLER_ERROR,
 143         MGMT_EV_INDEX_ADDED,
 144         MGMT_EV_INDEX_REMOVED,
 145         MGMT_EV_NEW_SETTINGS,
 146         MGMT_EV_CLASS_OF_DEV_CHANGED,
 147         MGMT_EV_LOCAL_NAME_CHANGED,
 148         MGMT_EV_NEW_LINK_KEY,
 149         MGMT_EV_NEW_LONG_TERM_KEY,
 150         MGMT_EV_DEVICE_CONNECTED,
 151         MGMT_EV_DEVICE_DISCONNECTED,
 152         MGMT_EV_CONNECT_FAILED,
 153         MGMT_EV_PIN_CODE_REQUEST,
 154         MGMT_EV_USER_CONFIRM_REQUEST,
 155         MGMT_EV_USER_PASSKEY_REQUEST,
 156         MGMT_EV_AUTH_FAILED,
 157         MGMT_EV_DEVICE_FOUND,
 158         MGMT_EV_DISCOVERING,
 159         MGMT_EV_DEVICE_BLOCKED,
 160         MGMT_EV_DEVICE_UNBLOCKED,
 161         MGMT_EV_DEVICE_UNPAIRED,
 162         MGMT_EV_PASSKEY_NOTIFY,
 163         MGMT_EV_NEW_IRK,
 164         MGMT_EV_NEW_CSRK,
 165         MGMT_EV_DEVICE_ADDED,
 166         MGMT_EV_DEVICE_REMOVED,
 167         MGMT_EV_NEW_CONN_PARAM,
 168         MGMT_EV_UNCONF_INDEX_ADDED,
 169         MGMT_EV_UNCONF_INDEX_REMOVED,
 170         MGMT_EV_NEW_CONFIG_OPTIONS,
 171         MGMT_EV_EXT_INDEX_ADDED,
 172         MGMT_EV_EXT_INDEX_REMOVED,
 173         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 174         MGMT_EV_ADVERTISING_ADDED,
 175         MGMT_EV_ADVERTISING_REMOVED,
 176         MGMT_EV_EXT_INFO_CHANGED,
 177         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 178         MGMT_EV_EXP_FEATURE_CHANGED,
 179         MGMT_EV_DEVICE_FLAGS_CHANGED,
 180         MGMT_EV_ADV_MONITOR_ADDED,
 181         MGMT_EV_ADV_MONITOR_REMOVED,
 182         MGMT_EV_CONTROLLER_SUSPEND,
 183         MGMT_EV_CONTROLLER_RESUME,
 184         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 185         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 186 };
 187
 188 static const u16 mgmt_untrusted_commands[] = {
 189         MGMT_OP_READ_INDEX_LIST,
 190         MGMT_OP_READ_INFO,
 191         MGMT_OP_READ_UNCONF_INDEX_LIST,
 192         MGMT_OP_READ_CONFIG_INFO,
 193         MGMT_OP_READ_EXT_INDEX_LIST,
 194         MGMT_OP_READ_EXT_INFO,
 195         MGMT_OP_READ_CONTROLLER_CAP,
 196         MGMT_OP_READ_EXP_FEATURES_INFO,
 197         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 198         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 199 };
 200
 201 static const u16 mgmt_untrusted_events[] = {
 202         MGMT_EV_INDEX_ADDED,
 203         MGMT_EV_INDEX_REMOVED,
 204         MGMT_EV_NEW_SETTINGS,
 205         MGMT_EV_CLASS_OF_DEV_CHANGED,
 206         MGMT_EV_LOCAL_NAME_CHANGED,
 207         MGMT_EV_UNCONF_INDEX_ADDED,
 208         MGMT_EV_UNCONF_INDEX_REMOVED,
 209         MGMT_EV_NEW_CONFIG_OPTIONS,
 210         MGMT_EV_EXT_INDEX_ADDED,
 211         MGMT_EV_EXT_INDEX_REMOVED,
 212         MGMT_EV_EXT_INFO_CHANGED,
 213         MGMT_EV_EXP_FEATURE_CHANGED,
 214 };
 215
 216 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 217
 218 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 219                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 220
 221 /* HCI to MGMT error code conversion table */
 222 static const u8 mgmt_status_table[] = {
 223         MGMT_STATUS_SUCCESS,
 224         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 225         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 226         MGMT_STATUS_FAILED,             /* Hardware Failure */
 227         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 228         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 229         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 230         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 231         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 232         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 233         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 234         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 235         MGMT_STATUS_BUSY,               /* Command Disallowed */
 236         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 237         MGMT_STATUS_REJECTED,           /* Rejected Security */
 238         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 239         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 240         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 241         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 242         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 243         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 244         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 245         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 246         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 247         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 248         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 249         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 250         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 251         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 252         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 253         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 254         MGMT_STATUS_FAILED,             /* Unspecified Error */
 255         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 256         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 257         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 258         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 259         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 260         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 261         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 262         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 263         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 264         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 265         MGMT_STATUS_FAILED,             /* Transaction Collision */
 266         MGMT_STATUS_FAILED,             /* Reserved for future use */
 267         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 268         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 269         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 270         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 271         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 272         MGMT_STATUS_FAILED,             /* Reserved for future use */
 273         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 274         MGMT_STATUS_FAILED,             /* Reserved for future use */
 275         MGMT_STATUS_FAILED,             /* Slot Violation */
 276         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 277         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 278         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 279         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 280         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 281         MGMT_STATUS_BUSY,               /* Controller Busy */
 282         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 283         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 284         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 285         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 286         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 287 };
 288
 289 static u8 mgmt_errno_status(int err)
 290 {
 291         switch (err) {
 292         case 0:
 293                 return MGMT_STATUS_SUCCESS;
 294         case -EPERM:
 295                 return MGMT_STATUS_REJECTED;
 296         case -EINVAL:
 297                 return MGMT_STATUS_INVALID_PARAMS;
 298         case -EOPNOTSUPP:
 299                 return MGMT_STATUS_NOT_SUPPORTED;
 300         case -EBUSY:
 301                 return MGMT_STATUS_BUSY;
 302         case -ETIMEDOUT:
 303                 return MGMT_STATUS_AUTH_FAILED;
 304         case -ENOMEM:
 305                 return MGMT_STATUS_NO_RESOURCES;
 306         case -EISCONN:
 307                 return MGMT_STATUS_ALREADY_CONNECTED;
 308         case -ENOTCONN:
 309                 return MGMT_STATUS_DISCONNECTED;
 310         }
 311
 312         return MGMT_STATUS_FAILED;
 313 }
 314
 315 static u8 mgmt_status(int err)
 316 {
 317         if (err < 0)
 318                 return mgmt_errno_status(err);
 319
 320         if (err < ARRAY_SIZE(mgmt_status_table))
 321                 return mgmt_status_table[err];
 322
 323         return MGMT_STATUS_FAILED;
 324 }
 325
 326 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 327                             u16 len, int flag)
 328 {
 329         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 330                                flag, NULL);
 331 }
 332
 333 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 334                               u16 len, int flag, struct sock *skip_sk)
 335 {
 336         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 337                                flag, skip_sk);
 338 }
 339
 340 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 341                       struct sock *skip_sk)
 342 {
 343         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 344                                HCI_SOCK_TRUSTED, skip_sk);
 345 }
 346
 347 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 348 {
 349         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 350                                    skip_sk);
 351 }
 352
 353 static u8 le_addr_type(u8 mgmt_addr_type)
 354 {
 355         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 356                 return ADDR_LE_DEV_PUBLIC;
 357         else
 358                 return ADDR_LE_DEV_RANDOM;
 359 }
 360
 361 void mgmt_fill_version_info(void *ver)
 362 {
 363         struct mgmt_rp_read_version *rp = ver;
 364
 365         rp->version = MGMT_VERSION;
 366         rp->revision = cpu_to_le16(MGMT_REVISION);
 367 }
 368
 369 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 370                         u16 data_len)
 371 {
 372         struct mgmt_rp_read_version rp;
 373
 374         bt_dev_dbg(hdev, "sock %p", sk);
 375
 376         mgmt_fill_version_info(&rp);
 377
 378         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 379                                  &rp, sizeof(rp));
 380 }
 381
 382 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 383                          u16 data_len)
 384 {
 385         struct mgmt_rp_read_commands *rp;
 386         u16 num_commands, num_events;
 387         size_t rp_size;
 388         int i, err;
 389
 390         bt_dev_dbg(hdev, "sock %p", sk);
 391
 392         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 393                 num_commands = ARRAY_SIZE(mgmt_commands);
 394                 num_events = ARRAY_SIZE(mgmt_events);
 395         } else {
 396                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 397                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 398         }
 399
 400         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 401
 402         rp = kmalloc(rp_size, GFP_KERNEL);
 403         if (!rp)
 404                 return -ENOMEM;
 405
 406         rp->num_commands = cpu_to_le16(num_commands);
 407         rp->num_events = cpu_to_le16(num_events);
 408
 409         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 410                 __le16 *opcode = rp->opcodes;
 411
 412                 for (i = 0; i < num_commands; i++, opcode++)
 413                         put_unaligned_le16(mgmt_commands[i], opcode);
 414
 415                 for (i = 0; i < num_events; i++, opcode++)
 416                         put_unaligned_le16(mgmt_events[i], opcode);
 417         } else {
 418                 __le16 *opcode = rp->opcodes;
 419
 420                 for (i = 0; i < num_commands; i++, opcode++)
 421                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 422
 423                 for (i = 0; i < num_events; i++, opcode++)
 424                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 425         }
 426
 427         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 428                                 rp, rp_size);
 429         kfree(rp);
 430
 431         return err;
 432 }
 433
 434 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 435                            u16 data_len)
 436 {
 437         struct mgmt_rp_read_index_list *rp;
 438         struct hci_dev *d;
 439         size_t rp_len;
 440         u16 count;
 441         int err;
 442
 443         bt_dev_dbg(hdev, "sock %p", sk);
 444
 445         read_lock(&hci_dev_list_lock);
 446
 447         count = 0;
 448         list_for_each_entry(d, &hci_dev_list, list) {
 449                 if (d->dev_type == HCI_PRIMARY &&
 450                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 451                         count++;
 452         }
 453
 454         rp_len = sizeof(*rp) + (2 * count);
 455         rp = kmalloc(rp_len, GFP_ATOMIC);
 456         if (!rp) {
 457                 read_unlock(&hci_dev_list_lock);
 458                 return -ENOMEM;
 459         }
 460
 461         count = 0;
 462         list_for_each_entry(d, &hci_dev_list, list) {
 463                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 464                     hci_dev_test_flag(d, HCI_CONFIG) ||
 465                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 466                         continue;
 467
 468                 /* Devices marked as raw-only are neither configured
 469                  * nor unconfigured controllers.
 470                  */
 471                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 472                         continue;
 473
 474                 if (d->dev_type == HCI_PRIMARY &&
 475                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 476                         rp->index[count++] = cpu_to_le16(d->id);
 477                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 478                 }
 479         }
 480
 481         rp->num_controllers = cpu_to_le16(count);
 482         rp_len = sizeof(*rp) + (2 * count);
 483
 484         read_unlock(&hci_dev_list_lock);
 485
 486         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 487                                 0, rp, rp_len);
 488
 489         kfree(rp);
 490
 491         return err;
 492 }
 493
 494 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 495                                   void *data, u16 data_len)
 496 {
 497         struct mgmt_rp_read_unconf_index_list *rp;
 498         struct hci_dev *d;
 499         size_t rp_len;
 500         u16 count;
 501         int err;
 502
 503         bt_dev_dbg(hdev, "sock %p", sk);
 504
 505         read_lock(&hci_dev_list_lock);
 506
 507         count = 0;
 508         list_for_each_entry(d, &hci_dev_list, list) {
 509                 if (d->dev_type == HCI_PRIMARY &&
 510                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 511                         count++;
 512         }
 513
 514         rp_len = sizeof(*rp) + (2 * count);
 515         rp = kmalloc(rp_len, GFP_ATOMIC);
 516         if (!rp) {
 517                 read_unlock(&hci_dev_list_lock);
 518                 return -ENOMEM;
 519         }
 520
 521         count = 0;
 522         list_for_each_entry(d, &hci_dev_list, list) {
 523                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 524                     hci_dev_test_flag(d, HCI_CONFIG) ||
 525                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 526                         continue;
 527
 528                 /* Devices marked as raw-only are neither configured
 529                  * nor unconfigured controllers.
 530                  */
 531                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 532                         continue;
 533
 534                 if (d->dev_type == HCI_PRIMARY &&
 535                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 536                         rp->index[count++] = cpu_to_le16(d->id);
 537                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 538                 }
 539         }
 540
 541         rp->num_controllers = cpu_to_le16(count);
 542         rp_len = sizeof(*rp) + (2 * count);
 543
 544         read_unlock(&hci_dev_list_lock);
 545
 546         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 547                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 548
 549         kfree(rp);
 550
 551         return err;
 552 }
 553
 554 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 555                                void *data, u16 data_len)
 556 {
 557         struct mgmt_rp_read_ext_index_list *rp;
 558         struct hci_dev *d;
 559         u16 count;
 560         int err;
 561
 562         bt_dev_dbg(hdev, "sock %p", sk);
 563
 564         read_lock(&hci_dev_list_lock);
 565
 566         count = 0;
 567         list_for_each_entry(d, &hci_dev_list, list) {
 568                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 569                         count++;
 570         }
 571
 572         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 573         if (!rp) {
 574                 read_unlock(&hci_dev_list_lock);
 575                 return -ENOMEM;
 576         }
 577
 578         count = 0;
 579         list_for_each_entry(d, &hci_dev_list, list) {
 580                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 581                     hci_dev_test_flag(d, HCI_CONFIG) ||
 582                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 583                         continue;
 584
 585                 /* Devices marked as raw-only are neither configured
 586                  * nor unconfigured controllers.
 587                  */
 588                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 589                         continue;
 590
 591                 if (d->dev_type == HCI_PRIMARY) {
 592                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 593                                 rp->entry[count].type = 0x01;
 594                         else
 595                                 rp->entry[count].type = 0x00;
 596                 } else if (d->dev_type == HCI_AMP) {
 597                         rp->entry[count].type = 0x02;
 598                 } else {
 599                         continue;
 600                 }
 601
 602                 rp->entry[count].bus = d->bus;
 603                 rp->entry[count++].index = cpu_to_le16(d->id);
 604                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 605         }
 606
 607         rp->num_controllers = cpu_to_le16(count);
 608
 609         read_unlock(&hci_dev_list_lock);
 610
 611         /* If this command is called at least once, then all the
 612          * default index and unconfigured index events are disabled
 613          * and from now on only extended index events are used.
 614          */
 615         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 616         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 617         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 618
 619         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 620                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 621                                 struct_size(rp, entry, count));
 622
 623         kfree(rp);
 624
 625         return err;
 626 }
 627
 628 static bool is_configured(struct hci_dev *hdev)
 629 {
 630         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 631             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 632                 return false;
 633
 634         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 635              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 636             !bacmp(&hdev->public_addr, BDADDR_ANY))
 637                 return false;
 638
 639         return true;
 640 }
 641
 642 static __le32 get_missing_options(struct hci_dev *hdev)
 643 {
 644         u32 options = 0;
 645
 646         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 647             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 648                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 649
 650         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 651              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 652             !bacmp(&hdev->public_addr, BDADDR_ANY))
 653                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 654
 655         return cpu_to_le32(options);
 656 }
 657
 658 static int new_options(struct hci_dev *hdev, struct sock *skip)
 659 {
 660         __le32 options = get_missing_options(hdev);
 661
 662         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 663                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 664 }
 665
 666 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 667 {
 668         __le32 options = get_missing_options(hdev);
 669
 670         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 671                                  sizeof(options));
 672 }
 673
 674 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 675                             void *data, u16 data_len)
 676 {
 677         struct mgmt_rp_read_config_info rp;
 678         u32 options = 0;
 679
 680         bt_dev_dbg(hdev, "sock %p", sk);
 681
 682         hci_dev_lock(hdev);
 683
 684         memset(&rp, 0, sizeof(rp));
 685         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 686
 687         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 688                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 689
 690         if (hdev->set_bdaddr)
 691                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 692
 693         rp.supported_options = cpu_to_le32(options);
 694         rp.missing_options = get_missing_options(hdev);
 695
 696         hci_dev_unlock(hdev);
 697
 698         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 699                                  &rp, sizeof(rp));
 700 }
 701
 702 static u32 get_supported_phys(struct hci_dev *hdev)
 703 {
 704         u32 supported_phys = 0;
 705
 706         if (lmp_bredr_capable(hdev)) {
 707                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 708
 709                 if (hdev->features[0][0] & LMP_3SLOT)
 710                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 711
 712                 if (hdev->features[0][0] & LMP_5SLOT)
 713                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 714
 715                 if (lmp_edr_2m_capable(hdev)) {
 716                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 717
 718                         if (lmp_edr_3slot_capable(hdev))
 719                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 720
 721                         if (lmp_edr_5slot_capable(hdev))
 722                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 723
 724                         if (lmp_edr_3m_capable(hdev)) {
 725                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 726
 727                                 if (lmp_edr_3slot_capable(hdev))
 728                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 729
 730                                 if (lmp_edr_5slot_capable(hdev))
 731                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 732                         }
 733                 }
 734         }
 735
 736         if (lmp_le_capable(hdev)) {
 737                 supported_phys |= MGMT_PHY_LE_1M_TX;
 738                 supported_phys |= MGMT_PHY_LE_1M_RX;
 739
 740                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 741                         supported_phys |= MGMT_PHY_LE_2M_TX;
 742                         supported_phys |= MGMT_PHY_LE_2M_RX;
 743                 }
 744
 745                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 746                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 747                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 748                 }
 749         }
 750
 751         return supported_phys;
 752 }
 753
 754 static u32 get_selected_phys(struct hci_dev *hdev)
 755 {
 756         u32 selected_phys = 0;
 757
 758         if (lmp_bredr_capable(hdev)) {
 759                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 760
 761                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 762                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 763
 764                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 765                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 766
 767                 if (lmp_edr_2m_capable(hdev)) {
 768                         if (!(hdev->pkt_type & HCI_2DH1))
 769                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 770
 771                         if (lmp_edr_3slot_capable(hdev) &&
 772                             !(hdev->pkt_type & HCI_2DH3))
 773                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 774
 775                         if (lmp_edr_5slot_capable(hdev) &&
 776                             !(hdev->pkt_type & HCI_2DH5))
 777                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 778
 779                         if (lmp_edr_3m_capable(hdev)) {
 780                                 if (!(hdev->pkt_type & HCI_3DH1))
 781                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 782
 783                                 if (lmp_edr_3slot_capable(hdev) &&
 784                                     !(hdev->pkt_type & HCI_3DH3))
 785                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 786
 787                                 if (lmp_edr_5slot_capable(hdev) &&
 788                                     !(hdev->pkt_type & HCI_3DH5))
 789                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 790                         }
 791                 }
 792         }
 793
 794         if (lmp_le_capable(hdev)) {
 795                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 796                         selected_phys |= MGMT_PHY_LE_1M_TX;
 797
 798                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 799                         selected_phys |= MGMT_PHY_LE_1M_RX;
 800
 801                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 802                         selected_phys |= MGMT_PHY_LE_2M_TX;
 803
 804                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 805                         selected_phys |= MGMT_PHY_LE_2M_RX;
 806
 807                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 808                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 809
 810                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 811                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 812         }
 813
 814         return selected_phys;
 815 }
 816
 817 static u32 get_configurable_phys(struct hci_dev *hdev)
 818 {
 819         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 820                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 821 }
 822
 823 static u32 get_supported_settings(struct hci_dev *hdev)
 824 {
 825         u32 settings = 0;
 826
 827         settings |= MGMT_SETTING_POWERED;
 828         settings |= MGMT_SETTING_BONDABLE;
 829         settings |= MGMT_SETTING_DEBUG_KEYS;
 830         settings |= MGMT_SETTING_CONNECTABLE;
 831         settings |= MGMT_SETTING_DISCOVERABLE;
 832
 833         if (lmp_bredr_capable(hdev)) {
 834                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 835                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 836                 settings |= MGMT_SETTING_BREDR;
 837                 settings |= MGMT_SETTING_LINK_SECURITY;
 838
 839                 if (lmp_ssp_capable(hdev)) {
 840                         settings |= MGMT_SETTING_SSP;
 841                         if (IS_ENABLED(CONFIG_BT_HS))
 842                                 settings |= MGMT_SETTING_HS;
 843                 }
 844
 845                 if (lmp_sc_capable(hdev))
 846                         settings |= MGMT_SETTING_SECURE_CONN;
 847
 848                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 849                              &hdev->quirks))
 850                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 851         }
 852
 853         if (lmp_le_capable(hdev)) {
 854                 settings |= MGMT_SETTING_LE;
 855                 settings |= MGMT_SETTING_SECURE_CONN;
 856                 settings |= MGMT_SETTING_PRIVACY;
 857                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 858                 settings |= MGMT_SETTING_ADVERTISING;
 859         }
 860
 861         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 862             hdev->set_bdaddr)
 863                 settings |= MGMT_SETTING_CONFIGURATION;
 864
 865         if (cis_central_capable(hdev))
 866                 settings |= MGMT_SETTING_CIS_CENTRAL;
 867
 868         if (cis_peripheral_capable(hdev))
 869                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 870
 871         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 872
 873         return settings;
 874 }
 875
 876 static u32 get_current_settings(struct hci_dev *hdev)
 877 {
 878         u32 settings = 0;
 879
 880         if (hdev_is_powered(hdev))
 881                 settings |= MGMT_SETTING_POWERED;
 882
 883         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 884                 settings |= MGMT_SETTING_CONNECTABLE;
 885
 886         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 887                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 888
 889         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 890                 settings |= MGMT_SETTING_DISCOVERABLE;
 891
 892         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 893                 settings |= MGMT_SETTING_BONDABLE;
 894
 895         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 896                 settings |= MGMT_SETTING_BREDR;
 897
 898         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 899                 settings |= MGMT_SETTING_LE;
 900
 901         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 902                 settings |= MGMT_SETTING_LINK_SECURITY;
 903
 904         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 905                 settings |= MGMT_SETTING_SSP;
 906
 907         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 908                 settings |= MGMT_SETTING_HS;
 909
 910         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 911                 settings |= MGMT_SETTING_ADVERTISING;
 912
 913         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 914                 settings |= MGMT_SETTING_SECURE_CONN;
 915
 916         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 917                 settings |= MGMT_SETTING_DEBUG_KEYS;
 918
 919         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 920                 settings |= MGMT_SETTING_PRIVACY;
 921
 922         /* The current setting for static address has two purposes. The
 923          * first is to indicate if the static address will be used and
 924          * the second is to indicate if it is actually set.
 925          *
 926          * This means if the static address is not configured, this flag
 927          * will never be set. If the address is configured, then if the
 928          * address is actually used decides if the flag is set or not.
 929          *
 930          * For single mode LE only controllers and dual-mode controllers
 931          * with BR/EDR disabled, the existence of the static address will
 932          * be evaluated.
 933          */
 934         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 935             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 936             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 937                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 938                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 939         }
 940
 941         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 942                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 943
 944         if (cis_central_capable(hdev))
 945                 settings |= MGMT_SETTING_CIS_CENTRAL;
 946
 947         if (cis_peripheral_capable(hdev))
 948                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 949
 950         return settings;
 951 }
 952
 953 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 954 {
 955         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 956 }
 957
 958 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 959 {
 960         struct mgmt_pending_cmd *cmd;
 961
 962         /* If there's a pending mgmt command the flags will not yet have
 963          * their final values, so check for this first.
 964          */
 965         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 966         if (cmd) {
 967                 struct mgmt_mode *cp = cmd->param;
 968                 if (cp->val == 0x01)
 969                         return LE_AD_GENERAL;
 970                 else if (cp->val == 0x02)
 971                         return LE_AD_LIMITED;
 972         } else {
 973                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 974                         return LE_AD_LIMITED;
 975                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 976                         return LE_AD_GENERAL;
 977         }
 978
 979         return 0;
 980 }
 981
 982 bool mgmt_get_connectable(struct hci_dev *hdev)
 983 {
 984         struct mgmt_pending_cmd *cmd;
 985
 986         /* If there's a pending mgmt command the flag will not yet have
 987          * it's final value, so check for this first.
 988          */
 989         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 990         if (cmd) {
 991                 struct mgmt_mode *cp = cmd->param;
 992
 993                 return cp->val;
 994         }
 995
 996         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 997 }
 998
 999 static int service_cache_sync(struct hci_dev *hdev, void *data)
1000 {
1001         hci_update_eir_sync(hdev);
1002         hci_update_class_sync(hdev);
1003
1004         return 0;
1005 }
1006
1007 static void service_cache_off(struct work_struct *work)
1008 {
1009         struct hci_dev *hdev = container_of(work, struct hci_dev,
1010                                             service_cache.work);
1011
1012         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1013                 return;
1014
1015         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1016 }
1017
1018 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1019 {
1020         /* The generation of a new RPA and programming it into the
1021          * controller happens in the hci_req_enable_advertising()
1022          * function.
1023          */
1024         if (ext_adv_capable(hdev))
1025                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1026         else
1027                 return hci_enable_advertising_sync(hdev);
1028 }
1029
1030 static void rpa_expired(struct work_struct *work)
1031 {
1032         struct hci_dev *hdev = container_of(work, struct hci_dev,
1033                                             rpa_expired.work);
1034
1035         bt_dev_dbg(hdev, "");
1036
1037         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1038
1039         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1040                 return;
1041
1042         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1043 }
1044
1045 static void discov_off(struct work_struct *work)
1046 {
1047         struct hci_dev *hdev = container_of(work, struct hci_dev,
1048                                             discov_off.work);
1049
1050         bt_dev_dbg(hdev, "");
1051
1052         hci_dev_lock(hdev);
1053
1054         /* When discoverable timeout triggers, then just make sure
1055          * the limited discoverable flag is cleared. Even in the case
1056          * of a timeout triggered from general discoverable, it is
1057          * safe to unconditionally clear the flag.
1058          */
1059         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1060         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1061         hdev->discov_timeout = 0;
1062
1063         hci_update_discoverable(hdev);
1064
1065         mgmt_new_settings(hdev);
1066
1067         hci_dev_unlock(hdev);
1068 }
1069
1070 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1071
1072 static void mesh_send_complete(struct hci_dev *hdev,
1073                                struct mgmt_mesh_tx *mesh_tx, bool silent)
1074 {
1075         u8 handle = mesh_tx->handle;
1076
1077         if (!silent)
1078                 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1079                            sizeof(handle), NULL);
1080
1081         mgmt_mesh_remove(mesh_tx);
1082 }
1083
1084 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1085 {
1086         struct mgmt_mesh_tx *mesh_tx;
1087
1088         hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1089         hci_disable_advertising_sync(hdev);
1090         mesh_tx = mgmt_mesh_next(hdev, NULL);
1091
1092         if (mesh_tx)
1093                 mesh_send_complete(hdev, mesh_tx, false);
1094
1095         return 0;
1096 }
1097
1098 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1099 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1100 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1101 {
1102         struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1103
1104         if (!mesh_tx)
1105                 return;
1106
1107         err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1108                                  mesh_send_start_complete);
1109
1110         if (err < 0)
1111                 mesh_send_complete(hdev, mesh_tx, false);
1112         else
1113                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1114 }
1115
1116 static void mesh_send_done(struct work_struct *work)
1117 {
1118         struct hci_dev *hdev = container_of(work, struct hci_dev,
1119                                             mesh_send_done.work);
1120
1121         if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1122                 return;
1123
1124         hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1125 }
1126
1127 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1128 {
1129         if (hci_dev_test_flag(hdev, HCI_MGMT))
1130                 return;
1131
1132         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1133
1134         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1135         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1136         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1137         INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1138
1139         /* Non-mgmt controlled devices get this bit set
1140          * implicitly so that pairing works for them, however
1141          * for mgmt we require user-space to explicitly enable
1142          * it
1143          */
1144         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1145
1146         hci_dev_set_flag(hdev, HCI_MGMT);
1147 }
1148
1149 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1150                                 void *data, u16 data_len)
1151 {
1152         struct mgmt_rp_read_info rp;
1153
1154         bt_dev_dbg(hdev, "sock %p", sk);
1155
1156         hci_dev_lock(hdev);
1157
1158         memset(&rp, 0, sizeof(rp));
1159
1160         bacpy(&rp.bdaddr, &hdev->bdaddr);
1161
1162         rp.version = hdev->hci_ver;
1163         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1164
1165         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1166         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1167
1168         memcpy(rp.dev_class, hdev->dev_class, 3);
1169
1170         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1171         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1172
1173         hci_dev_unlock(hdev);
1174
1175         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1176                                  sizeof(rp));
1177 }
1178
1179 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1180 {
1181         u16 eir_len = 0;
1182         size_t name_len;
1183
1184         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1185                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1186                                           hdev->dev_class, 3);
1187
1188         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1189                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1190                                           hdev->appearance);
1191
1192         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1193         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1194                                   hdev->dev_name, name_len);
1195
1196         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1197         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1198                                   hdev->short_name, name_len);
1199
1200         return eir_len;
1201 }
1202
1203 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1204                                     void *data, u16 data_len)
1205 {
1206         char buf[512];
1207         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1208         u16 eir_len;
1209
1210         bt_dev_dbg(hdev, "sock %p", sk);
1211
1212         memset(&buf, 0, sizeof(buf));
1213
1214         hci_dev_lock(hdev);
1215
1216         bacpy(&rp->bdaddr, &hdev->bdaddr);
1217
1218         rp->version = hdev->hci_ver;
1219         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1220
1221         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1222         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1223
1224
1225         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1226         rp->eir_len = cpu_to_le16(eir_len);
1227
1228         hci_dev_unlock(hdev);
1229
1230         /* If this command is called at least once, then the events
1231          * for class of device and local name changes are disabled
1232          * and only the new extended controller information event
1233          * is used.
1234          */
1235         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1236         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1237         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1238
1239         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1240                                  sizeof(*rp) + eir_len);
1241 }
1242
1243 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1244 {
1245         char buf[512];
1246         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1247         u16 eir_len;
1248
1249         memset(buf, 0, sizeof(buf));
1250
1251         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1252         ev->eir_len = cpu_to_le16(eir_len);
1253
1254         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1255                                   sizeof(*ev) + eir_len,
1256                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1257 }
1258
1259 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1260 {
1261         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1262
1263         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1264                                  sizeof(settings));
1265 }
1266
1267 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1268 {
1269         struct mgmt_ev_advertising_added ev;
1270
1271         ev.instance = instance;
1272
1273         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1274 }
1275
1276 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1277                               u8 instance)
1278 {
1279         struct mgmt_ev_advertising_removed ev;
1280
1281         ev.instance = instance;
1282
1283         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1284 }
1285
1286 static void cancel_adv_timeout(struct hci_dev *hdev)
1287 {
1288         if (hdev->adv_instance_timeout) {
1289                 hdev->adv_instance_timeout = 0;
1290                 cancel_delayed_work(&hdev->adv_instance_expire);
1291         }
1292 }
1293
1294 /* This function requires the caller holds hdev->lock */
1295 static void restart_le_actions(struct hci_dev *hdev)
1296 {
1297         struct hci_conn_params *p;
1298
1299         list_for_each_entry(p, &hdev->le_conn_params, list) {
1300                 /* Needed for AUTO_OFF case where might not "really"
1301                  * have been powered off.
1302                  */
1303                 list_del_init(&p->action);
1304
1305                 switch (p->auto_connect) {
1306                 case HCI_AUTO_CONN_DIRECT:
1307                 case HCI_AUTO_CONN_ALWAYS:
1308                         list_add(&p->action, &hdev->pend_le_conns);
1309                         break;
1310                 case HCI_AUTO_CONN_REPORT:
1311                         list_add(&p->action, &hdev->pend_le_reports);
1312                         break;
1313                 default:
1314                         break;
1315                 }
1316         }
1317 }
1318
1319 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1320 {
1321         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1322
1323         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1324                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1325 }
1326
1327 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1328 {
1329         struct mgmt_pending_cmd *cmd = data;
1330         struct mgmt_mode *cp;
1331
1332         /* Make sure cmd still outstanding. */
1333         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1334                 return;
1335
1336         cp = cmd->param;
1337
1338         bt_dev_dbg(hdev, "err %d", err);
1339
1340         if (!err) {
1341                 if (cp->val) {
1342                         hci_dev_lock(hdev);
1343                         restart_le_actions(hdev);
1344                         hci_update_passive_scan(hdev);
1345                         hci_dev_unlock(hdev);
1346                 }
1347
1348                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1349
1350                 /* Only call new_setting for power on as power off is deferred
1351                  * to hdev->power_off work which does call hci_dev_do_close.
1352                  */
1353                 if (cp->val)
1354                         new_settings(hdev, cmd->sk);
1355         } else {
1356                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1357                                 mgmt_status(err));
1358         }
1359
1360         mgmt_pending_remove(cmd);
1361 }
1362
1363 static int set_powered_sync(struct hci_dev *hdev, void *data)
1364 {
1365         struct mgmt_pending_cmd *cmd = data;
1366         struct mgmt_mode *cp = cmd->param;
1367
1368         BT_DBG("%s", hdev->name);
1369
1370         return hci_set_powered_sync(hdev, cp->val);
1371 }
1372
1373 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1374                        u16 len)
1375 {
1376         struct mgmt_mode *cp = data;
1377         struct mgmt_pending_cmd *cmd;
1378         int err;
1379
1380         bt_dev_dbg(hdev, "sock %p", sk);
1381
1382         if (cp->val != 0x00 && cp->val != 0x01)
1383                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1384                                        MGMT_STATUS_INVALID_PARAMS);
1385
1386         hci_dev_lock(hdev);
1387
1388         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1389                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1390                                       MGMT_STATUS_BUSY);
1391                 goto failed;
1392         }
1393
1394         if (!!cp->val == hdev_is_powered(hdev)) {
1395                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1396                 goto failed;
1397         }
1398
1399         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1400         if (!cmd) {
1401                 err = -ENOMEM;
1402                 goto failed;
1403         }
1404
1405         err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1406                                  mgmt_set_powered_complete);
1407
1408         if (err < 0)
1409                 mgmt_pending_remove(cmd);
1410
1411 failed:
1412         hci_dev_unlock(hdev);
1413         return err;
1414 }
1415
1416 int mgmt_new_settings(struct hci_dev *hdev)
1417 {
1418         return new_settings(hdev, NULL);
1419 }
1420
1421 struct cmd_lookup {
1422         struct sock *sk;
1423         struct hci_dev *hdev;
1424         u8 mgmt_status;
1425 };
1426
1427 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1428 {
1429         struct cmd_lookup *match = data;
1430
1431         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1432
1433         list_del(&cmd->list);
1434
1435         if (match->sk == NULL) {
1436                 match->sk = cmd->sk;
1437                 sock_hold(match->sk);
1438         }
1439
1440         mgmt_pending_free(cmd);
1441 }
1442
1443 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1444 {
1445         u8 *status = data;
1446
1447         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1448         mgmt_pending_remove(cmd);
1449 }
1450
1451 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1452 {
1453         if (cmd->cmd_complete) {
1454                 u8 *status = data;
1455
1456                 cmd->cmd_complete(cmd, *status);
1457                 mgmt_pending_remove(cmd);
1458
1459                 return;
1460         }
1461
1462         cmd_status_rsp(cmd, data);
1463 }
1464
1465 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1466 {
1467         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1468                                  cmd->param, cmd->param_len);
1469 }
1470
1471 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1472 {
1473         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1474                                  cmd->param, sizeof(struct mgmt_addr_info));
1475 }
1476
1477 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1478 {
1479         if (!lmp_bredr_capable(hdev))
1480                 return MGMT_STATUS_NOT_SUPPORTED;
1481         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1482                 return MGMT_STATUS_REJECTED;
1483         else
1484                 return MGMT_STATUS_SUCCESS;
1485 }
1486
1487 static u8 mgmt_le_support(struct hci_dev *hdev)
1488 {
1489         if (!lmp_le_capable(hdev))
1490                 return MGMT_STATUS_NOT_SUPPORTED;
1491         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1492                 return MGMT_STATUS_REJECTED;
1493         else
1494                 return MGMT_STATUS_SUCCESS;
1495 }
1496
1497 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1498                                            int err)
1499 {
1500         struct mgmt_pending_cmd *cmd = data;
1501
1502         bt_dev_dbg(hdev, "err %d", err);
1503
1504         /* Make sure cmd still outstanding. */
1505         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1506                 return;
1507
1508         hci_dev_lock(hdev);
1509
1510         if (err) {
1511                 u8 mgmt_err = mgmt_status(err);
1512                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1513                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1514                 goto done;
1515         }
1516
1517         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1518             hdev->discov_timeout > 0) {
1519                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1520                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1521         }
1522
1523         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1524         new_settings(hdev, cmd->sk);
1525
1526 done:
1527         mgmt_pending_remove(cmd);
1528         hci_dev_unlock(hdev);
1529 }
1530
1531 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1532 {
1533         BT_DBG("%s", hdev->name);
1534
1535         return hci_update_discoverable_sync(hdev);
1536 }
1537
1538 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1539                             u16 len)
1540 {
1541         struct mgmt_cp_set_discoverable *cp = data;
1542         struct mgmt_pending_cmd *cmd;
1543         u16 timeout;
1544         int err;
1545
1546         bt_dev_dbg(hdev, "sock %p", sk);
1547
1548         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1549             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1550                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1551                                        MGMT_STATUS_REJECTED);
1552
1553         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1554                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1555                                        MGMT_STATUS_INVALID_PARAMS);
1556
1557         timeout = __le16_to_cpu(cp->timeout);
1558
1559         /* Disabling discoverable requires that no timeout is set,
1560          * and enabling limited discoverable requires a timeout.
1561          */
1562         if ((cp->val == 0x00 && timeout > 0) ||
1563             (cp->val == 0x02 && timeout == 0))
1564                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1565                                        MGMT_STATUS_INVALID_PARAMS);
1566
1567         hci_dev_lock(hdev);
1568
1569         if (!hdev_is_powered(hdev) && timeout > 0) {
1570                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1571                                       MGMT_STATUS_NOT_POWERED);
1572                 goto failed;
1573         }
1574
1575         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1576             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1577                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1578                                       MGMT_STATUS_BUSY);
1579                 goto failed;
1580         }
1581
1582         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1583                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1584                                       MGMT_STATUS_REJECTED);
1585                 goto failed;
1586         }
1587
1588         if (hdev->advertising_paused) {
1589                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1590                                       MGMT_STATUS_BUSY);
1591                 goto failed;
1592         }
1593
1594         if (!hdev_is_powered(hdev)) {
1595                 bool changed = false;
1596
1597                 /* Setting limited discoverable when powered off is
1598                  * not a valid operation since it requires a timeout
1599                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1600                  */
1601                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1602                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1603                         changed = true;
1604                 }
1605
1606                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1607                 if (err < 0)
1608                         goto failed;
1609
1610                 if (changed)
1611                         err = new_settings(hdev, sk);
1612
1613                 goto failed;
1614         }
1615
1616         /* If the current mode is the same, then just update the timeout
1617          * value with the new value. And if only the timeout gets updated,
1618          * then no need for any HCI transactions.
1619          */
1620         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1621             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1622                                                    HCI_LIMITED_DISCOVERABLE)) {
1623                 cancel_delayed_work(&hdev->discov_off);
1624                 hdev->discov_timeout = timeout;
1625
1626                 if (cp->val && hdev->discov_timeout > 0) {
1627                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1628                         queue_delayed_work(hdev->req_workqueue,
1629                                            &hdev->discov_off, to);
1630                 }
1631
1632                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1633                 goto failed;
1634         }
1635
1636         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1637         if (!cmd) {
1638                 err = -ENOMEM;
1639                 goto failed;
1640         }
1641
1642         /* Cancel any potential discoverable timeout that might be
1643          * still active and store new timeout value. The arming of
1644          * the timeout happens in the complete handler.
1645          */
1646         cancel_delayed_work(&hdev->discov_off);
1647         hdev->discov_timeout = timeout;
1648
1649         if (cp->val)
1650                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1651         else
1652                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1653
1654         /* Limited discoverable mode */
1655         if (cp->val == 0x02)
1656                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1657         else
1658                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1659
1660         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1661                                  mgmt_set_discoverable_complete);
1662
1663         if (err < 0)
1664                 mgmt_pending_remove(cmd);
1665
1666 failed:
1667         hci_dev_unlock(hdev);
1668         return err;
1669 }
1670
1671 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1672                                           int err)
1673 {
1674         struct mgmt_pending_cmd *cmd = data;
1675
1676         bt_dev_dbg(hdev, "err %d", err);
1677
1678         /* Make sure cmd still outstanding. */
1679         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1680                 return;
1681
1682         hci_dev_lock(hdev);
1683
1684         if (err) {
1685                 u8 mgmt_err = mgmt_status(err);
1686                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1687                 goto done;
1688         }
1689
1690         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1691         new_settings(hdev, cmd->sk);
1692
1693 done:
1694         if (cmd)
1695                 mgmt_pending_remove(cmd);
1696
1697         hci_dev_unlock(hdev);
1698 }
1699
1700 static int set_connectable_update_settings(struct hci_dev *hdev,
1701                                            struct sock *sk, u8 val)
1702 {
1703         bool changed = false;
1704         int err;
1705
1706         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1707                 changed = true;
1708
1709         if (val) {
1710                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1711         } else {
1712                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1713                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1714         }
1715
1716         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1717         if (err < 0)
1718                 return err;
1719
1720         if (changed) {
1721                 hci_update_scan(hdev);
1722                 hci_update_passive_scan(hdev);
1723                 return new_settings(hdev, sk);
1724         }
1725
1726         return 0;
1727 }
1728
1729 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1730 {
1731         BT_DBG("%s", hdev->name);
1732
1733         return hci_update_connectable_sync(hdev);
1734 }
1735
1736 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1737                            u16 len)
1738 {
1739         struct mgmt_mode *cp = data;
1740         struct mgmt_pending_cmd *cmd;
1741         int err;
1742
1743         bt_dev_dbg(hdev, "sock %p", sk);
1744
1745         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1746             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1747                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1748                                        MGMT_STATUS_REJECTED);
1749
1750         if (cp->val != 0x00 && cp->val != 0x01)
1751                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1752                                        MGMT_STATUS_INVALID_PARAMS);
1753
1754         hci_dev_lock(hdev);
1755
1756         if (!hdev_is_powered(hdev)) {
1757                 err = set_connectable_update_settings(hdev, sk, cp->val);
1758                 goto failed;
1759         }
1760
1761         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1762             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1763                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1764                                       MGMT_STATUS_BUSY);
1765                 goto failed;
1766         }
1767
1768         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1769         if (!cmd) {
1770                 err = -ENOMEM;
1771                 goto failed;
1772         }
1773
1774         if (cp->val) {
1775                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1776         } else {
1777                 if (hdev->discov_timeout > 0)
1778                         cancel_delayed_work(&hdev->discov_off);
1779
1780                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1781                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1782                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1783         }
1784
1785         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1786                                  mgmt_set_connectable_complete);
1787
1788         if (err < 0)
1789                 mgmt_pending_remove(cmd);
1790
1791 failed:
1792         hci_dev_unlock(hdev);
1793         return err;
1794 }
1795
1796 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1797                         u16 len)
1798 {
1799         struct mgmt_mode *cp = data;
1800         bool changed;
1801         int err;
1802
1803         bt_dev_dbg(hdev, "sock %p", sk);
1804
1805         if (cp->val != 0x00 && cp->val != 0x01)
1806                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1807                                        MGMT_STATUS_INVALID_PARAMS);
1808
1809         hci_dev_lock(hdev);
1810
1811         if (cp->val)
1812                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1813         else
1814                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1815
1816         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1817         if (err < 0)
1818                 goto unlock;
1819
1820         if (changed) {
1821                 /* In limited privacy mode the change of bondable mode
1822                  * may affect the local advertising address.
1823                  */
1824                 hci_update_discoverable(hdev);
1825
1826                 err = new_settings(hdev, sk);
1827         }
1828
1829 unlock:
1830         hci_dev_unlock(hdev);
1831         return err;
1832 }
1833
1834 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1835                              u16 len)
1836 {
1837         struct mgmt_mode *cp = data;
1838         struct mgmt_pending_cmd *cmd;
1839         u8 val, status;
1840         int err;
1841
1842         bt_dev_dbg(hdev, "sock %p", sk);
1843
1844         status = mgmt_bredr_support(hdev);
1845         if (status)
1846                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1847                                        status);
1848
1849         if (cp->val != 0x00 && cp->val != 0x01)
1850                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1851                                        MGMT_STATUS_INVALID_PARAMS);
1852
1853         hci_dev_lock(hdev);
1854
1855         if (!hdev_is_powered(hdev)) {
1856                 bool changed = false;
1857
1858                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1859                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1860                         changed = true;
1861                 }
1862
1863                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1864                 if (err < 0)
1865                         goto failed;
1866
1867                 if (changed)
1868                         err = new_settings(hdev, sk);
1869
1870                 goto failed;
1871         }
1872
1873         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1874                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1875                                       MGMT_STATUS_BUSY);
1876                 goto failed;
1877         }
1878
1879         val = !!cp->val;
1880
1881         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1882                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1883                 goto failed;
1884         }
1885
1886         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1887         if (!cmd) {
1888                 err = -ENOMEM;
1889                 goto failed;
1890         }
1891
1892         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1893         if (err < 0) {
1894                 mgmt_pending_remove(cmd);
1895                 goto failed;
1896         }
1897
1898 failed:
1899         hci_dev_unlock(hdev);
1900         return err;
1901 }
1902
1903 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1904 {
1905         struct cmd_lookup match = { NULL, hdev };
1906         struct mgmt_pending_cmd *cmd = data;
1907         struct mgmt_mode *cp = cmd->param;
1908         u8 enable = cp->val;
1909         bool changed;
1910
1911         /* Make sure cmd still outstanding. */
1912         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1913                 return;
1914
1915         if (err) {
1916                 u8 mgmt_err = mgmt_status(err);
1917
1918                 if (enable && hci_dev_test_and_clear_flag(hdev,
1919                                                           HCI_SSP_ENABLED)) {
1920                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1921                         new_settings(hdev, NULL);
1922                 }
1923
1924                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1925                                      &mgmt_err);
1926                 return;
1927         }
1928
1929         if (enable) {
1930                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1931         } else {
1932                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1933
1934                 if (!changed)
1935                         changed = hci_dev_test_and_clear_flag(hdev,
1936                                                               HCI_HS_ENABLED);
1937                 else
1938                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1939         }
1940
1941         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1942
1943         if (changed)
1944                 new_settings(hdev, match.sk);
1945
1946         if (match.sk)
1947                 sock_put(match.sk);
1948
1949         hci_update_eir_sync(hdev);
1950 }
1951
1952 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1953 {
1954         struct mgmt_pending_cmd *cmd = data;
1955         struct mgmt_mode *cp = cmd->param;
1956         bool changed = false;
1957         int err;
1958
1959         if (cp->val)
1960                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1961
1962         err = hci_write_ssp_mode_sync(hdev, cp->val);
1963
1964         if (!err && changed)
1965                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1966
1967         return err;
1968 }
1969
1970 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1971 {
1972         struct mgmt_mode *cp = data;
1973         struct mgmt_pending_cmd *cmd;
1974         u8 status;
1975         int err;
1976
1977         bt_dev_dbg(hdev, "sock %p", sk);
1978
1979         status = mgmt_bredr_support(hdev);
1980         if (status)
1981                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1982
1983         if (!lmp_ssp_capable(hdev))
1984                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1985                                        MGMT_STATUS_NOT_SUPPORTED);
1986
1987         if (cp->val != 0x00 && cp->val != 0x01)
1988                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1989                                        MGMT_STATUS_INVALID_PARAMS);
1990
1991         hci_dev_lock(hdev);
1992
1993         if (!hdev_is_powered(hdev)) {
1994                 bool changed;
1995
1996                 if (cp->val) {
1997                         changed = !hci_dev_test_and_set_flag(hdev,
1998                                                              HCI_SSP_ENABLED);
1999                 } else {
2000                         changed = hci_dev_test_and_clear_flag(hdev,
2001                                                               HCI_SSP_ENABLED);
2002                         if (!changed)
2003                                 changed = hci_dev_test_and_clear_flag(hdev,
2004                                                                       HCI_HS_ENABLED);
2005                         else
2006                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2007                 }
2008
2009                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2010                 if (err < 0)
2011                         goto failed;
2012
2013                 if (changed)
2014                         err = new_settings(hdev, sk);
2015
2016                 goto failed;
2017         }
2018
2019         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2020                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2021                                       MGMT_STATUS_BUSY);
2022                 goto failed;
2023         }
2024
2025         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2026                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2027                 goto failed;
2028         }
2029
2030         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2031         if (!cmd)
2032                 err = -ENOMEM;
2033         else
2034                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2035                                          set_ssp_complete);
2036
2037         if (err < 0) {
2038                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2039                                       MGMT_STATUS_FAILED);
2040
2041                 if (cmd)
2042                         mgmt_pending_remove(cmd);
2043         }
2044
2045 failed:
2046         hci_dev_unlock(hdev);
2047         return err;
2048 }
2049
2050 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2051 {
2052         struct mgmt_mode *cp = data;
2053         bool changed;
2054         u8 status;
2055         int err;
2056
2057         bt_dev_dbg(hdev, "sock %p", sk);
2058
2059         if (!IS_ENABLED(CONFIG_BT_HS))
2060                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2061                                        MGMT_STATUS_NOT_SUPPORTED);
2062
2063         status = mgmt_bredr_support(hdev);
2064         if (status)
2065                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2066
2067         if (!lmp_ssp_capable(hdev))
2068                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2069                                        MGMT_STATUS_NOT_SUPPORTED);
2070
2071         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2072                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2073                                        MGMT_STATUS_REJECTED);
2074
2075         if (cp->val != 0x00 && cp->val != 0x01)
2076                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2077                                        MGMT_STATUS_INVALID_PARAMS);
2078
2079         hci_dev_lock(hdev);
2080
2081         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2082                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2083                                       MGMT_STATUS_BUSY);
2084                 goto unlock;
2085         }
2086
2087         if (cp->val) {
2088                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2089         } else {
2090                 if (hdev_is_powered(hdev)) {
2091                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2092                                               MGMT_STATUS_REJECTED);
2093                         goto unlock;
2094                 }
2095
2096                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2097         }
2098
2099         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2100         if (err < 0)
2101                 goto unlock;
2102
2103         if (changed)
2104                 err = new_settings(hdev, sk);
2105
2106 unlock:
2107         hci_dev_unlock(hdev);
2108         return err;
2109 }
2110
2111 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2112 {
2113         struct cmd_lookup match = { NULL, hdev };
2114         u8 status = mgmt_status(err);
2115
2116         bt_dev_dbg(hdev, "err %d", err);
2117
2118         if (status) {
2119                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2120                                                         &status);
2121                 return;
2122         }
2123
2124         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2125
2126         new_settings(hdev, match.sk);
2127
2128         if (match.sk)
2129                 sock_put(match.sk);
2130 }
2131
2132 static int set_le_sync(struct hci_dev *hdev, void *data)
2133 {
2134         struct mgmt_pending_cmd *cmd = data;
2135         struct mgmt_mode *cp = cmd->param;
2136         u8 val = !!cp->val;
2137         int err;
2138
2139         if (!val) {
2140                 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2141
2142                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2143                         hci_disable_advertising_sync(hdev);
2144
2145                 if (ext_adv_capable(hdev))
2146                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2147         } else {
2148                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2149         }
2150
2151         err = hci_write_le_host_supported_sync(hdev, val, 0);
2152
2153         /* Make sure the controller has a good default for
2154          * advertising data. Restrict the update to when LE
2155          * has actually been enabled. During power on, the
2156          * update in powered_update_hci will take care of it.
2157          */
2158         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2159                 if (ext_adv_capable(hdev)) {
2160                         int status;
2161
2162                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2163                         if (!status)
2164                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2165                 } else {
2166                         hci_update_adv_data_sync(hdev, 0x00);
2167                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2168                 }
2169
2170                 hci_update_passive_scan(hdev);
2171         }
2172
2173         return err;
2174 }
2175
2176 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2177 {
2178         struct mgmt_pending_cmd *cmd = data;
2179         u8 status = mgmt_status(err);
2180         struct sock *sk = cmd->sk;
2181
2182         if (status) {
2183                 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2184                                      cmd_status_rsp, &status);
2185                 return;
2186         }
2187
2188         mgmt_pending_remove(cmd);
2189         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2190 }
2191
2192 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2193 {
2194         struct mgmt_pending_cmd *cmd = data;
2195         struct mgmt_cp_set_mesh *cp = cmd->param;
2196         size_t len = cmd->param_len;
2197
2198         memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2199
2200         if (cp->enable)
2201                 hci_dev_set_flag(hdev, HCI_MESH);
2202         else
2203                 hci_dev_clear_flag(hdev, HCI_MESH);
2204
2205         len -= sizeof(*cp);
2206
2207         /* If filters don't fit, forward all adv pkts */
2208         if (len <= sizeof(hdev->mesh_ad_types))
2209                 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2210
2211         hci_update_passive_scan_sync(hdev);
2212         return 0;
2213 }
2214
2215 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2216 {
2217         struct mgmt_cp_set_mesh *cp = data;
2218         struct mgmt_pending_cmd *cmd;
2219         int err = 0;
2220
2221         bt_dev_dbg(hdev, "sock %p", sk);
2222
2223         if (!lmp_le_capable(hdev) ||
2224             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2225                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2226                                        MGMT_STATUS_NOT_SUPPORTED);
2227
2228         if (cp->enable != 0x00 && cp->enable != 0x01)
2229                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2230                                        MGMT_STATUS_INVALID_PARAMS);
2231
2232         hci_dev_lock(hdev);
2233
2234         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2235         if (!cmd)
2236                 err = -ENOMEM;
2237         else
2238                 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2239                                          set_mesh_complete);
2240
2241         if (err < 0) {
2242                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2243                                       MGMT_STATUS_FAILED);
2244
2245                 if (cmd)
2246                         mgmt_pending_remove(cmd);
2247         }
2248
2249         hci_dev_unlock(hdev);
2250         return err;
2251 }
2252
2253 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2254 {
2255         struct mgmt_mesh_tx *mesh_tx = data;
2256         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2257         unsigned long mesh_send_interval;
2258         u8 mgmt_err = mgmt_status(err);
2259
2260         /* Report any errors here, but don't report completion */
2261
2262         if (mgmt_err) {
2263                 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2264                 /* Send Complete Error Code for handle */
2265                 mesh_send_complete(hdev, mesh_tx, false);
2266                 return;
2267         }
2268
2269         mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2270         queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2271                            mesh_send_interval);
2272 }
2273
2274 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2275 {
2276         struct mgmt_mesh_tx *mesh_tx = data;
2277         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2278         struct adv_info *adv, *next_instance;
2279         u8 instance = hdev->le_num_of_adv_sets + 1;
2280         u16 timeout, duration;
2281         int err = 0;
2282
2283         if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2284                 return MGMT_STATUS_BUSY;
2285
2286         timeout = 1000;
2287         duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2288         adv = hci_add_adv_instance(hdev, instance, 0,
2289                                    send->adv_data_len, send->adv_data,
2290                                    0, NULL,
2291                                    timeout, duration,
2292                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
2293                                    hdev->le_adv_min_interval,
2294                                    hdev->le_adv_max_interval,
2295                                    mesh_tx->handle);
2296
2297         if (!IS_ERR(adv))
2298                 mesh_tx->instance = instance;
2299         else
2300                 err = PTR_ERR(adv);
2301
2302         if (hdev->cur_adv_instance == instance) {
2303                 /* If the currently advertised instance is being changed then
2304                  * cancel the current advertising and schedule the next
2305                  * instance. If there is only one instance then the overridden
2306                  * advertising data will be visible right away.
2307                  */
2308                 cancel_adv_timeout(hdev);
2309
2310                 next_instance = hci_get_next_instance(hdev, instance);
2311                 if (next_instance)
2312                         instance = next_instance->instance;
2313                 else
2314                         instance = 0;
2315         } else if (hdev->adv_instance_timeout) {
2316                 /* Immediately advertise the new instance if no other, or
2317                  * let it go naturally from queue if ADV is already happening
2318                  */
2319                 instance = 0;
2320         }
2321
2322         if (instance)
2323                 return hci_schedule_adv_instance_sync(hdev, instance, true);
2324
2325         return err;
2326 }
2327
2328 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2329 {
2330         struct mgmt_rp_mesh_read_features *rp = data;
2331
2332         if (rp->used_handles >= rp->max_handles)
2333                 return;
2334
2335         rp->handles[rp->used_handles++] = mesh_tx->handle;
2336 }
2337
2338 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2339                          void *data, u16 len)
2340 {
2341         struct mgmt_rp_mesh_read_features rp;
2342
2343         if (!lmp_le_capable(hdev) ||
2344             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2345                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2346                                        MGMT_STATUS_NOT_SUPPORTED);
2347
2348         memset(&rp, 0, sizeof(rp));
2349         rp.index = cpu_to_le16(hdev->id);
2350         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2351                 rp.max_handles = MESH_HANDLES_MAX;
2352
2353         hci_dev_lock(hdev);
2354
2355         if (rp.max_handles)
2356                 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2357
2358         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2359                           rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2360
2361         hci_dev_unlock(hdev);
2362         return 0;
2363 }
2364
2365 static int send_cancel(struct hci_dev *hdev, void *data)
2366 {
2367         struct mgmt_pending_cmd *cmd = data;
2368         struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2369         struct mgmt_mesh_tx *mesh_tx;
2370
2371         if (!cancel->handle) {
2372                 do {
2373                         mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2374
2375                         if (mesh_tx)
2376                                 mesh_send_complete(hdev, mesh_tx, false);
2377                 } while (mesh_tx);
2378         } else {
2379                 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2380
2381                 if (mesh_tx && mesh_tx->sk == cmd->sk)
2382                         mesh_send_complete(hdev, mesh_tx, false);
2383         }
2384
2385         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2386                           0, NULL, 0);
2387         mgmt_pending_free(cmd);
2388
2389         return 0;
2390 }
2391
2392 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2393                             void *data, u16 len)
2394 {
2395         struct mgmt_pending_cmd *cmd;
2396         int err;
2397
2398         if (!lmp_le_capable(hdev) ||
2399             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2400                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2401                                        MGMT_STATUS_NOT_SUPPORTED);
2402
2403         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2404                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2405                                        MGMT_STATUS_REJECTED);
2406
2407         hci_dev_lock(hdev);
2408         cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2409         if (!cmd)
2410                 err = -ENOMEM;
2411         else
2412                 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2413
2414         if (err < 0) {
2415                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2416                                       MGMT_STATUS_FAILED);
2417
2418                 if (cmd)
2419                         mgmt_pending_free(cmd);
2420         }
2421
2422         hci_dev_unlock(hdev);
2423         return err;
2424 }
2425
2426 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2427 {
2428         struct mgmt_mesh_tx *mesh_tx;
2429         struct mgmt_cp_mesh_send *send = data;
2430         struct mgmt_rp_mesh_read_features rp;
2431         bool sending;
2432         int err = 0;
2433
2434         if (!lmp_le_capable(hdev) ||
2435             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2436                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2437                                        MGMT_STATUS_NOT_SUPPORTED);
2438         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2439             len <= MGMT_MESH_SEND_SIZE ||
2440             len > (MGMT_MESH_SEND_SIZE + 31))
2441                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2442                                        MGMT_STATUS_REJECTED);
2443
2444         hci_dev_lock(hdev);
2445
2446         memset(&rp, 0, sizeof(rp));
2447         rp.max_handles = MESH_HANDLES_MAX;
2448
2449         mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2450
2451         if (rp.max_handles <= rp.used_handles) {
2452                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2453                                       MGMT_STATUS_BUSY);
2454                 goto done;
2455         }
2456
2457         sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2458         mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2459
2460         if (!mesh_tx)
2461                 err = -ENOMEM;
2462         else if (!sending)
2463                 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2464                                          mesh_send_start_complete);
2465
2466         if (err < 0) {
2467                 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2468                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2469                                       MGMT_STATUS_FAILED);
2470
2471                 if (mesh_tx) {
2472                         if (sending)
2473                                 mgmt_mesh_remove(mesh_tx);
2474                 }
2475         } else {
2476                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2477
2478                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2479                                   &mesh_tx->handle, 1);
2480         }
2481
2482 done:
2483         hci_dev_unlock(hdev);
2484         return err;
2485 }
2486
2487 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2488 {
2489         struct mgmt_mode *cp = data;
2490         struct mgmt_pending_cmd *cmd;
2491         int err;
2492         u8 val, enabled;
2493
2494         bt_dev_dbg(hdev, "sock %p", sk);
2495
2496         if (!lmp_le_capable(hdev))
2497                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2498                                        MGMT_STATUS_NOT_SUPPORTED);
2499
2500         if (cp->val != 0x00 && cp->val != 0x01)
2501                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2502                                        MGMT_STATUS_INVALID_PARAMS);
2503
2504         /* Bluetooth single mode LE only controllers or dual-mode
2505          * controllers configured as LE only devices, do not allow
2506          * switching LE off. These have either LE enabled explicitly
2507          * or BR/EDR has been previously switched off.
2508          *
2509          * When trying to enable an already enabled LE, then gracefully
2510          * send a positive response. Trying to disable it however will
2511          * result into rejection.
2512          */
2513         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2514                 if (cp->val == 0x01)
2515                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2516
2517                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2518                                        MGMT_STATUS_REJECTED);
2519         }
2520
2521         hci_dev_lock(hdev);
2522
2523         val = !!cp->val;
2524         enabled = lmp_host_le_capable(hdev);
2525
2526         if (!hdev_is_powered(hdev) || val == enabled) {
2527                 bool changed = false;
2528
2529                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2530                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2531                         changed = true;
2532                 }
2533
2534                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2535                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2536                         changed = true;
2537                 }
2538
2539                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2540                 if (err < 0)
2541                         goto unlock;
2542
2543                 if (changed)
2544                         err = new_settings(hdev, sk);
2545
2546                 goto unlock;
2547         }
2548
2549         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2550             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2551                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2552                                       MGMT_STATUS_BUSY);
2553                 goto unlock;
2554         }
2555
2556         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2557         if (!cmd)
2558                 err = -ENOMEM;
2559         else
2560                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2561                                          set_le_complete);
2562
2563         if (err < 0) {
2564                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2565                                       MGMT_STATUS_FAILED);
2566
2567                 if (cmd)
2568                         mgmt_pending_remove(cmd);
2569         }
2570
2571 unlock:
2572         hci_dev_unlock(hdev);
2573         return err;
2574 }
2575
2576 /* This is a helper function to test for pending mgmt commands that can
2577  * cause CoD or EIR HCI commands. We can only allow one such pending
2578  * mgmt command at a time since otherwise we cannot easily track what
2579  * the current values are, will be, and based on that calculate if a new
2580  * HCI command needs to be sent and if yes with what value.
2581  */
2582 static bool pending_eir_or_class(struct hci_dev *hdev)
2583 {
2584         struct mgmt_pending_cmd *cmd;
2585
2586         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2587                 switch (cmd->opcode) {
2588                 case MGMT_OP_ADD_UUID:
2589                 case MGMT_OP_REMOVE_UUID:
2590                 case MGMT_OP_SET_DEV_CLASS:
2591                 case MGMT_OP_SET_POWERED:
2592                         return true;
2593                 }
2594         }
2595
2596         return false;
2597 }
2598
2599 static const u8 bluetooth_base_uuid[] = {
2600                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2601                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2602 };
2603
2604 static u8 get_uuid_size(const u8 *uuid)
2605 {
2606         u32 val;
2607
2608         if (memcmp(uuid, bluetooth_base_uuid, 12))
2609                 return 128;
2610
2611         val = get_unaligned_le32(&uuid[12]);
2612         if (val > 0xffff)
2613                 return 32;
2614
2615         return 16;
2616 }
2617
2618 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2619 {
2620         struct mgmt_pending_cmd *cmd = data;
2621
2622         bt_dev_dbg(hdev, "err %d", err);
2623
2624         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2625                           mgmt_status(err), hdev->dev_class, 3);
2626
2627         mgmt_pending_free(cmd);
2628 }
2629
2630 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2631 {
2632         int err;
2633
2634         err = hci_update_class_sync(hdev);
2635         if (err)
2636                 return err;
2637
2638         return hci_update_eir_sync(hdev);
2639 }
2640
2641 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2642 {
2643         struct mgmt_cp_add_uuid *cp = data;
2644         struct mgmt_pending_cmd *cmd;
2645         struct bt_uuid *uuid;
2646         int err;
2647
2648         bt_dev_dbg(hdev, "sock %p", sk);
2649
2650         hci_dev_lock(hdev);
2651
2652         if (pending_eir_or_class(hdev)) {
2653                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2654                                       MGMT_STATUS_BUSY);
2655                 goto failed;
2656         }
2657
2658         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2659         if (!uuid) {
2660                 err = -ENOMEM;
2661                 goto failed;
2662         }
2663
2664         memcpy(uuid->uuid, cp->uuid, 16);
2665         uuid->svc_hint = cp->svc_hint;
2666         uuid->size = get_uuid_size(cp->uuid);
2667
2668         list_add_tail(&uuid->list, &hdev->uuids);
2669
2670         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2671         if (!cmd) {
2672                 err = -ENOMEM;
2673                 goto failed;
2674         }
2675
2676         err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2677         if (err < 0) {
2678                 mgmt_pending_free(cmd);
2679                 goto failed;
2680         }
2681
2682 failed:
2683         hci_dev_unlock(hdev);
2684         return err;
2685 }
2686
2687 static bool enable_service_cache(struct hci_dev *hdev)
2688 {
2689         if (!hdev_is_powered(hdev))
2690                 return false;
2691
2692         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2693                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2694                                    CACHE_TIMEOUT);
2695                 return true;
2696         }
2697
2698         return false;
2699 }
2700
2701 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2702 {
2703         int err;
2704
2705         err = hci_update_class_sync(hdev);
2706         if (err)
2707                 return err;
2708
2709         return hci_update_eir_sync(hdev);
2710 }
2711
2712 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2713                        u16 len)
2714 {
2715         struct mgmt_cp_remove_uuid *cp = data;
2716         struct mgmt_pending_cmd *cmd;
2717         struct bt_uuid *match, *tmp;
2718         static const u8 bt_uuid_any[] = {
2719                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2720         };
2721         int err, found;
2722
2723         bt_dev_dbg(hdev, "sock %p", sk);
2724
2725         hci_dev_lock(hdev);
2726
2727         if (pending_eir_or_class(hdev)) {
2728                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2729                                       MGMT_STATUS_BUSY);
2730                 goto unlock;
2731         }
2732
2733         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2734                 hci_uuids_clear(hdev);
2735
2736                 if (enable_service_cache(hdev)) {
2737                         err = mgmt_cmd_complete(sk, hdev->id,
2738                                                 MGMT_OP_REMOVE_UUID,
2739                                                 0, hdev->dev_class, 3);
2740                         goto unlock;
2741                 }
2742
2743                 goto update_class;
2744         }
2745
2746         found = 0;
2747
2748         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2749                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2750                         continue;
2751
2752                 list_del(&match->list);
2753                 kfree(match);
2754                 found++;
2755         }
2756
2757         if (found == 0) {
2758                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2759                                       MGMT_STATUS_INVALID_PARAMS);
2760                 goto unlock;
2761         }
2762
2763 update_class:
2764         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2765         if (!cmd) {
2766                 err = -ENOMEM;
2767                 goto unlock;
2768         }
2769
2770         err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2771                                  mgmt_class_complete);
2772         if (err < 0)
2773                 mgmt_pending_free(cmd);
2774
2775 unlock:
2776         hci_dev_unlock(hdev);
2777         return err;
2778 }
2779
2780 static int set_class_sync(struct hci_dev *hdev, void *data)
2781 {
2782         int err = 0;
2783
2784         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2785                 cancel_delayed_work_sync(&hdev->service_cache);
2786                 err = hci_update_eir_sync(hdev);
2787         }
2788
2789         if (err)
2790                 return err;
2791
2792         return hci_update_class_sync(hdev);
2793 }
2794
2795 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2796                          u16 len)
2797 {
2798         struct mgmt_cp_set_dev_class *cp = data;
2799         struct mgmt_pending_cmd *cmd;
2800         int err;
2801
2802         bt_dev_dbg(hdev, "sock %p", sk);
2803
2804         if (!lmp_bredr_capable(hdev))
2805                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2806                                        MGMT_STATUS_NOT_SUPPORTED);
2807
2808         hci_dev_lock(hdev);
2809
2810         if (pending_eir_or_class(hdev)) {
2811                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2812                                       MGMT_STATUS_BUSY);
2813                 goto unlock;
2814         }
2815
2816         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2817                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2818                                       MGMT_STATUS_INVALID_PARAMS);
2819                 goto unlock;
2820         }
2821
2822         hdev->major_class = cp->major;
2823         hdev->minor_class = cp->minor;
2824
2825         if (!hdev_is_powered(hdev)) {
2826                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2827                                         hdev->dev_class, 3);
2828                 goto unlock;
2829         }
2830
2831         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2832         if (!cmd) {
2833                 err = -ENOMEM;
2834                 goto unlock;
2835         }
2836
2837         err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2838                                  mgmt_class_complete);
2839         if (err < 0)
2840                 mgmt_pending_free(cmd);
2841
2842 unlock:
2843         hci_dev_unlock(hdev);
2844         return err;
2845 }
2846
2847 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2848                           u16 len)
2849 {
2850         struct mgmt_cp_load_link_keys *cp = data;
2851         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2852                                    sizeof(struct mgmt_link_key_info));
2853         u16 key_count, expected_len;
2854         bool changed;
2855         int i;
2856
2857         bt_dev_dbg(hdev, "sock %p", sk);
2858
2859         if (!lmp_bredr_capable(hdev))
2860                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2861                                        MGMT_STATUS_NOT_SUPPORTED);
2862
2863         key_count = __le16_to_cpu(cp->key_count);
2864         if (key_count > max_key_count) {
2865                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2866                            key_count);
2867                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2868                                        MGMT_STATUS_INVALID_PARAMS);
2869         }
2870
2871         expected_len = struct_size(cp, keys, key_count);
2872         if (expected_len != len) {
2873                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2874                            expected_len, len);
2875                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2876                                        MGMT_STATUS_INVALID_PARAMS);
2877         }
2878
2879         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2880                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2881                                        MGMT_STATUS_INVALID_PARAMS);
2882
2883         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2884                    key_count);
2885
2886         for (i = 0; i < key_count; i++) {
2887                 struct mgmt_link_key_info *key = &cp->keys[i];
2888
2889                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2890                         return mgmt_cmd_status(sk, hdev->id,
2891                                                MGMT_OP_LOAD_LINK_KEYS,
2892                                                MGMT_STATUS_INVALID_PARAMS);
2893         }
2894
2895         hci_dev_lock(hdev);
2896
2897         hci_link_keys_clear(hdev);
2898
2899         if (cp->debug_keys)
2900                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2901         else
2902                 changed = hci_dev_test_and_clear_flag(hdev,
2903                                                       HCI_KEEP_DEBUG_KEYS);
2904
2905         if (changed)
2906                 new_settings(hdev, NULL);
2907
2908         for (i = 0; i < key_count; i++) {
2909                 struct mgmt_link_key_info *key = &cp->keys[i];
2910
2911                 if (hci_is_blocked_key(hdev,
2912                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2913                                        key->val)) {
2914                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2915                                     &key->addr.bdaddr);
2916                         continue;
2917                 }
2918
2919                 /* Always ignore debug keys and require a new pairing if
2920                  * the user wants to use them.
2921                  */
2922                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2923                         continue;
2924
2925                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2926                                  key->type, key->pin_len, NULL);
2927         }
2928
2929         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2930
2931         hci_dev_unlock(hdev);
2932
2933         return 0;
2934 }
2935
2936 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2937                            u8 addr_type, struct sock *skip_sk)
2938 {
2939         struct mgmt_ev_device_unpaired ev;
2940
2941         bacpy(&ev.addr.bdaddr, bdaddr);
2942         ev.addr.type = addr_type;
2943
2944         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2945                           skip_sk);
2946 }
2947
2948 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2949 {
2950         struct mgmt_pending_cmd *cmd = data;
2951         struct mgmt_cp_unpair_device *cp = cmd->param;
2952
2953         if (!err)
2954                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2955
2956         cmd->cmd_complete(cmd, err);
2957         mgmt_pending_free(cmd);
2958 }
2959
2960 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2961 {
2962         struct mgmt_pending_cmd *cmd = data;
2963         struct mgmt_cp_unpair_device *cp = cmd->param;
2964         struct hci_conn *conn;
2965
2966         if (cp->addr.type == BDADDR_BREDR)
2967                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2968                                                &cp->addr.bdaddr);
2969         else
2970                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2971                                                le_addr_type(cp->addr.type));
2972
2973         if (!conn)
2974                 return 0;
2975
2976         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2977 }
2978
2979 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2980                          u16 len)
2981 {
2982         struct mgmt_cp_unpair_device *cp = data;
2983         struct mgmt_rp_unpair_device rp;
2984         struct hci_conn_params *params;
2985         struct mgmt_pending_cmd *cmd;
2986         struct hci_conn *conn;
2987         u8 addr_type;
2988         int err;
2989
2990         memset(&rp, 0, sizeof(rp));
2991         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2992         rp.addr.type = cp->addr.type;
2993
2994         if (!bdaddr_type_is_valid(cp->addr.type))
2995                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2996                                          MGMT_STATUS_INVALID_PARAMS,
2997                                          &rp, sizeof(rp));
2998
2999         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
3000                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3001                                          MGMT_STATUS_INVALID_PARAMS,
3002                                          &rp, sizeof(rp));
3003
3004         hci_dev_lock(hdev);
3005
3006         if (!hdev_is_powered(hdev)) {
3007                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3008                                         MGMT_STATUS_NOT_POWERED, &rp,
3009                                         sizeof(rp));
3010                 goto unlock;
3011         }
3012
3013         if (cp->addr.type == BDADDR_BREDR) {
3014                 /* If disconnection is requested, then look up the
3015                  * connection. If the remote device is connected, it
3016                  * will be later used to terminate the link.
3017                  *
3018                  * Setting it to NULL explicitly will cause no
3019                  * termination of the link.
3020                  */
3021                 if (cp->disconnect)
3022                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3023                                                        &cp->addr.bdaddr);
3024                 else
3025                         conn = NULL;
3026
3027                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3028                 if (err < 0) {
3029                         err = mgmt_cmd_complete(sk, hdev->id,
3030                                                 MGMT_OP_UNPAIR_DEVICE,
3031                                                 MGMT_STATUS_NOT_PAIRED, &rp,
3032                                                 sizeof(rp));
3033                         goto unlock;
3034                 }
3035
3036                 goto done;
3037         }
3038
3039         /* LE address type */
3040         addr_type = le_addr_type(cp->addr.type);
3041
3042         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3043         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3044         if (err < 0) {
3045                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3046                                         MGMT_STATUS_NOT_PAIRED, &rp,
3047                                         sizeof(rp));
3048                 goto unlock;
3049         }
3050
3051         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3052         if (!conn) {
3053                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3054                 goto done;
3055         }
3056
3057
3058         /* Defer clearing up the connection parameters until closing to
3059          * give a chance of keeping them if a repairing happens.
3060          */
3061         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3062
3063         /* Disable auto-connection parameters if present */
3064         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3065         if (params) {
3066                 if (params->explicit_connect)
3067                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3068                 else
3069                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3070         }
3071
3072         /* If disconnection is not requested, then clear the connection
3073          * variable so that the link is not terminated.
3074          */
3075         if (!cp->disconnect)
3076                 conn = NULL;
3077
3078 done:
3079         /* If the connection variable is set, then termination of the
3080          * link is requested.
3081          */
3082         if (!conn) {
3083                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3084                                         &rp, sizeof(rp));
3085                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3086                 goto unlock;
3087         }
3088
3089         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3090                                sizeof(*cp));
3091         if (!cmd) {
3092                 err = -ENOMEM;
3093                 goto unlock;
3094         }
3095
3096         cmd->cmd_complete = addr_cmd_complete;
3097
3098         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3099                                  unpair_device_complete);
3100         if (err < 0)
3101                 mgmt_pending_free(cmd);
3102
3103 unlock:
3104         hci_dev_unlock(hdev);
3105         return err;
3106 }
3107
3108 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3109                       u16 len)
3110 {
3111         struct mgmt_cp_disconnect *cp = data;
3112         struct mgmt_rp_disconnect rp;
3113         struct mgmt_pending_cmd *cmd;
3114         struct hci_conn *conn;
3115         int err;
3116
3117         bt_dev_dbg(hdev, "sock %p", sk);
3118
3119         memset(&rp, 0, sizeof(rp));
3120         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3121         rp.addr.type = cp->addr.type;
3122
3123         if (!bdaddr_type_is_valid(cp->addr.type))
3124                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3125                                          MGMT_STATUS_INVALID_PARAMS,
3126                                          &rp, sizeof(rp));
3127
3128         hci_dev_lock(hdev);
3129
3130         if (!test_bit(HCI_UP, &hdev->flags)) {
3131                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3132                                         MGMT_STATUS_NOT_POWERED, &rp,
3133                                         sizeof(rp));
3134                 goto failed;
3135         }
3136
3137         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3138                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3139                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3140                 goto failed;
3141         }
3142
3143         if (cp->addr.type == BDADDR_BREDR)
3144                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3145                                                &cp->addr.bdaddr);
3146         else
3147                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3148                                                le_addr_type(cp->addr.type));
3149
3150         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3151                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3152                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3153                                         sizeof(rp));
3154                 goto failed;
3155         }
3156
3157         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3158         if (!cmd) {
3159                 err = -ENOMEM;
3160                 goto failed;
3161         }
3162
3163         cmd->cmd_complete = generic_cmd_complete;
3164
3165         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3166         if (err < 0)
3167                 mgmt_pending_remove(cmd);
3168
3169 failed:
3170         hci_dev_unlock(hdev);
3171         return err;
3172 }
3173
3174 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3175 {
3176         switch (link_type) {
3177         case LE_LINK:
3178                 switch (addr_type) {
3179                 case ADDR_LE_DEV_PUBLIC:
3180                         return BDADDR_LE_PUBLIC;
3181
3182                 default:
3183                         /* Fallback to LE Random address type */
3184                         return BDADDR_LE_RANDOM;
3185                 }
3186
3187         default:
3188                 /* Fallback to BR/EDR type */
3189                 return BDADDR_BREDR;
3190         }
3191 }
3192
3193 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3194                            u16 data_len)
3195 {
3196         struct mgmt_rp_get_connections *rp;
3197         struct hci_conn *c;
3198         int err;
3199         u16 i;
3200
3201         bt_dev_dbg(hdev, "sock %p", sk);
3202
3203         hci_dev_lock(hdev);
3204
3205         if (!hdev_is_powered(hdev)) {
3206                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3207                                       MGMT_STATUS_NOT_POWERED);
3208                 goto unlock;
3209         }
3210
3211         i = 0;
3212         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3213                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3214                         i++;
3215         }
3216
3217         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
3218         if (!rp) {
3219                 err = -ENOMEM;
3220                 goto unlock;
3221         }
3222
3223         i = 0;
3224         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3225                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3226                         continue;
3227                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3228                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3229                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3230                         continue;
3231                 i++;
3232         }
3233
3234         rp->conn_count = cpu_to_le16(i);
3235
3236         /* Recalculate length in case of filtered SCO connections, etc */
3237         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3238                                 struct_size(rp, addr, i));
3239
3240         kfree(rp);
3241
3242 unlock:
3243         hci_dev_unlock(hdev);
3244         return err;
3245 }
3246
3247 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3248                                    struct mgmt_cp_pin_code_neg_reply *cp)
3249 {
3250         struct mgmt_pending_cmd *cmd;
3251         int err;
3252
3253         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3254                                sizeof(*cp));
3255         if (!cmd)
3256                 return -ENOMEM;
3257
3258         cmd->cmd_complete = addr_cmd_complete;
3259
3260         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3261                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3262         if (err < 0)
3263                 mgmt_pending_remove(cmd);
3264
3265         return err;
3266 }
3267
3268 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3269                           u16 len)
3270 {
3271         struct hci_conn *conn;
3272         struct mgmt_cp_pin_code_reply *cp = data;
3273         struct hci_cp_pin_code_reply reply;
3274         struct mgmt_pending_cmd *cmd;
3275         int err;
3276
3277         bt_dev_dbg(hdev, "sock %p", sk);
3278
3279         hci_dev_lock(hdev);
3280
3281         if (!hdev_is_powered(hdev)) {
3282                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3283                                       MGMT_STATUS_NOT_POWERED);
3284                 goto failed;
3285         }
3286
3287         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3288         if (!conn) {
3289                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3290                                       MGMT_STATUS_NOT_CONNECTED);
3291                 goto failed;
3292         }
3293
3294         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3295                 struct mgmt_cp_pin_code_neg_reply ncp;
3296
3297                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3298
3299                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3300
3301                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3302                 if (err >= 0)
3303                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3304                                               MGMT_STATUS_INVALID_PARAMS);
3305
3306                 goto failed;
3307         }
3308
3309         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3310         if (!cmd) {
3311                 err = -ENOMEM;
3312                 goto failed;
3313         }
3314
3315         cmd->cmd_complete = addr_cmd_complete;
3316
3317         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3318         reply.pin_len = cp->pin_len;
3319         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3320
3321         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3322         if (err < 0)
3323                 mgmt_pending_remove(cmd);
3324
3325 failed:
3326         hci_dev_unlock(hdev);
3327         return err;
3328 }
3329
3330 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3331                              u16 len)
3332 {
3333         struct mgmt_cp_set_io_capability *cp = data;
3334
3335         bt_dev_dbg(hdev, "sock %p", sk);
3336
3337         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3338                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3339                                        MGMT_STATUS_INVALID_PARAMS);
3340
3341         hci_dev_lock(hdev);
3342
3343         hdev->io_capability = cp->io_capability;
3344
3345         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3346
3347         hci_dev_unlock(hdev);
3348
3349         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3350                                  NULL, 0);
3351 }
3352
3353 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3354 {
3355         struct hci_dev *hdev = conn->hdev;
3356         struct mgmt_pending_cmd *cmd;
3357
3358         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3359                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3360                         continue;
3361
3362                 if (cmd->user_data != conn)
3363                         continue;
3364
3365                 return cmd;
3366         }
3367
3368         return NULL;
3369 }
3370
3371 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3372 {
3373         struct mgmt_rp_pair_device rp;
3374         struct hci_conn *conn = cmd->user_data;
3375         int err;
3376
3377         bacpy(&rp.addr.bdaddr, &conn->dst);
3378         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3379
3380         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3381                                 status, &rp, sizeof(rp));
3382
3383         /* So we don't get further callbacks for this connection */
3384         conn->connect_cfm_cb = NULL;
3385         conn->security_cfm_cb = NULL;
3386         conn->disconn_cfm_cb = NULL;
3387
3388         hci_conn_drop(conn);
3389
3390         /* The device is paired so there is no need to remove
3391          * its connection parameters anymore.
3392          */
3393         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3394
3395         hci_conn_put(conn);
3396
3397         return err;
3398 }
3399
3400 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3401 {
3402         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3403         struct mgmt_pending_cmd *cmd;
3404
3405         cmd = find_pairing(conn);
3406         if (cmd) {
3407                 cmd->cmd_complete(cmd, status);
3408                 mgmt_pending_remove(cmd);
3409         }
3410 }
3411
3412 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3413 {
3414         struct mgmt_pending_cmd *cmd;
3415
3416         BT_DBG("status %u", status);
3417
3418         cmd = find_pairing(conn);
3419         if (!cmd) {
3420                 BT_DBG("Unable to find a pending command");
3421                 return;
3422         }
3423
3424         cmd->cmd_complete(cmd, mgmt_status(status));
3425         mgmt_pending_remove(cmd);
3426 }
3427
3428 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3429 {
3430         struct mgmt_pending_cmd *cmd;
3431
3432         BT_DBG("status %u", status);
3433
3434         if (!status)
3435                 return;
3436
3437         cmd = find_pairing(conn);
3438         if (!cmd) {
3439                 BT_DBG("Unable to find a pending command");
3440                 return;
3441         }
3442
3443         cmd->cmd_complete(cmd, mgmt_status(status));
3444         mgmt_pending_remove(cmd);
3445 }
3446
3447 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3448                        u16 len)
3449 {
3450         struct mgmt_cp_pair_device *cp = data;
3451         struct mgmt_rp_pair_device rp;
3452         struct mgmt_pending_cmd *cmd;
3453         u8 sec_level, auth_type;
3454         struct hci_conn *conn;
3455         int err;
3456
3457         bt_dev_dbg(hdev, "sock %p", sk);
3458
3459         memset(&rp, 0, sizeof(rp));
3460         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3461         rp.addr.type = cp->addr.type;
3462
3463         if (!bdaddr_type_is_valid(cp->addr.type))
3464                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3465                                          MGMT_STATUS_INVALID_PARAMS,
3466                                          &rp, sizeof(rp));
3467
3468         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3469                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3470                                          MGMT_STATUS_INVALID_PARAMS,
3471                                          &rp, sizeof(rp));
3472
3473         hci_dev_lock(hdev);
3474
3475         if (!hdev_is_powered(hdev)) {
3476                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3477                                         MGMT_STATUS_NOT_POWERED, &rp,
3478                                         sizeof(rp));
3479                 goto unlock;
3480         }
3481
3482         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3483                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3484                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3485                                         sizeof(rp));
3486                 goto unlock;
3487         }
3488
3489         sec_level = BT_SECURITY_MEDIUM;
3490         auth_type = HCI_AT_DEDICATED_BONDING;
3491
3492         if (cp->addr.type == BDADDR_BREDR) {
3493                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3494                                        auth_type, CONN_REASON_PAIR_DEVICE);
3495         } else {
3496                 u8 addr_type = le_addr_type(cp->addr.type);
3497                 struct hci_conn_params *p;
3498
3499                 /* When pairing a new device, it is expected to remember
3500                  * this device for future connections. Adding the connection
3501                  * parameter information ahead of time allows tracking
3502                  * of the peripheral preferred values and will speed up any
3503                  * further connection establishment.
3504                  *
3505                  * If connection parameters already exist, then they
3506                  * will be kept and this function does nothing.
3507                  */
3508                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3509
3510                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3511                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3512
3513                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3514                                            sec_level, HCI_LE_CONN_TIMEOUT,
3515                                            CONN_REASON_PAIR_DEVICE);
3516         }
3517
3518         if (IS_ERR(conn)) {
3519                 int status;
3520
3521                 if (PTR_ERR(conn) == -EBUSY)
3522                         status = MGMT_STATUS_BUSY;
3523                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3524                         status = MGMT_STATUS_NOT_SUPPORTED;
3525                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3526                         status = MGMT_STATUS_REJECTED;
3527                 else
3528                         status = MGMT_STATUS_CONNECT_FAILED;
3529
3530                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3531                                         status, &rp, sizeof(rp));
3532                 goto unlock;
3533         }
3534
3535         if (conn->connect_cfm_cb) {
3536                 hci_conn_drop(conn);
3537                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3538                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3539                 goto unlock;
3540         }
3541
3542         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3543         if (!cmd) {
3544                 err = -ENOMEM;
3545                 hci_conn_drop(conn);
3546                 goto unlock;
3547         }
3548
3549         cmd->cmd_complete = pairing_complete;
3550
3551         /* For LE, just connecting isn't a proof that the pairing finished */
3552         if (cp->addr.type == BDADDR_BREDR) {
3553                 conn->connect_cfm_cb = pairing_complete_cb;
3554                 conn->security_cfm_cb = pairing_complete_cb;
3555                 conn->disconn_cfm_cb = pairing_complete_cb;
3556         } else {
3557                 conn->connect_cfm_cb = le_pairing_complete_cb;
3558                 conn->security_cfm_cb = le_pairing_complete_cb;
3559                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3560         }
3561
3562         conn->io_capability = cp->io_cap;
3563         cmd->user_data = hci_conn_get(conn);
3564
3565         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3566             hci_conn_security(conn, sec_level, auth_type, true)) {
3567                 cmd->cmd_complete(cmd, 0);
3568                 mgmt_pending_remove(cmd);
3569         }
3570
3571         err = 0;
3572
3573 unlock:
3574         hci_dev_unlock(hdev);
3575         return err;
3576 }
3577
3578 static int abort_conn_sync(struct hci_dev *hdev, void *data)
3579 {
3580         struct hci_conn *conn;
3581         u16 handle = PTR_ERR(data);
3582
3583         conn = hci_conn_hash_lookup_handle(hdev, handle);
3584         if (!conn)
3585                 return 0;
3586
3587         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
3588 }
3589
3590 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3591                               u16 len)
3592 {
3593         struct mgmt_addr_info *addr = data;
3594         struct mgmt_pending_cmd *cmd;
3595         struct hci_conn *conn;
3596         int err;
3597
3598         bt_dev_dbg(hdev, "sock %p", sk);
3599
3600         hci_dev_lock(hdev);
3601
3602         if (!hdev_is_powered(hdev)) {
3603                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3604                                       MGMT_STATUS_NOT_POWERED);
3605                 goto unlock;
3606         }
3607
3608         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3609         if (!cmd) {
3610                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3611                                       MGMT_STATUS_INVALID_PARAMS);
3612                 goto unlock;
3613         }
3614
3615         conn = cmd->user_data;
3616
3617         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3618                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3619                                       MGMT_STATUS_INVALID_PARAMS);
3620                 goto unlock;
3621         }
3622
3623         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3624         mgmt_pending_remove(cmd);
3625
3626         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3627                                 addr, sizeof(*addr));
3628
3629         /* Since user doesn't want to proceed with the connection, abort any
3630          * ongoing pairing and then terminate the link if it was created
3631          * because of the pair device action.
3632          */
3633         if (addr->type == BDADDR_BREDR)
3634                 hci_remove_link_key(hdev, &addr->bdaddr);
3635         else
3636                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3637                                               le_addr_type(addr->type));
3638
3639         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3640                 hci_cmd_sync_queue(hdev, abort_conn_sync, ERR_PTR(conn->handle),
3641                                    NULL);
3642
3643 unlock:
3644         hci_dev_unlock(hdev);
3645         return err;
3646 }
3647
3648 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3649                              struct mgmt_addr_info *addr, u16 mgmt_op,
3650                              u16 hci_op, __le32 passkey)
3651 {
3652         struct mgmt_pending_cmd *cmd;
3653         struct hci_conn *conn;
3654         int err;
3655
3656         hci_dev_lock(hdev);
3657
3658         if (!hdev_is_powered(hdev)) {
3659                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3660                                         MGMT_STATUS_NOT_POWERED, addr,
3661                                         sizeof(*addr));
3662                 goto done;
3663         }
3664
3665         if (addr->type == BDADDR_BREDR)
3666                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3667         else
3668                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3669                                                le_addr_type(addr->type));
3670
3671         if (!conn) {
3672                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3673                                         MGMT_STATUS_NOT_CONNECTED, addr,
3674                                         sizeof(*addr));
3675                 goto done;
3676         }
3677
3678         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3679                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3680                 if (!err)
3681                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3682                                                 MGMT_STATUS_SUCCESS, addr,
3683                                                 sizeof(*addr));
3684                 else
3685                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3686                                                 MGMT_STATUS_FAILED, addr,
3687                                                 sizeof(*addr));
3688
3689                 goto done;
3690         }
3691
3692         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3693         if (!cmd) {
3694                 err = -ENOMEM;
3695                 goto done;
3696         }
3697
3698         cmd->cmd_complete = addr_cmd_complete;
3699
3700         /* Continue with pairing via HCI */
3701         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3702                 struct hci_cp_user_passkey_reply cp;
3703
3704                 bacpy(&cp.bdaddr, &addr->bdaddr);
3705                 cp.passkey = passkey;
3706                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3707         } else
3708                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3709                                    &addr->bdaddr);
3710
3711         if (err < 0)
3712                 mgmt_pending_remove(cmd);
3713
3714 done:
3715         hci_dev_unlock(hdev);
3716         return err;
3717 }
3718
3719 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3720                               void *data, u16 len)
3721 {
3722         struct mgmt_cp_pin_code_neg_reply *cp = data;
3723
3724         bt_dev_dbg(hdev, "sock %p", sk);
3725
3726         return user_pairing_resp(sk, hdev, &cp->addr,
3727                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3728                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3729 }
3730
3731 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3732                               u16 len)
3733 {
3734         struct mgmt_cp_user_confirm_reply *cp = data;
3735
3736         bt_dev_dbg(hdev, "sock %p", sk);
3737
3738         if (len != sizeof(*cp))
3739                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3740                                        MGMT_STATUS_INVALID_PARAMS);
3741
3742         return user_pairing_resp(sk, hdev, &cp->addr,
3743                                  MGMT_OP_USER_CONFIRM_REPLY,
3744                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3745 }
3746
3747 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3748                                   void *data, u16 len)
3749 {
3750         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3751
3752         bt_dev_dbg(hdev, "sock %p", sk);
3753
3754         return user_pairing_resp(sk, hdev, &cp->addr,
3755                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3756                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3757 }
3758
3759 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3760                               u16 len)
3761 {
3762         struct mgmt_cp_user_passkey_reply *cp = data;
3763
3764         bt_dev_dbg(hdev, "sock %p", sk);
3765
3766         return user_pairing_resp(sk, hdev, &cp->addr,
3767                                  MGMT_OP_USER_PASSKEY_REPLY,
3768                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3769 }
3770
3771 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3772                                   void *data, u16 len)
3773 {
3774         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3775
3776         bt_dev_dbg(hdev, "sock %p", sk);
3777
3778         return user_pairing_resp(sk, hdev, &cp->addr,
3779                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3780                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3781 }
3782
3783 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3784 {
3785         struct adv_info *adv_instance;
3786
3787         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3788         if (!adv_instance)
3789                 return 0;
3790
3791         /* stop if current instance doesn't need to be changed */
3792         if (!(adv_instance->flags & flags))
3793                 return 0;
3794
3795         cancel_adv_timeout(hdev);
3796
3797         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3798         if (!adv_instance)
3799                 return 0;
3800
3801         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3802
3803         return 0;
3804 }
3805
3806 static int name_changed_sync(struct hci_dev *hdev, void *data)
3807 {
3808         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3809 }
3810
3811 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3812 {
3813         struct mgmt_pending_cmd *cmd = data;
3814         struct mgmt_cp_set_local_name *cp = cmd->param;
3815         u8 status = mgmt_status(err);
3816
3817         bt_dev_dbg(hdev, "err %d", err);
3818
3819         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3820                 return;
3821
3822         if (status) {
3823                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3824                                 status);
3825         } else {
3826                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3827                                   cp, sizeof(*cp));
3828
3829                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3830                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3831         }
3832
3833         mgmt_pending_remove(cmd);
3834 }
3835
3836 static int set_name_sync(struct hci_dev *hdev, void *data)
3837 {
3838         if (lmp_bredr_capable(hdev)) {
3839                 hci_update_name_sync(hdev);
3840                 hci_update_eir_sync(hdev);
3841         }
3842
3843         /* The name is stored in the scan response data and so
3844          * no need to update the advertising data here.
3845          */
3846         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3847                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3848
3849         return 0;
3850 }
3851
3852 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3853                           u16 len)
3854 {
3855         struct mgmt_cp_set_local_name *cp = data;
3856         struct mgmt_pending_cmd *cmd;
3857         int err;
3858
3859         bt_dev_dbg(hdev, "sock %p", sk);
3860
3861         hci_dev_lock(hdev);
3862
3863         /* If the old values are the same as the new ones just return a
3864          * direct command complete event.
3865          */
3866         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3867             !memcmp(hdev->short_name, cp->short_name,
3868                     sizeof(hdev->short_name))) {
3869                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3870                                         data, len);
3871                 goto failed;
3872         }
3873
3874         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3875
3876         if (!hdev_is_powered(hdev)) {
3877                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3878
3879                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3880                                         data, len);
3881                 if (err < 0)
3882                         goto failed;
3883
3884                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3885                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3886                 ext_info_changed(hdev, sk);
3887
3888                 goto failed;
3889         }
3890
3891         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3892         if (!cmd)
3893                 err = -ENOMEM;
3894         else
3895                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3896                                          set_name_complete);
3897
3898         if (err < 0) {
3899                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3900                                       MGMT_STATUS_FAILED);
3901
3902                 if (cmd)
3903                         mgmt_pending_remove(cmd);
3904
3905                 goto failed;
3906         }
3907
3908         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3909
3910 failed:
3911         hci_dev_unlock(hdev);
3912         return err;
3913 }
3914
3915 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3916 {
3917         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3918 }
3919
3920 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3921                           u16 len)
3922 {
3923         struct mgmt_cp_set_appearance *cp = data;
3924         u16 appearance;
3925         int err;
3926
3927         bt_dev_dbg(hdev, "sock %p", sk);
3928
3929         if (!lmp_le_capable(hdev))
3930                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3931                                        MGMT_STATUS_NOT_SUPPORTED);
3932
3933         appearance = le16_to_cpu(cp->appearance);
3934
3935         hci_dev_lock(hdev);
3936
3937         if (hdev->appearance != appearance) {
3938                 hdev->appearance = appearance;
3939
3940                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3941                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3942                                            NULL);
3943
3944                 ext_info_changed(hdev, sk);
3945         }
3946
3947         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3948                                 0);
3949
3950         hci_dev_unlock(hdev);
3951
3952         return err;
3953 }
3954
3955 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3956                                  void *data, u16 len)
3957 {
3958         struct mgmt_rp_get_phy_configuration rp;
3959
3960         bt_dev_dbg(hdev, "sock %p", sk);
3961
3962         hci_dev_lock(hdev);
3963
3964         memset(&rp, 0, sizeof(rp));
3965
3966         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3967         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3968         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3969
3970         hci_dev_unlock(hdev);
3971
3972         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3973                                  &rp, sizeof(rp));
3974 }
3975
3976 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3977 {
3978         struct mgmt_ev_phy_configuration_changed ev;
3979
3980         memset(&ev, 0, sizeof(ev));
3981
3982         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3983
3984         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3985                           sizeof(ev), skip);
3986 }
3987
3988 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3989 {
3990         struct mgmt_pending_cmd *cmd = data;
3991         struct sk_buff *skb = cmd->skb;
3992         u8 status = mgmt_status(err);
3993
3994         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3995                 return;
3996
3997         if (!status) {
3998                 if (!skb)
3999                         status = MGMT_STATUS_FAILED;
4000                 else if (IS_ERR(skb))
4001                         status = mgmt_status(PTR_ERR(skb));
4002                 else
4003                         status = mgmt_status(skb->data[0]);
4004         }
4005
4006         bt_dev_dbg(hdev, "status %d", status);
4007
4008         if (status) {
4009                 mgmt_cmd_status(cmd->sk, hdev->id,
4010                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
4011         } else {
4012                 mgmt_cmd_complete(cmd->sk, hdev->id,
4013                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
4014                                   NULL, 0);
4015
4016                 mgmt_phy_configuration_changed(hdev, cmd->sk);
4017         }
4018
4019         if (skb && !IS_ERR(skb))
4020                 kfree_skb(skb);
4021
4022         mgmt_pending_remove(cmd);
4023 }
4024
4025 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4026 {
4027         struct mgmt_pending_cmd *cmd = data;
4028         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4029         struct hci_cp_le_set_default_phy cp_phy;
4030         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
4031
4032         memset(&cp_phy, 0, sizeof(cp_phy));
4033
4034         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4035                 cp_phy.all_phys |= 0x01;
4036
4037         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4038                 cp_phy.all_phys |= 0x02;
4039
4040         if (selected_phys & MGMT_PHY_LE_1M_TX)
4041                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4042
4043         if (selected_phys & MGMT_PHY_LE_2M_TX)
4044                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4045
4046         if (selected_phys & MGMT_PHY_LE_CODED_TX)
4047                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4048
4049         if (selected_phys & MGMT_PHY_LE_1M_RX)
4050                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4051
4052         if (selected_phys & MGMT_PHY_LE_2M_RX)
4053                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4054
4055         if (selected_phys & MGMT_PHY_LE_CODED_RX)
4056                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4057
4058         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4059                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4060
4061         return 0;
4062 }
4063
4064 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4065                                  void *data, u16 len)
4066 {
4067         struct mgmt_cp_set_phy_configuration *cp = data;
4068         struct mgmt_pending_cmd *cmd;
4069         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4070         u16 pkt_type = (HCI_DH1 | HCI_DM1);
4071         bool changed = false;
4072         int err;
4073
4074         bt_dev_dbg(hdev, "sock %p", sk);
4075
4076         configurable_phys = get_configurable_phys(hdev);
4077         supported_phys = get_supported_phys(hdev);
4078         selected_phys = __le32_to_cpu(cp->selected_phys);
4079
4080         if (selected_phys & ~supported_phys)
4081                 return mgmt_cmd_status(sk, hdev->id,
4082                                        MGMT_OP_SET_PHY_CONFIGURATION,
4083                                        MGMT_STATUS_INVALID_PARAMS);
4084
4085         unconfigure_phys = supported_phys & ~configurable_phys;
4086
4087         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4088                 return mgmt_cmd_status(sk, hdev->id,
4089                                        MGMT_OP_SET_PHY_CONFIGURATION,
4090                                        MGMT_STATUS_INVALID_PARAMS);
4091
4092         if (selected_phys == get_selected_phys(hdev))
4093                 return mgmt_cmd_complete(sk, hdev->id,
4094                                          MGMT_OP_SET_PHY_CONFIGURATION,
4095                                          0, NULL, 0);
4096
4097         hci_dev_lock(hdev);
4098
4099         if (!hdev_is_powered(hdev)) {
4100                 err = mgmt_cmd_status(sk, hdev->id,
4101                                       MGMT_OP_SET_PHY_CONFIGURATION,
4102                                       MGMT_STATUS_REJECTED);
4103                 goto unlock;
4104         }
4105
4106         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4107                 err = mgmt_cmd_status(sk, hdev->id,
4108                                       MGMT_OP_SET_PHY_CONFIGURATION,
4109                                       MGMT_STATUS_BUSY);
4110                 goto unlock;
4111         }
4112
4113         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4114                 pkt_type |= (HCI_DH3 | HCI_DM3);
4115         else
4116                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4117
4118         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4119                 pkt_type |= (HCI_DH5 | HCI_DM5);
4120         else
4121                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4122
4123         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4124                 pkt_type &= ~HCI_2DH1;
4125         else
4126                 pkt_type |= HCI_2DH1;
4127
4128         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4129                 pkt_type &= ~HCI_2DH3;
4130         else
4131                 pkt_type |= HCI_2DH3;
4132
4133         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4134                 pkt_type &= ~HCI_2DH5;
4135         else
4136                 pkt_type |= HCI_2DH5;
4137
4138         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4139                 pkt_type &= ~HCI_3DH1;
4140         else
4141                 pkt_type |= HCI_3DH1;
4142
4143         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4144                 pkt_type &= ~HCI_3DH3;
4145         else
4146                 pkt_type |= HCI_3DH3;
4147
4148         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4149                 pkt_type &= ~HCI_3DH5;
4150         else
4151                 pkt_type |= HCI_3DH5;
4152
4153         if (pkt_type != hdev->pkt_type) {
4154                 hdev->pkt_type = pkt_type;
4155                 changed = true;
4156         }
4157
4158         if ((selected_phys & MGMT_PHY_LE_MASK) ==
4159             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4160                 if (changed)
4161                         mgmt_phy_configuration_changed(hdev, sk);
4162
4163                 err = mgmt_cmd_complete(sk, hdev->id,
4164                                         MGMT_OP_SET_PHY_CONFIGURATION,
4165                                         0, NULL, 0);
4166
4167                 goto unlock;
4168         }
4169
4170         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4171                                len);
4172         if (!cmd)
4173                 err = -ENOMEM;
4174         else
4175                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4176                                          set_default_phy_complete);
4177
4178         if (err < 0) {
4179                 err = mgmt_cmd_status(sk, hdev->id,
4180                                       MGMT_OP_SET_PHY_CONFIGURATION,
4181                                       MGMT_STATUS_FAILED);
4182
4183                 if (cmd)
4184                         mgmt_pending_remove(cmd);
4185         }
4186
4187 unlock:
4188         hci_dev_unlock(hdev);
4189
4190         return err;
4191 }
4192
4193 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4194                             u16 len)
4195 {
4196         int err = MGMT_STATUS_SUCCESS;
4197         struct mgmt_cp_set_blocked_keys *keys = data;
4198         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4199                                    sizeof(struct mgmt_blocked_key_info));
4200         u16 key_count, expected_len;
4201         int i;
4202
4203         bt_dev_dbg(hdev, "sock %p", sk);
4204
4205         key_count = __le16_to_cpu(keys->key_count);
4206         if (key_count > max_key_count) {
4207                 bt_dev_err(hdev, "too big key_count value %u", key_count);
4208                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4209                                        MGMT_STATUS_INVALID_PARAMS);
4210         }
4211
4212         expected_len = struct_size(keys, keys, key_count);
4213         if (expected_len != len) {
4214                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4215                            expected_len, len);
4216                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4217                                        MGMT_STATUS_INVALID_PARAMS);
4218         }
4219
4220         hci_dev_lock(hdev);
4221
4222         hci_blocked_keys_clear(hdev);
4223
4224         for (i = 0; i < key_count; ++i) {
4225                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4226
4227                 if (!b) {
4228                         err = MGMT_STATUS_NO_RESOURCES;
4229                         break;
4230                 }
4231
4232                 b->type = keys->keys[i].type;
4233                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4234                 list_add_rcu(&b->list, &hdev->blocked_keys);
4235         }
4236         hci_dev_unlock(hdev);
4237
4238         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4239                                 err, NULL, 0);
4240 }
4241
4242 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4243                                void *data, u16 len)
4244 {
4245         struct mgmt_mode *cp = data;
4246         int err;
4247         bool changed = false;
4248
4249         bt_dev_dbg(hdev, "sock %p", sk);
4250
4251         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4252                 return mgmt_cmd_status(sk, hdev->id,
4253                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4254                                        MGMT_STATUS_NOT_SUPPORTED);
4255
4256         if (cp->val != 0x00 && cp->val != 0x01)
4257                 return mgmt_cmd_status(sk, hdev->id,
4258                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4259                                        MGMT_STATUS_INVALID_PARAMS);
4260
4261         hci_dev_lock(hdev);
4262
4263         if (hdev_is_powered(hdev) &&
4264             !!cp->val != hci_dev_test_flag(hdev,
4265                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
4266                 err = mgmt_cmd_status(sk, hdev->id,
4267                                       MGMT_OP_SET_WIDEBAND_SPEECH,
4268                                       MGMT_STATUS_REJECTED);
4269                 goto unlock;
4270         }
4271
4272         if (cp->val)
4273                 changed = !hci_dev_test_and_set_flag(hdev,
4274                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4275         else
4276                 changed = hci_dev_test_and_clear_flag(hdev,
4277                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4278
4279         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4280         if (err < 0)
4281                 goto unlock;
4282
4283         if (changed)
4284                 err = new_settings(hdev, sk);
4285
4286 unlock:
4287         hci_dev_unlock(hdev);
4288         return err;
4289 }
4290
4291 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4292                                void *data, u16 data_len)
4293 {
4294         char buf[20];
4295         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4296         u16 cap_len = 0;
4297         u8 flags = 0;
4298         u8 tx_power_range[2];
4299
4300         bt_dev_dbg(hdev, "sock %p", sk);
4301
4302         memset(&buf, 0, sizeof(buf));
4303
4304         hci_dev_lock(hdev);
4305
4306         /* When the Read Simple Pairing Options command is supported, then
4307          * the remote public key validation is supported.
4308          *
4309          * Alternatively, when Microsoft extensions are available, they can
4310          * indicate support for public key validation as well.
4311          */
4312         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4313                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
4314
4315         flags |= 0x02;          /* Remote public key validation (LE) */
4316
4317         /* When the Read Encryption Key Size command is supported, then the
4318          * encryption key size is enforced.
4319          */
4320         if (hdev->commands[20] & 0x10)
4321                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
4322
4323         flags |= 0x08;          /* Encryption key size enforcement (LE) */
4324
4325         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4326                                   &flags, 1);
4327
4328         /* When the Read Simple Pairing Options command is supported, then
4329          * also max encryption key size information is provided.
4330          */
4331         if (hdev->commands[41] & 0x08)
4332                 cap_len = eir_append_le16(rp->cap, cap_len,
4333                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
4334                                           hdev->max_enc_key_size);
4335
4336         cap_len = eir_append_le16(rp->cap, cap_len,
4337                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4338                                   SMP_MAX_ENC_KEY_SIZE);
4339
4340         /* Append the min/max LE tx power parameters if we were able to fetch
4341          * it from the controller
4342          */
4343         if (hdev->commands[38] & 0x80) {
4344                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4345                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4346                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4347                                           tx_power_range, 2);
4348         }
4349
4350         rp->cap_len = cpu_to_le16(cap_len);
4351
4352         hci_dev_unlock(hdev);
4353
4354         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4355                                  rp, sizeof(*rp) + cap_len);
4356 }
4357
4358 #ifdef CONFIG_BT_FEATURE_DEBUG
4359 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4360 static const u8 debug_uuid[16] = {
4361         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4362         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4363 };
4364 #endif
4365
4366 /* 330859bc-7506-492d-9370-9a6f0614037f */
4367 static const u8 quality_report_uuid[16] = {
4368         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4369         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4370 };
4371
4372 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4373 static const u8 offload_codecs_uuid[16] = {
4374         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4375         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4376 };
4377
4378 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4379 static const u8 le_simultaneous_roles_uuid[16] = {
4380         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4381         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4382 };
4383
4384 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
4385 static const u8 rpa_resolution_uuid[16] = {
4386         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4387         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4388 };
4389
4390 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4391 static const u8 iso_socket_uuid[16] = {
4392         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4393         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4394 };
4395
4396 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4397 static const u8 mgmt_mesh_uuid[16] = {
4398         0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4399         0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4400 };
4401
4402 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4403                                   void *data, u16 data_len)
4404 {
4405         struct mgmt_rp_read_exp_features_info *rp;
4406         size_t len;
4407         u16 idx = 0;
4408         u32 flags;
4409         int status;
4410
4411         bt_dev_dbg(hdev, "sock %p", sk);
4412
4413         /* Enough space for 7 features */
4414         len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4415         rp = kzalloc(len, GFP_KERNEL);
4416         if (!rp)
4417                 return -ENOMEM;
4418
4419 #ifdef CONFIG_BT_FEATURE_DEBUG
4420         if (!hdev) {
4421                 flags = bt_dbg_get() ? BIT(0) : 0;
4422
4423                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4424                 rp->features[idx].flags = cpu_to_le32(flags);
4425                 idx++;
4426         }
4427 #endif
4428
4429         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4430                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4431                         flags = BIT(0);
4432                 else
4433                         flags = 0;
4434
4435                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4436                 rp->features[idx].flags = cpu_to_le32(flags);
4437                 idx++;
4438         }
4439
4440         if (hdev && ll_privacy_capable(hdev)) {
4441                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4442                         flags = BIT(0) | BIT(1);
4443                 else
4444                         flags = BIT(1);
4445
4446                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4447                 rp->features[idx].flags = cpu_to_le32(flags);
4448                 idx++;
4449         }
4450
4451         if (hdev && (aosp_has_quality_report(hdev) ||
4452                      hdev->set_quality_report)) {
4453                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4454                         flags = BIT(0);
4455                 else
4456                         flags = 0;
4457
4458                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4459                 rp->features[idx].flags = cpu_to_le32(flags);
4460                 idx++;
4461         }
4462
4463         if (hdev && hdev->get_data_path_id) {
4464                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4465                         flags = BIT(0);
4466                 else
4467                         flags = 0;
4468
4469                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4470                 rp->features[idx].flags = cpu_to_le32(flags);
4471                 idx++;
4472         }
4473
4474         if (IS_ENABLED(CONFIG_BT_LE)) {
4475                 flags = iso_enabled() ? BIT(0) : 0;
4476                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4477                 rp->features[idx].flags = cpu_to_le32(flags);
4478                 idx++;
4479         }
4480
4481         if (hdev && lmp_le_capable(hdev)) {
4482                 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4483                         flags = BIT(0);
4484                 else
4485                         flags = 0;
4486
4487                 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4488                 rp->features[idx].flags = cpu_to_le32(flags);
4489                 idx++;
4490         }
4491
4492         rp->feature_count = cpu_to_le16(idx);
4493
4494         /* After reading the experimental features information, enable
4495          * the events to update client on any future change.
4496          */
4497         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4498
4499         status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4500                                    MGMT_OP_READ_EXP_FEATURES_INFO,
4501                                    0, rp, sizeof(*rp) + (20 * idx));
4502
4503         kfree(rp);
4504         return status;
4505 }
4506
4507 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4508                                           struct sock *skip)
4509 {
4510         struct mgmt_ev_exp_feature_changed ev;
4511
4512         memset(&ev, 0, sizeof(ev));
4513         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4514         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4515
4516         // Do we need to be atomic with the conn_flags?
4517         if (enabled && privacy_mode_capable(hdev))
4518                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4519         else
4520                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4521
4522         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4523                                   &ev, sizeof(ev),
4524                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4525
4526 }
4527
4528 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4529                                bool enabled, struct sock *skip)
4530 {
4531         struct mgmt_ev_exp_feature_changed ev;
4532
4533         memset(&ev, 0, sizeof(ev));
4534         memcpy(ev.uuid, uuid, 16);
4535         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4536
4537         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4538                                   &ev, sizeof(ev),
4539                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4540 }
4541
4542 #define EXP_FEAT(_uuid, _set_func)      \
4543 {                                       \
4544         .uuid = _uuid,                  \
4545         .set_func = _set_func,          \
4546 }
4547
4548 /* The zero key uuid is special. Multiple exp features are set through it. */
4549 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4550                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4551 {
4552         struct mgmt_rp_set_exp_feature rp;
4553
4554         memset(rp.uuid, 0, 16);
4555         rp.flags = cpu_to_le32(0);
4556
4557 #ifdef CONFIG_BT_FEATURE_DEBUG
4558         if (!hdev) {
4559                 bool changed = bt_dbg_get();
4560
4561                 bt_dbg_set(false);
4562
4563                 if (changed)
4564                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4565         }
4566 #endif
4567
4568         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4569                 bool changed;
4570
4571                 changed = hci_dev_test_and_clear_flag(hdev,
4572                                                       HCI_ENABLE_LL_PRIVACY);
4573                 if (changed)
4574                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4575                                             sk);
4576         }
4577
4578         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4579
4580         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4581                                  MGMT_OP_SET_EXP_FEATURE, 0,
4582                                  &rp, sizeof(rp));
4583 }
4584
4585 #ifdef CONFIG_BT_FEATURE_DEBUG
4586 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4587                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4588 {
4589         struct mgmt_rp_set_exp_feature rp;
4590
4591         bool val, changed;
4592         int err;
4593
4594         /* Command requires to use the non-controller index */
4595         if (hdev)
4596                 return mgmt_cmd_status(sk, hdev->id,
4597                                        MGMT_OP_SET_EXP_FEATURE,
4598                                        MGMT_STATUS_INVALID_INDEX);
4599
4600         /* Parameters are limited to a single octet */
4601         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4602                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4603                                        MGMT_OP_SET_EXP_FEATURE,
4604                                        MGMT_STATUS_INVALID_PARAMS);
4605
4606         /* Only boolean on/off is supported */
4607         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4608                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4609                                        MGMT_OP_SET_EXP_FEATURE,
4610                                        MGMT_STATUS_INVALID_PARAMS);
4611
4612         val = !!cp->param[0];
4613         changed = val ? !bt_dbg_get() : bt_dbg_get();
4614         bt_dbg_set(val);
4615
4616         memcpy(rp.uuid, debug_uuid, 16);
4617         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4618
4619         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4620
4621         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4622                                 MGMT_OP_SET_EXP_FEATURE, 0,
4623                                 &rp, sizeof(rp));
4624
4625         if (changed)
4626                 exp_feature_changed(hdev, debug_uuid, val, sk);
4627
4628         return err;
4629 }
4630 #endif
4631
4632 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4633                               struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4634 {
4635         struct mgmt_rp_set_exp_feature rp;
4636         bool val, changed;
4637         int err;
4638
4639         /* Command requires to use the controller index */
4640         if (!hdev)
4641                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4642                                        MGMT_OP_SET_EXP_FEATURE,
4643                                        MGMT_STATUS_INVALID_INDEX);
4644
4645         /* Parameters are limited to a single octet */
4646         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4647                 return mgmt_cmd_status(sk, hdev->id,
4648                                        MGMT_OP_SET_EXP_FEATURE,
4649                                        MGMT_STATUS_INVALID_PARAMS);
4650
4651         /* Only boolean on/off is supported */
4652         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4653                 return mgmt_cmd_status(sk, hdev->id,
4654                                        MGMT_OP_SET_EXP_FEATURE,
4655                                        MGMT_STATUS_INVALID_PARAMS);
4656
4657         val = !!cp->param[0];
4658
4659         if (val) {
4660                 changed = !hci_dev_test_and_set_flag(hdev,
4661                                                      HCI_MESH_EXPERIMENTAL);
4662         } else {
4663                 hci_dev_clear_flag(hdev, HCI_MESH);
4664                 changed = hci_dev_test_and_clear_flag(hdev,
4665                                                       HCI_MESH_EXPERIMENTAL);
4666         }
4667
4668         memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4669         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4670
4671         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4672
4673         err = mgmt_cmd_complete(sk, hdev->id,
4674                                 MGMT_OP_SET_EXP_FEATURE, 0,
4675                                 &rp, sizeof(rp));
4676
4677         if (changed)
4678                 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4679
4680         return err;
4681 }
4682
4683 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4684                                    struct mgmt_cp_set_exp_feature *cp,
4685                                    u16 data_len)
4686 {
4687         struct mgmt_rp_set_exp_feature rp;
4688         bool val, changed;
4689         int err;
4690         u32 flags;
4691
4692         /* Command requires to use the controller index */
4693         if (!hdev)
4694                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4695                                        MGMT_OP_SET_EXP_FEATURE,
4696                                        MGMT_STATUS_INVALID_INDEX);
4697
4698         /* Changes can only be made when controller is powered down */
4699         if (hdev_is_powered(hdev))
4700                 return mgmt_cmd_status(sk, hdev->id,
4701                                        MGMT_OP_SET_EXP_FEATURE,
4702                                        MGMT_STATUS_REJECTED);
4703
4704         /* Parameters are limited to a single octet */
4705         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4706                 return mgmt_cmd_status(sk, hdev->id,
4707                                        MGMT_OP_SET_EXP_FEATURE,
4708                                        MGMT_STATUS_INVALID_PARAMS);
4709
4710         /* Only boolean on/off is supported */
4711         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4712                 return mgmt_cmd_status(sk, hdev->id,
4713                                        MGMT_OP_SET_EXP_FEATURE,
4714                                        MGMT_STATUS_INVALID_PARAMS);
4715
4716         val = !!cp->param[0];
4717
4718         if (val) {
4719                 changed = !hci_dev_test_and_set_flag(hdev,
4720                                                      HCI_ENABLE_LL_PRIVACY);
4721                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4722
4723                 /* Enable LL privacy + supported settings changed */
4724                 flags = BIT(0) | BIT(1);
4725         } else {
4726                 changed = hci_dev_test_and_clear_flag(hdev,
4727                                                       HCI_ENABLE_LL_PRIVACY);
4728
4729                 /* Disable LL privacy + supported settings changed */
4730                 flags = BIT(1);
4731         }
4732
4733         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4734         rp.flags = cpu_to_le32(flags);
4735
4736         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4737
4738         err = mgmt_cmd_complete(sk, hdev->id,
4739                                 MGMT_OP_SET_EXP_FEATURE, 0,
4740                                 &rp, sizeof(rp));
4741
4742         if (changed)
4743                 exp_ll_privacy_feature_changed(val, hdev, sk);
4744
4745         return err;
4746 }
4747
4748 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4749                                    struct mgmt_cp_set_exp_feature *cp,
4750                                    u16 data_len)
4751 {
4752         struct mgmt_rp_set_exp_feature rp;
4753         bool val, changed;
4754         int err;
4755
4756         /* Command requires to use a valid controller index */
4757         if (!hdev)
4758                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4759                                        MGMT_OP_SET_EXP_FEATURE,
4760                                        MGMT_STATUS_INVALID_INDEX);
4761
4762         /* Parameters are limited to a single octet */
4763         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4764                 return mgmt_cmd_status(sk, hdev->id,
4765                                        MGMT_OP_SET_EXP_FEATURE,
4766                                        MGMT_STATUS_INVALID_PARAMS);
4767
4768         /* Only boolean on/off is supported */
4769         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4770                 return mgmt_cmd_status(sk, hdev->id,
4771                                        MGMT_OP_SET_EXP_FEATURE,
4772                                        MGMT_STATUS_INVALID_PARAMS);
4773
4774         hci_req_sync_lock(hdev);
4775
4776         val = !!cp->param[0];
4777         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4778
4779         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4780                 err = mgmt_cmd_status(sk, hdev->id,
4781                                       MGMT_OP_SET_EXP_FEATURE,
4782                                       MGMT_STATUS_NOT_SUPPORTED);
4783                 goto unlock_quality_report;
4784         }
4785
4786         if (changed) {
4787                 if (hdev->set_quality_report)
4788                         err = hdev->set_quality_report(hdev, val);
4789                 else
4790                         err = aosp_set_quality_report(hdev, val);
4791
4792                 if (err) {
4793                         err = mgmt_cmd_status(sk, hdev->id,
4794                                               MGMT_OP_SET_EXP_FEATURE,
4795                                               MGMT_STATUS_FAILED);
4796                         goto unlock_quality_report;
4797                 }
4798
4799                 if (val)
4800                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4801                 else
4802                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4803         }
4804
4805         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4806
4807         memcpy(rp.uuid, quality_report_uuid, 16);
4808         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4809         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4810
4811         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4812                                 &rp, sizeof(rp));
4813
4814         if (changed)
4815                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4816
4817 unlock_quality_report:
4818         hci_req_sync_unlock(hdev);
4819         return err;
4820 }
4821
4822 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4823                                   struct mgmt_cp_set_exp_feature *cp,
4824                                   u16 data_len)
4825 {
4826         bool val, changed;
4827         int err;
4828         struct mgmt_rp_set_exp_feature rp;
4829
4830         /* Command requires to use a valid controller index */
4831         if (!hdev)
4832                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4833                                        MGMT_OP_SET_EXP_FEATURE,
4834                                        MGMT_STATUS_INVALID_INDEX);
4835
4836         /* Parameters are limited to a single octet */
4837         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4838                 return mgmt_cmd_status(sk, hdev->id,
4839                                        MGMT_OP_SET_EXP_FEATURE,
4840                                        MGMT_STATUS_INVALID_PARAMS);
4841
4842         /* Only boolean on/off is supported */
4843         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4844                 return mgmt_cmd_status(sk, hdev->id,
4845                                        MGMT_OP_SET_EXP_FEATURE,
4846                                        MGMT_STATUS_INVALID_PARAMS);
4847
4848         val = !!cp->param[0];
4849         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4850
4851         if (!hdev->get_data_path_id) {
4852                 return mgmt_cmd_status(sk, hdev->id,
4853                                        MGMT_OP_SET_EXP_FEATURE,
4854                                        MGMT_STATUS_NOT_SUPPORTED);
4855         }
4856
4857         if (changed) {
4858                 if (val)
4859                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4860                 else
4861                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4862         }
4863
4864         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4865                     val, changed);
4866
4867         memcpy(rp.uuid, offload_codecs_uuid, 16);
4868         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4869         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4870         err = mgmt_cmd_complete(sk, hdev->id,
4871                                 MGMT_OP_SET_EXP_FEATURE, 0,
4872                                 &rp, sizeof(rp));
4873
4874         if (changed)
4875                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4876
4877         return err;
4878 }
4879
4880 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4881                                           struct mgmt_cp_set_exp_feature *cp,
4882                                           u16 data_len)
4883 {
4884         bool val, changed;
4885         int err;
4886         struct mgmt_rp_set_exp_feature rp;
4887
4888         /* Command requires to use a valid controller index */
4889         if (!hdev)
4890                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4891                                        MGMT_OP_SET_EXP_FEATURE,
4892                                        MGMT_STATUS_INVALID_INDEX);
4893
4894         /* Parameters are limited to a single octet */
4895         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4896                 return mgmt_cmd_status(sk, hdev->id,
4897                                        MGMT_OP_SET_EXP_FEATURE,
4898                                        MGMT_STATUS_INVALID_PARAMS);
4899
4900         /* Only boolean on/off is supported */
4901         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4902                 return mgmt_cmd_status(sk, hdev->id,
4903                                        MGMT_OP_SET_EXP_FEATURE,
4904                                        MGMT_STATUS_INVALID_PARAMS);
4905
4906         val = !!cp->param[0];
4907         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4908
4909         if (!hci_dev_le_state_simultaneous(hdev)) {
4910                 return mgmt_cmd_status(sk, hdev->id,
4911                                        MGMT_OP_SET_EXP_FEATURE,
4912                                        MGMT_STATUS_NOT_SUPPORTED);
4913         }
4914
4915         if (changed) {
4916                 if (val)
4917                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4918                 else
4919                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4920         }
4921
4922         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4923                     val, changed);
4924
4925         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4926         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4927         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4928         err = mgmt_cmd_complete(sk, hdev->id,
4929                                 MGMT_OP_SET_EXP_FEATURE, 0,
4930                                 &rp, sizeof(rp));
4931
4932         if (changed)
4933                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4934
4935         return err;
4936 }
4937
4938 #ifdef CONFIG_BT_LE
4939 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4940                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4941 {
4942         struct mgmt_rp_set_exp_feature rp;
4943         bool val, changed = false;
4944         int err;
4945
4946         /* Command requires to use the non-controller index */
4947         if (hdev)
4948                 return mgmt_cmd_status(sk, hdev->id,
4949                                        MGMT_OP_SET_EXP_FEATURE,
4950                                        MGMT_STATUS_INVALID_INDEX);
4951
4952         /* Parameters are limited to a single octet */
4953         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4954                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4955                                        MGMT_OP_SET_EXP_FEATURE,
4956                                        MGMT_STATUS_INVALID_PARAMS);
4957
4958         /* Only boolean on/off is supported */
4959         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4960                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4961                                        MGMT_OP_SET_EXP_FEATURE,
4962                                        MGMT_STATUS_INVALID_PARAMS);
4963
4964         val = cp->param[0] ? true : false;
4965         if (val)
4966                 err = iso_init();
4967         else
4968                 err = iso_exit();
4969
4970         if (!err)
4971                 changed = true;
4972
4973         memcpy(rp.uuid, iso_socket_uuid, 16);
4974         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4975
4976         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4977
4978         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4979                                 MGMT_OP_SET_EXP_FEATURE, 0,
4980                                 &rp, sizeof(rp));
4981
4982         if (changed)
4983                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4984
4985         return err;
4986 }
4987 #endif
4988
4989 static const struct mgmt_exp_feature {
4990         const u8 *uuid;
4991         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4992                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4993 } exp_features[] = {
4994         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4995 #ifdef CONFIG_BT_FEATURE_DEBUG
4996         EXP_FEAT(debug_uuid, set_debug_func),
4997 #endif
4998         EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
4999         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
5000         EXP_FEAT(quality_report_uuid, set_quality_report_func),
5001         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
5002         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
5003 #ifdef CONFIG_BT_LE
5004         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
5005 #endif
5006
5007         /* end with a null feature */
5008         EXP_FEAT(NULL, NULL)
5009 };
5010
5011 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5012                            void *data, u16 data_len)
5013 {
5014         struct mgmt_cp_set_exp_feature *cp = data;
5015         size_t i = 0;
5016
5017         bt_dev_dbg(hdev, "sock %p", sk);
5018
5019         for (i = 0; exp_features[i].uuid; i++) {
5020                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5021                         return exp_features[i].set_func(sk, hdev, cp, data_len);
5022         }
5023
5024         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5025                                MGMT_OP_SET_EXP_FEATURE,
5026                                MGMT_STATUS_NOT_SUPPORTED);
5027 }
5028
5029 static u32 get_params_flags(struct hci_dev *hdev,
5030                             struct hci_conn_params *params)
5031 {
5032         u32 flags = hdev->conn_flags;
5033
5034         /* Devices using RPAs can only be programmed in the acceptlist if
5035          * LL Privacy has been enable otherwise they cannot mark
5036          * HCI_CONN_FLAG_REMOTE_WAKEUP.
5037          */
5038         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
5039             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
5040                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
5041
5042         return flags;
5043 }
5044
5045 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5046                             u16 data_len)
5047 {
5048         struct mgmt_cp_get_device_flags *cp = data;
5049         struct mgmt_rp_get_device_flags rp;
5050         struct bdaddr_list_with_flags *br_params;
5051         struct hci_conn_params *params;
5052         u32 supported_flags;
5053         u32 current_flags = 0;
5054         u8 status = MGMT_STATUS_INVALID_PARAMS;
5055
5056         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5057                    &cp->addr.bdaddr, cp->addr.type);
5058
5059         hci_dev_lock(hdev);
5060
5061         supported_flags = hdev->conn_flags;
5062
5063         memset(&rp, 0, sizeof(rp));
5064
5065         if (cp->addr.type == BDADDR_BREDR) {
5066                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5067                                                               &cp->addr.bdaddr,
5068                                                               cp->addr.type);
5069                 if (!br_params)
5070                         goto done;
5071
5072                 current_flags = br_params->flags;
5073         } else {
5074                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5075                                                 le_addr_type(cp->addr.type));
5076                 if (!params)
5077                         goto done;
5078
5079                 supported_flags = get_params_flags(hdev, params);
5080                 current_flags = params->flags;
5081         }
5082
5083         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5084         rp.addr.type = cp->addr.type;
5085         rp.supported_flags = cpu_to_le32(supported_flags);
5086         rp.current_flags = cpu_to_le32(current_flags);
5087
5088         status = MGMT_STATUS_SUCCESS;
5089
5090 done:
5091         hci_dev_unlock(hdev);
5092
5093         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5094                                 &rp, sizeof(rp));
5095 }
5096
5097 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5098                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5099                                  u32 supported_flags, u32 current_flags)
5100 {
5101         struct mgmt_ev_device_flags_changed ev;
5102
5103         bacpy(&ev.addr.bdaddr, bdaddr);
5104         ev.addr.type = bdaddr_type;
5105         ev.supported_flags = cpu_to_le32(supported_flags);
5106         ev.current_flags = cpu_to_le32(current_flags);
5107
5108         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5109 }
5110
5111 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5112                             u16 len)
5113 {
5114         struct mgmt_cp_set_device_flags *cp = data;
5115         struct bdaddr_list_with_flags *br_params;
5116         struct hci_conn_params *params;
5117         u8 status = MGMT_STATUS_INVALID_PARAMS;
5118         u32 supported_flags;
5119         u32 current_flags = __le32_to_cpu(cp->current_flags);
5120
5121         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5122                    &cp->addr.bdaddr, cp->addr.type, current_flags);
5123
5124         // We should take hci_dev_lock() early, I think.. conn_flags can change
5125         supported_flags = hdev->conn_flags;
5126
5127         if ((supported_flags | current_flags) != supported_flags) {
5128                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5129                             current_flags, supported_flags);
5130                 goto done;
5131         }
5132
5133         hci_dev_lock(hdev);
5134
5135         if (cp->addr.type == BDADDR_BREDR) {
5136                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5137                                                               &cp->addr.bdaddr,
5138                                                               cp->addr.type);
5139
5140                 if (br_params) {
5141                         br_params->flags = current_flags;
5142                         status = MGMT_STATUS_SUCCESS;
5143                 } else {
5144                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5145                                     &cp->addr.bdaddr, cp->addr.type);
5146                 }
5147
5148                 goto unlock;
5149         }
5150
5151         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5152                                         le_addr_type(cp->addr.type));
5153         if (!params) {
5154                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5155                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5156                 goto unlock;
5157         }
5158
5159         supported_flags = get_params_flags(hdev, params);
5160
5161         if ((supported_flags | current_flags) != supported_flags) {
5162                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5163                             current_flags, supported_flags);
5164                 goto unlock;
5165         }
5166
5167         params->flags = current_flags;
5168         status = MGMT_STATUS_SUCCESS;
5169
5170         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5171          * has been set.
5172          */
5173         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5174                 hci_update_passive_scan(hdev);
5175
5176 unlock:
5177         hci_dev_unlock(hdev);
5178
5179 done:
5180         if (status == MGMT_STATUS_SUCCESS)
5181                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5182                                      supported_flags, current_flags);
5183
5184         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5185                                  &cp->addr, sizeof(cp->addr));
5186 }
5187
5188 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5189                                    u16 handle)
5190 {
5191         struct mgmt_ev_adv_monitor_added ev;
5192
5193         ev.monitor_handle = cpu_to_le16(handle);
5194
5195         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5196 }
5197
5198 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
5199 {
5200         struct mgmt_ev_adv_monitor_removed ev;
5201         struct mgmt_pending_cmd *cmd;
5202         struct sock *sk_skip = NULL;
5203         struct mgmt_cp_remove_adv_monitor *cp;
5204
5205         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5206         if (cmd) {
5207                 cp = cmd->param;
5208
5209                 if (cp->monitor_handle)
5210                         sk_skip = cmd->sk;
5211         }
5212
5213         ev.monitor_handle = cpu_to_le16(handle);
5214
5215         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
5216 }
5217
5218 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5219                                  void *data, u16 len)
5220 {
5221         struct adv_monitor *monitor = NULL;
5222         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5223         int handle, err;
5224         size_t rp_size = 0;
5225         __u32 supported = 0;
5226         __u32 enabled = 0;
5227         __u16 num_handles = 0;
5228         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5229
5230         BT_DBG("request for %s", hdev->name);
5231
5232         hci_dev_lock(hdev);
5233
5234         if (msft_monitor_supported(hdev))
5235                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5236
5237         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5238                 handles[num_handles++] = monitor->handle;
5239
5240         hci_dev_unlock(hdev);
5241
5242         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5243         rp = kmalloc(rp_size, GFP_KERNEL);
5244         if (!rp)
5245                 return -ENOMEM;
5246
5247         /* All supported features are currently enabled */
5248         enabled = supported;
5249
5250         rp->supported_features = cpu_to_le32(supported);
5251         rp->enabled_features = cpu_to_le32(enabled);
5252         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5253         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5254         rp->num_handles = cpu_to_le16(num_handles);
5255         if (num_handles)
5256                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5257
5258         err = mgmt_cmd_complete(sk, hdev->id,
5259                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5260                                 MGMT_STATUS_SUCCESS, rp, rp_size);
5261
5262         kfree(rp);
5263
5264         return err;
5265 }
5266
5267 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5268                                                    void *data, int status)
5269 {
5270         struct mgmt_rp_add_adv_patterns_monitor rp;
5271         struct mgmt_pending_cmd *cmd = data;
5272         struct adv_monitor *monitor = cmd->user_data;
5273
5274         hci_dev_lock(hdev);
5275
5276         rp.monitor_handle = cpu_to_le16(monitor->handle);
5277
5278         if (!status) {
5279                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5280                 hdev->adv_monitors_cnt++;
5281                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5282                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
5283                 hci_update_passive_scan(hdev);
5284         }
5285
5286         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5287                           mgmt_status(status), &rp, sizeof(rp));
5288         mgmt_pending_remove(cmd);
5289
5290         hci_dev_unlock(hdev);
5291         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5292                    rp.monitor_handle, status);
5293 }
5294
5295 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5296 {
5297         struct mgmt_pending_cmd *cmd = data;
5298         struct adv_monitor *monitor = cmd->user_data;
5299
5300         return hci_add_adv_monitor(hdev, monitor);
5301 }
5302
5303 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5304                                       struct adv_monitor *m, u8 status,
5305                                       void *data, u16 len, u16 op)
5306 {
5307         struct mgmt_pending_cmd *cmd;
5308         int err;
5309
5310         hci_dev_lock(hdev);
5311
5312         if (status)
5313                 goto unlock;
5314
5315         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5316             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5317             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5318             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5319                 status = MGMT_STATUS_BUSY;
5320                 goto unlock;
5321         }
5322
5323         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5324         if (!cmd) {
5325                 status = MGMT_STATUS_NO_RESOURCES;
5326                 goto unlock;
5327         }
5328
5329         cmd->user_data = m;
5330         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5331                                  mgmt_add_adv_patterns_monitor_complete);
5332         if (err) {
5333                 if (err == -ENOMEM)
5334                         status = MGMT_STATUS_NO_RESOURCES;
5335                 else
5336                         status = MGMT_STATUS_FAILED;
5337
5338                 goto unlock;
5339         }
5340
5341         hci_dev_unlock(hdev);
5342
5343         return 0;
5344
5345 unlock:
5346         hci_free_adv_monitor(hdev, m);
5347         hci_dev_unlock(hdev);
5348         return mgmt_cmd_status(sk, hdev->id, op, status);
5349 }
5350
5351 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5352                                    struct mgmt_adv_rssi_thresholds *rssi)
5353 {
5354         if (rssi) {
5355                 m->rssi.low_threshold = rssi->low_threshold;
5356                 m->rssi.low_threshold_timeout =
5357                     __le16_to_cpu(rssi->low_threshold_timeout);
5358                 m->rssi.high_threshold = rssi->high_threshold;
5359                 m->rssi.high_threshold_timeout =
5360                     __le16_to_cpu(rssi->high_threshold_timeout);
5361                 m->rssi.sampling_period = rssi->sampling_period;
5362         } else {
5363                 /* Default values. These numbers are the least constricting
5364                  * parameters for MSFT API to work, so it behaves as if there
5365                  * are no rssi parameter to consider. May need to be changed
5366                  * if other API are to be supported.
5367                  */
5368                 m->rssi.low_threshold = -127;
5369                 m->rssi.low_threshold_timeout = 60;
5370                 m->rssi.high_threshold = -127;
5371                 m->rssi.high_threshold_timeout = 0;
5372                 m->rssi.sampling_period = 0;
5373         }
5374 }
5375
5376 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5377                                     struct mgmt_adv_pattern *patterns)
5378 {
5379         u8 offset = 0, length = 0;
5380         struct adv_pattern *p = NULL;
5381         int i;
5382
5383         for (i = 0; i < pattern_count; i++) {
5384                 offset = patterns[i].offset;
5385                 length = patterns[i].length;
5386                 if (offset >= HCI_MAX_AD_LENGTH ||
5387                     length > HCI_MAX_AD_LENGTH ||
5388                     (offset + length) > HCI_MAX_AD_LENGTH)
5389                         return MGMT_STATUS_INVALID_PARAMS;
5390
5391                 p = kmalloc(sizeof(*p), GFP_KERNEL);
5392                 if (!p)
5393                         return MGMT_STATUS_NO_RESOURCES;
5394
5395                 p->ad_type = patterns[i].ad_type;
5396                 p->offset = patterns[i].offset;
5397                 p->length = patterns[i].length;
5398                 memcpy(p->value, patterns[i].value, p->length);
5399
5400                 INIT_LIST_HEAD(&p->list);
5401                 list_add(&p->list, &m->patterns);
5402         }
5403
5404         return MGMT_STATUS_SUCCESS;
5405 }
5406
5407 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5408                                     void *data, u16 len)
5409 {
5410         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5411         struct adv_monitor *m = NULL;
5412         u8 status = MGMT_STATUS_SUCCESS;
5413         size_t expected_size = sizeof(*cp);
5414
5415         BT_DBG("request for %s", hdev->name);
5416
5417         if (len <= sizeof(*cp)) {
5418                 status = MGMT_STATUS_INVALID_PARAMS;
5419                 goto done;
5420         }
5421
5422         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5423         if (len != expected_size) {
5424                 status = MGMT_STATUS_INVALID_PARAMS;
5425                 goto done;
5426         }
5427
5428         m = kzalloc(sizeof(*m), GFP_KERNEL);
5429         if (!m) {
5430                 status = MGMT_STATUS_NO_RESOURCES;
5431                 goto done;
5432         }
5433
5434         INIT_LIST_HEAD(&m->patterns);
5435
5436         parse_adv_monitor_rssi(m, NULL);
5437         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5438
5439 done:
5440         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5441                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5442 }
5443
5444 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5445                                          void *data, u16 len)
5446 {
5447         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5448         struct adv_monitor *m = NULL;
5449         u8 status = MGMT_STATUS_SUCCESS;
5450         size_t expected_size = sizeof(*cp);
5451
5452         BT_DBG("request for %s", hdev->name);
5453
5454         if (len <= sizeof(*cp)) {
5455                 status = MGMT_STATUS_INVALID_PARAMS;
5456                 goto done;
5457         }
5458
5459         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5460         if (len != expected_size) {
5461                 status = MGMT_STATUS_INVALID_PARAMS;
5462                 goto done;
5463         }
5464
5465         m = kzalloc(sizeof(*m), GFP_KERNEL);
5466         if (!m) {
5467                 status = MGMT_STATUS_NO_RESOURCES;
5468                 goto done;
5469         }
5470
5471         INIT_LIST_HEAD(&m->patterns);
5472
5473         parse_adv_monitor_rssi(m, &cp->rssi);
5474         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5475
5476 done:
5477         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5478                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5479 }
5480
5481 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5482                                              void *data, int status)
5483 {
5484         struct mgmt_rp_remove_adv_monitor rp;
5485         struct mgmt_pending_cmd *cmd = data;
5486         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5487
5488         hci_dev_lock(hdev);
5489
5490         rp.monitor_handle = cp->monitor_handle;
5491
5492         if (!status)
5493                 hci_update_passive_scan(hdev);
5494
5495         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5496                           mgmt_status(status), &rp, sizeof(rp));
5497         mgmt_pending_remove(cmd);
5498
5499         hci_dev_unlock(hdev);
5500         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5501                    rp.monitor_handle, status);
5502 }
5503
5504 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5505 {
5506         struct mgmt_pending_cmd *cmd = data;
5507         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5508         u16 handle = __le16_to_cpu(cp->monitor_handle);
5509
5510         if (!handle)
5511                 return hci_remove_all_adv_monitor(hdev);
5512
5513         return hci_remove_single_adv_monitor(hdev, handle);
5514 }
5515
5516 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5517                               void *data, u16 len)
5518 {
5519         struct mgmt_pending_cmd *cmd;
5520         int err, status;
5521
5522         hci_dev_lock(hdev);
5523
5524         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5525             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5526             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5527             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5528                 status = MGMT_STATUS_BUSY;
5529                 goto unlock;
5530         }
5531
5532         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5533         if (!cmd) {
5534                 status = MGMT_STATUS_NO_RESOURCES;
5535                 goto unlock;
5536         }
5537
5538         err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
5539                                  mgmt_remove_adv_monitor_complete);
5540
5541         if (err) {
5542                 mgmt_pending_remove(cmd);
5543
5544                 if (err == -ENOMEM)
5545                         status = MGMT_STATUS_NO_RESOURCES;
5546                 else
5547                         status = MGMT_STATUS_FAILED;
5548
5549                 goto unlock;
5550         }
5551
5552         hci_dev_unlock(hdev);
5553
5554         return 0;
5555
5556 unlock:
5557         hci_dev_unlock(hdev);
5558         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5559                                status);
5560 }
5561
5562 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5563 {
5564         struct mgmt_rp_read_local_oob_data mgmt_rp;
5565         size_t rp_size = sizeof(mgmt_rp);
5566         struct mgmt_pending_cmd *cmd = data;
5567         struct sk_buff *skb = cmd->skb;
5568         u8 status = mgmt_status(err);
5569
5570         if (!status) {
5571                 if (!skb)
5572                         status = MGMT_STATUS_FAILED;
5573                 else if (IS_ERR(skb))
5574                         status = mgmt_status(PTR_ERR(skb));
5575                 else
5576                         status = mgmt_status(skb->data[0]);
5577         }
5578
5579         bt_dev_dbg(hdev, "status %d", status);
5580
5581         if (status) {
5582                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5583                 goto remove;
5584         }
5585
5586         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5587
5588         if (!bredr_sc_enabled(hdev)) {
5589                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5590
5591                 if (skb->len < sizeof(*rp)) {
5592                         mgmt_cmd_status(cmd->sk, hdev->id,
5593                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5594                                         MGMT_STATUS_FAILED);
5595                         goto remove;
5596                 }
5597
5598                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5599                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5600
5601                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5602         } else {
5603                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5604
5605                 if (skb->len < sizeof(*rp)) {
5606                         mgmt_cmd_status(cmd->sk, hdev->id,
5607                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5608                                         MGMT_STATUS_FAILED);
5609                         goto remove;
5610                 }
5611
5612                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5613                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5614
5615                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5616                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5617         }
5618
5619         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5620                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5621
5622 remove:
5623         if (skb && !IS_ERR(skb))
5624                 kfree_skb(skb);
5625
5626         mgmt_pending_free(cmd);
5627 }
5628
5629 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5630 {
5631         struct mgmt_pending_cmd *cmd = data;
5632
5633         if (bredr_sc_enabled(hdev))
5634                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5635         else
5636                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5637
5638         if (IS_ERR(cmd->skb))
5639                 return PTR_ERR(cmd->skb);
5640         else
5641                 return 0;
5642 }
5643
5644 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5645                                void *data, u16 data_len)
5646 {
5647         struct mgmt_pending_cmd *cmd;
5648         int err;
5649
5650         bt_dev_dbg(hdev, "sock %p", sk);
5651
5652         hci_dev_lock(hdev);
5653
5654         if (!hdev_is_powered(hdev)) {
5655                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5656                                       MGMT_STATUS_NOT_POWERED);
5657                 goto unlock;
5658         }
5659
5660         if (!lmp_ssp_capable(hdev)) {
5661                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5662                                       MGMT_STATUS_NOT_SUPPORTED);
5663                 goto unlock;
5664         }
5665
5666         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5667         if (!cmd)
5668                 err = -ENOMEM;
5669         else
5670                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5671                                          read_local_oob_data_complete);
5672
5673         if (err < 0) {
5674                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5675                                       MGMT_STATUS_FAILED);
5676
5677                 if (cmd)
5678                         mgmt_pending_free(cmd);
5679         }
5680
5681 unlock:
5682         hci_dev_unlock(hdev);
5683         return err;
5684 }
5685
5686 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5687                                void *data, u16 len)
5688 {
5689         struct mgmt_addr_info *addr = data;
5690         int err;
5691
5692         bt_dev_dbg(hdev, "sock %p", sk);
5693
5694         if (!bdaddr_type_is_valid(addr->type))
5695                 return mgmt_cmd_complete(sk, hdev->id,
5696                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5697                                          MGMT_STATUS_INVALID_PARAMS,
5698                                          addr, sizeof(*addr));
5699
5700         hci_dev_lock(hdev);
5701
5702         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5703                 struct mgmt_cp_add_remote_oob_data *cp = data;
5704                 u8 status;
5705
5706                 if (cp->addr.type != BDADDR_BREDR) {
5707                         err = mgmt_cmd_complete(sk, hdev->id,
5708                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5709                                                 MGMT_STATUS_INVALID_PARAMS,
5710                                                 &cp->addr, sizeof(cp->addr));
5711                         goto unlock;
5712                 }
5713
5714                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5715                                               cp->addr.type, cp->hash,
5716                                               cp->rand, NULL, NULL);
5717                 if (err < 0)
5718                         status = MGMT_STATUS_FAILED;
5719                 else
5720                         status = MGMT_STATUS_SUCCESS;
5721
5722                 err = mgmt_cmd_complete(sk, hdev->id,
5723                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5724                                         &cp->addr, sizeof(cp->addr));
5725         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5726                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5727                 u8 *rand192, *hash192, *rand256, *hash256;
5728                 u8 status;
5729
5730                 if (bdaddr_type_is_le(cp->addr.type)) {
5731                         /* Enforce zero-valued 192-bit parameters as
5732                          * long as legacy SMP OOB isn't implemented.
5733                          */
5734                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5735                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5736                                 err = mgmt_cmd_complete(sk, hdev->id,
5737                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5738                                                         MGMT_STATUS_INVALID_PARAMS,
5739                                                         addr, sizeof(*addr));
5740                                 goto unlock;
5741                         }
5742
5743                         rand192 = NULL;
5744                         hash192 = NULL;
5745                 } else {
5746                         /* In case one of the P-192 values is set to zero,
5747                          * then just disable OOB data for P-192.
5748                          */
5749                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5750                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5751                                 rand192 = NULL;
5752                                 hash192 = NULL;
5753                         } else {
5754                                 rand192 = cp->rand192;
5755                                 hash192 = cp->hash192;
5756                         }
5757                 }
5758
5759                 /* In case one of the P-256 values is set to zero, then just
5760                  * disable OOB data for P-256.
5761                  */
5762                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5763                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5764                         rand256 = NULL;
5765                         hash256 = NULL;
5766                 } else {
5767                         rand256 = cp->rand256;
5768                         hash256 = cp->hash256;
5769                 }
5770
5771                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5772                                               cp->addr.type, hash192, rand192,
5773                                               hash256, rand256);
5774                 if (err < 0)
5775                         status = MGMT_STATUS_FAILED;
5776                 else
5777                         status = MGMT_STATUS_SUCCESS;
5778
5779                 err = mgmt_cmd_complete(sk, hdev->id,
5780                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5781                                         status, &cp->addr, sizeof(cp->addr));
5782         } else {
5783                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5784                            len);
5785                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5786                                       MGMT_STATUS_INVALID_PARAMS);
5787         }
5788
5789 unlock:
5790         hci_dev_unlock(hdev);
5791         return err;
5792 }
5793
5794 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5795                                   void *data, u16 len)
5796 {
5797         struct mgmt_cp_remove_remote_oob_data *cp = data;
5798         u8 status;
5799         int err;
5800
5801         bt_dev_dbg(hdev, "sock %p", sk);
5802
5803         if (cp->addr.type != BDADDR_BREDR)
5804                 return mgmt_cmd_complete(sk, hdev->id,
5805                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5806                                          MGMT_STATUS_INVALID_PARAMS,
5807                                          &cp->addr, sizeof(cp->addr));
5808
5809         hci_dev_lock(hdev);
5810
5811         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5812                 hci_remote_oob_data_clear(hdev);
5813                 status = MGMT_STATUS_SUCCESS;
5814                 goto done;
5815         }
5816
5817         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5818         if (err < 0)
5819                 status = MGMT_STATUS_INVALID_PARAMS;
5820         else
5821                 status = MGMT_STATUS_SUCCESS;
5822
5823 done:
5824         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5825                                 status, &cp->addr, sizeof(cp->addr));
5826
5827         hci_dev_unlock(hdev);
5828         return err;
5829 }
5830
5831 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5832 {
5833         struct mgmt_pending_cmd *cmd;
5834
5835         bt_dev_dbg(hdev, "status %u", status);
5836
5837         hci_dev_lock(hdev);
5838
5839         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5840         if (!cmd)
5841                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5842
5843         if (!cmd)
5844                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5845
5846         if (cmd) {
5847                 cmd->cmd_complete(cmd, mgmt_status(status));
5848                 mgmt_pending_remove(cmd);
5849         }
5850
5851         hci_dev_unlock(hdev);
5852 }
5853
5854 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5855                                     uint8_t *mgmt_status)
5856 {
5857         switch (type) {
5858         case DISCOV_TYPE_LE:
5859                 *mgmt_status = mgmt_le_support(hdev);
5860                 if (*mgmt_status)
5861                         return false;
5862                 break;
5863         case DISCOV_TYPE_INTERLEAVED:
5864                 *mgmt_status = mgmt_le_support(hdev);
5865                 if (*mgmt_status)
5866                         return false;
5867                 fallthrough;
5868         case DISCOV_TYPE_BREDR:
5869                 *mgmt_status = mgmt_bredr_support(hdev);
5870                 if (*mgmt_status)
5871                         return false;
5872                 break;
5873         default:
5874                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5875                 return false;
5876         }
5877
5878         return true;
5879 }
5880
5881 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5882 {
5883         struct mgmt_pending_cmd *cmd = data;
5884
5885         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5886             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5887             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5888                 return;
5889
5890         bt_dev_dbg(hdev, "err %d", err);
5891
5892         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5893                           cmd->param, 1);
5894         mgmt_pending_remove(cmd);
5895
5896         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5897                                 DISCOVERY_FINDING);
5898 }
5899
5900 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5901 {
5902         return hci_start_discovery_sync(hdev);
5903 }
5904
5905 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5906                                     u16 op, void *data, u16 len)
5907 {
5908         struct mgmt_cp_start_discovery *cp = data;
5909         struct mgmt_pending_cmd *cmd;
5910         u8 status;
5911         int err;
5912
5913         bt_dev_dbg(hdev, "sock %p", sk);
5914
5915         hci_dev_lock(hdev);
5916
5917         if (!hdev_is_powered(hdev)) {
5918                 err = mgmt_cmd_complete(sk, hdev->id, op,
5919                                         MGMT_STATUS_NOT_POWERED,
5920                                         &cp->type, sizeof(cp->type));
5921                 goto failed;
5922         }
5923
5924         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5925             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5926                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5927                                         &cp->type, sizeof(cp->type));
5928                 goto failed;
5929         }
5930
5931         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5932                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5933                                         &cp->type, sizeof(cp->type));
5934                 goto failed;
5935         }
5936
5937         /* Can't start discovery when it is paused */
5938         if (hdev->discovery_paused) {
5939                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5940                                         &cp->type, sizeof(cp->type));
5941                 goto failed;
5942         }
5943
5944         /* Clear the discovery filter first to free any previously
5945          * allocated memory for the UUID list.
5946          */
5947         hci_discovery_filter_clear(hdev);
5948
5949         hdev->discovery.type = cp->type;
5950         hdev->discovery.report_invalid_rssi = false;
5951         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5952                 hdev->discovery.limited = true;
5953         else
5954                 hdev->discovery.limited = false;
5955
5956         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5957         if (!cmd) {
5958                 err = -ENOMEM;
5959                 goto failed;
5960         }
5961
5962         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5963                                  start_discovery_complete);
5964         if (err < 0) {
5965                 mgmt_pending_remove(cmd);
5966                 goto failed;
5967         }
5968
5969         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5970
5971 failed:
5972         hci_dev_unlock(hdev);
5973         return err;
5974 }
5975
5976 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5977                            void *data, u16 len)
5978 {
5979         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5980                                         data, len);
5981 }
5982
5983 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5984                                    void *data, u16 len)
5985 {
5986         return start_discovery_internal(sk, hdev,
5987                                         MGMT_OP_START_LIMITED_DISCOVERY,
5988                                         data, len);
5989 }
5990
5991 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5992                                    void *data, u16 len)
5993 {
5994         struct mgmt_cp_start_service_discovery *cp = data;
5995         struct mgmt_pending_cmd *cmd;
5996         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5997         u16 uuid_count, expected_len;
5998         u8 status;
5999         int err;
6000
6001         bt_dev_dbg(hdev, "sock %p", sk);
6002
6003         hci_dev_lock(hdev);
6004
6005         if (!hdev_is_powered(hdev)) {
6006                 err = mgmt_cmd_complete(sk, hdev->id,
6007                                         MGMT_OP_START_SERVICE_DISCOVERY,
6008                                         MGMT_STATUS_NOT_POWERED,
6009                                         &cp->type, sizeof(cp->type));
6010                 goto failed;
6011         }
6012
6013         if (hdev->discovery.state != DISCOVERY_STOPPED ||
6014             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6015                 err = mgmt_cmd_complete(sk, hdev->id,
6016                                         MGMT_OP_START_SERVICE_DISCOVERY,
6017                                         MGMT_STATUS_BUSY, &cp->type,
6018                                         sizeof(cp->type));
6019                 goto failed;
6020         }
6021
6022         if (hdev->discovery_paused) {
6023                 err = mgmt_cmd_complete(sk, hdev->id,
6024                                         MGMT_OP_START_SERVICE_DISCOVERY,
6025                                         MGMT_STATUS_BUSY, &cp->type,
6026                                         sizeof(cp->type));
6027                 goto failed;
6028         }
6029
6030         uuid_count = __le16_to_cpu(cp->uuid_count);
6031         if (uuid_count > max_uuid_count) {
6032                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6033                            uuid_count);
6034                 err = mgmt_cmd_complete(sk, hdev->id,
6035                                         MGMT_OP_START_SERVICE_DISCOVERY,
6036                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6037                                         sizeof(cp->type));
6038                 goto failed;
6039         }
6040
6041         expected_len = sizeof(*cp) + uuid_count * 16;
6042         if (expected_len != len) {
6043                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6044                            expected_len, len);
6045                 err = mgmt_cmd_complete(sk, hdev->id,
6046                                         MGMT_OP_START_SERVICE_DISCOVERY,
6047                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6048                                         sizeof(cp->type));
6049                 goto failed;
6050         }
6051
6052         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6053                 err = mgmt_cmd_complete(sk, hdev->id,
6054                                         MGMT_OP_START_SERVICE_DISCOVERY,
6055                                         status, &cp->type, sizeof(cp->type));
6056                 goto failed;
6057         }
6058
6059         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6060                                hdev, data, len);
6061         if (!cmd) {
6062                 err = -ENOMEM;
6063                 goto failed;
6064         }
6065
6066         /* Clear the discovery filter first to free any previously
6067          * allocated memory for the UUID list.
6068          */
6069         hci_discovery_filter_clear(hdev);
6070
6071         hdev->discovery.result_filtering = true;
6072         hdev->discovery.type = cp->type;
6073         hdev->discovery.rssi = cp->rssi;
6074         hdev->discovery.uuid_count = uuid_count;
6075
6076         if (uuid_count > 0) {
6077                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6078                                                 GFP_KERNEL);
6079                 if (!hdev->discovery.uuids) {
6080                         err = mgmt_cmd_complete(sk, hdev->id,
6081                                                 MGMT_OP_START_SERVICE_DISCOVERY,
6082                                                 MGMT_STATUS_FAILED,
6083                                                 &cp->type, sizeof(cp->type));
6084                         mgmt_pending_remove(cmd);
6085                         goto failed;
6086                 }
6087         }
6088
6089         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6090                                  start_discovery_complete);
6091         if (err < 0) {
6092                 mgmt_pending_remove(cmd);
6093                 goto failed;
6094         }
6095
6096         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6097
6098 failed:
6099         hci_dev_unlock(hdev);
6100         return err;
6101 }
6102
6103 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
6104 {
6105         struct mgmt_pending_cmd *cmd;
6106
6107         bt_dev_dbg(hdev, "status %u", status);
6108
6109         hci_dev_lock(hdev);
6110
6111         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6112         if (cmd) {
6113                 cmd->cmd_complete(cmd, mgmt_status(status));
6114                 mgmt_pending_remove(cmd);
6115         }
6116
6117         hci_dev_unlock(hdev);
6118 }
6119
6120 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6121 {
6122         struct mgmt_pending_cmd *cmd = data;
6123
6124         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6125                 return;
6126
6127         bt_dev_dbg(hdev, "err %d", err);
6128
6129         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6130                           cmd->param, 1);
6131         mgmt_pending_remove(cmd);
6132
6133         if (!err)
6134                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6135 }
6136
6137 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6138 {
6139         return hci_stop_discovery_sync(hdev);
6140 }
6141
6142 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6143                           u16 len)
6144 {
6145         struct mgmt_cp_stop_discovery *mgmt_cp = data;
6146         struct mgmt_pending_cmd *cmd;
6147         int err;
6148
6149         bt_dev_dbg(hdev, "sock %p", sk);
6150
6151         hci_dev_lock(hdev);
6152
6153         if (!hci_discovery_active(hdev)) {
6154                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6155                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6156                                         sizeof(mgmt_cp->type));
6157                 goto unlock;
6158         }
6159
6160         if (hdev->discovery.type != mgmt_cp->type) {
6161                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6162                                         MGMT_STATUS_INVALID_PARAMS,
6163                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6164                 goto unlock;
6165         }
6166
6167         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6168         if (!cmd) {
6169                 err = -ENOMEM;
6170                 goto unlock;
6171         }
6172
6173         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6174                                  stop_discovery_complete);
6175         if (err < 0) {
6176                 mgmt_pending_remove(cmd);
6177                 goto unlock;
6178         }
6179
6180         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6181
6182 unlock:
6183         hci_dev_unlock(hdev);
6184         return err;
6185 }
6186
6187 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6188                         u16 len)
6189 {
6190         struct mgmt_cp_confirm_name *cp = data;
6191         struct inquiry_entry *e;
6192         int err;
6193
6194         bt_dev_dbg(hdev, "sock %p", sk);
6195
6196         hci_dev_lock(hdev);
6197
6198         if (!hci_discovery_active(hdev)) {
6199                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6200                                         MGMT_STATUS_FAILED, &cp->addr,
6201                                         sizeof(cp->addr));
6202                 goto failed;
6203         }
6204
6205         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6206         if (!e) {
6207                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6208                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6209                                         sizeof(cp->addr));
6210                 goto failed;
6211         }
6212
6213         if (cp->name_known) {
6214                 e->name_state = NAME_KNOWN;
6215                 list_del(&e->list);
6216         } else {
6217                 e->name_state = NAME_NEEDED;
6218                 hci_inquiry_cache_update_resolve(hdev, e);
6219         }
6220
6221         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6222                                 &cp->addr, sizeof(cp->addr));
6223
6224 failed:
6225         hci_dev_unlock(hdev);
6226         return err;
6227 }
6228
6229 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6230                         u16 len)
6231 {
6232         struct mgmt_cp_block_device *cp = data;
6233         u8 status;
6234         int err;
6235
6236         bt_dev_dbg(hdev, "sock %p", sk);
6237
6238         if (!bdaddr_type_is_valid(cp->addr.type))
6239                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6240                                          MGMT_STATUS_INVALID_PARAMS,
6241                                          &cp->addr, sizeof(cp->addr));
6242
6243         hci_dev_lock(hdev);
6244
6245         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6246                                   cp->addr.type);
6247         if (err < 0) {
6248                 status = MGMT_STATUS_FAILED;
6249                 goto done;
6250         }
6251
6252         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6253                    sk);
6254         status = MGMT_STATUS_SUCCESS;
6255
6256 done:
6257         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6258                                 &cp->addr, sizeof(cp->addr));
6259
6260         hci_dev_unlock(hdev);
6261
6262         return err;
6263 }
6264
6265 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6266                           u16 len)
6267 {
6268         struct mgmt_cp_unblock_device *cp = data;
6269         u8 status;
6270         int err;
6271
6272         bt_dev_dbg(hdev, "sock %p", sk);
6273
6274         if (!bdaddr_type_is_valid(cp->addr.type))
6275                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6276                                          MGMT_STATUS_INVALID_PARAMS,
6277                                          &cp->addr, sizeof(cp->addr));
6278
6279         hci_dev_lock(hdev);
6280
6281         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6282                                   cp->addr.type);
6283         if (err < 0) {
6284                 status = MGMT_STATUS_INVALID_PARAMS;
6285                 goto done;
6286         }
6287
6288         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6289                    sk);
6290         status = MGMT_STATUS_SUCCESS;
6291
6292 done:
6293         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6294                                 &cp->addr, sizeof(cp->addr));
6295
6296         hci_dev_unlock(hdev);
6297
6298         return err;
6299 }
6300
6301 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6302 {
6303         return hci_update_eir_sync(hdev);
6304 }
6305
6306 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6307                          u16 len)
6308 {
6309         struct mgmt_cp_set_device_id *cp = data;
6310         int err;
6311         __u16 source;
6312
6313         bt_dev_dbg(hdev, "sock %p", sk);
6314
6315         source = __le16_to_cpu(cp->source);
6316
6317         if (source > 0x0002)
6318                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6319                                        MGMT_STATUS_INVALID_PARAMS);
6320
6321         hci_dev_lock(hdev);
6322
6323         hdev->devid_source = source;
6324         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6325         hdev->devid_product = __le16_to_cpu(cp->product);
6326         hdev->devid_version = __le16_to_cpu(cp->version);
6327
6328         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6329                                 NULL, 0);
6330
6331         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6332
6333         hci_dev_unlock(hdev);
6334
6335         return err;
6336 }
6337
6338 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6339 {
6340         if (err)
6341                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6342         else
6343                 bt_dev_dbg(hdev, "status %d", err);
6344 }
6345
6346 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6347 {
6348         struct cmd_lookup match = { NULL, hdev };
6349         u8 instance;
6350         struct adv_info *adv_instance;
6351         u8 status = mgmt_status(err);
6352
6353         if (status) {
6354                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
6355                                      cmd_status_rsp, &status);
6356                 return;
6357         }
6358
6359         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6360                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6361         else
6362                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6363
6364         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6365                              &match);
6366
6367         new_settings(hdev, match.sk);
6368
6369         if (match.sk)
6370                 sock_put(match.sk);
6371
6372         /* If "Set Advertising" was just disabled and instance advertising was
6373          * set up earlier, then re-enable multi-instance advertising.
6374          */
6375         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6376             list_empty(&hdev->adv_instances))
6377                 return;
6378
6379         instance = hdev->cur_adv_instance;
6380         if (!instance) {
6381                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6382                                                         struct adv_info, list);
6383                 if (!adv_instance)
6384                         return;
6385
6386                 instance = adv_instance->instance;
6387         }
6388
6389         err = hci_schedule_adv_instance_sync(hdev, instance, true);
6390
6391         enable_advertising_instance(hdev, err);
6392 }
6393
6394 static int set_adv_sync(struct hci_dev *hdev, void *data)
6395 {
6396         struct mgmt_pending_cmd *cmd = data;
6397         struct mgmt_mode *cp = cmd->param;
6398         u8 val = !!cp->val;
6399
6400         if (cp->val == 0x02)
6401                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6402         else
6403                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6404
6405         cancel_adv_timeout(hdev);
6406
6407         if (val) {
6408                 /* Switch to instance "0" for the Set Advertising setting.
6409                  * We cannot use update_[adv|scan_rsp]_data() here as the
6410                  * HCI_ADVERTISING flag is not yet set.
6411                  */
6412                 hdev->cur_adv_instance = 0x00;
6413
6414                 if (ext_adv_capable(hdev)) {
6415                         hci_start_ext_adv_sync(hdev, 0x00);
6416                 } else {
6417                         hci_update_adv_data_sync(hdev, 0x00);
6418                         hci_update_scan_rsp_data_sync(hdev, 0x00);
6419                         hci_enable_advertising_sync(hdev);
6420                 }
6421         } else {
6422                 hci_disable_advertising_sync(hdev);
6423         }
6424
6425         return 0;
6426 }
6427
6428 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6429                            u16 len)
6430 {
6431         struct mgmt_mode *cp = data;
6432         struct mgmt_pending_cmd *cmd;
6433         u8 val, status;
6434         int err;
6435
6436         bt_dev_dbg(hdev, "sock %p", sk);
6437
6438         status = mgmt_le_support(hdev);
6439         if (status)
6440                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6441                                        status);
6442
6443         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6444                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6445                                        MGMT_STATUS_INVALID_PARAMS);
6446
6447         if (hdev->advertising_paused)
6448                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6449                                        MGMT_STATUS_BUSY);
6450
6451         hci_dev_lock(hdev);
6452
6453         val = !!cp->val;
6454
6455         /* The following conditions are ones which mean that we should
6456          * not do any HCI communication but directly send a mgmt
6457          * response to user space (after toggling the flag if
6458          * necessary).
6459          */
6460         if (!hdev_is_powered(hdev) ||
6461             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6462              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6463             hci_dev_test_flag(hdev, HCI_MESH) ||
6464             hci_conn_num(hdev, LE_LINK) > 0 ||
6465             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6466              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6467                 bool changed;
6468
6469                 if (cp->val) {
6470                         hdev->cur_adv_instance = 0x00;
6471                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6472                         if (cp->val == 0x02)
6473                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6474                         else
6475                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6476                 } else {
6477                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6478                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6479                 }
6480
6481                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6482                 if (err < 0)
6483                         goto unlock;
6484
6485                 if (changed)
6486                         err = new_settings(hdev, sk);
6487
6488                 goto unlock;
6489         }
6490
6491         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6492             pending_find(MGMT_OP_SET_LE, hdev)) {
6493                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6494                                       MGMT_STATUS_BUSY);
6495                 goto unlock;
6496         }
6497
6498         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6499         if (!cmd)
6500                 err = -ENOMEM;
6501         else
6502                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6503                                          set_advertising_complete);
6504
6505         if (err < 0 && cmd)
6506                 mgmt_pending_remove(cmd);
6507
6508 unlock:
6509         hci_dev_unlock(hdev);
6510         return err;
6511 }
6512
6513 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6514                               void *data, u16 len)
6515 {
6516         struct mgmt_cp_set_static_address *cp = data;
6517         int err;
6518
6519         bt_dev_dbg(hdev, "sock %p", sk);
6520
6521         if (!lmp_le_capable(hdev))
6522                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6523                                        MGMT_STATUS_NOT_SUPPORTED);
6524
6525         if (hdev_is_powered(hdev))
6526                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6527                                        MGMT_STATUS_REJECTED);
6528
6529         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6530                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6531                         return mgmt_cmd_status(sk, hdev->id,
6532                                                MGMT_OP_SET_STATIC_ADDRESS,
6533                                                MGMT_STATUS_INVALID_PARAMS);
6534
6535                 /* Two most significant bits shall be set */
6536                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6537                         return mgmt_cmd_status(sk, hdev->id,
6538                                                MGMT_OP_SET_STATIC_ADDRESS,
6539                                                MGMT_STATUS_INVALID_PARAMS);
6540         }
6541
6542         hci_dev_lock(hdev);
6543
6544         bacpy(&hdev->static_addr, &cp->bdaddr);
6545
6546         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6547         if (err < 0)
6548                 goto unlock;
6549
6550         err = new_settings(hdev, sk);
6551
6552 unlock:
6553         hci_dev_unlock(hdev);
6554         return err;
6555 }
6556
6557 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6558                            void *data, u16 len)
6559 {
6560         struct mgmt_cp_set_scan_params *cp = data;
6561         __u16 interval, window;
6562         int err;
6563
6564         bt_dev_dbg(hdev, "sock %p", sk);
6565
6566         if (!lmp_le_capable(hdev))
6567                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6568                                        MGMT_STATUS_NOT_SUPPORTED);
6569
6570         interval = __le16_to_cpu(cp->interval);
6571
6572         if (interval < 0x0004 || interval > 0x4000)
6573                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6574                                        MGMT_STATUS_INVALID_PARAMS);
6575
6576         window = __le16_to_cpu(cp->window);
6577
6578         if (window < 0x0004 || window > 0x4000)
6579                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6580                                        MGMT_STATUS_INVALID_PARAMS);
6581
6582         if (window > interval)
6583                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6584                                        MGMT_STATUS_INVALID_PARAMS);
6585
6586         hci_dev_lock(hdev);
6587
6588         hdev->le_scan_interval = interval;
6589         hdev->le_scan_window = window;
6590
6591         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6592                                 NULL, 0);
6593
6594         /* If background scan is running, restart it so new parameters are
6595          * loaded.
6596          */
6597         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6598             hdev->discovery.state == DISCOVERY_STOPPED)
6599                 hci_update_passive_scan(hdev);
6600
6601         hci_dev_unlock(hdev);
6602
6603         return err;
6604 }
6605
6606 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6607 {
6608         struct mgmt_pending_cmd *cmd = data;
6609
6610         bt_dev_dbg(hdev, "err %d", err);
6611
6612         if (err) {
6613                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6614                                 mgmt_status(err));
6615         } else {
6616                 struct mgmt_mode *cp = cmd->param;
6617
6618                 if (cp->val)
6619                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6620                 else
6621                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6622
6623                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6624                 new_settings(hdev, cmd->sk);
6625         }
6626
6627         mgmt_pending_free(cmd);
6628 }
6629
6630 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6631 {
6632         struct mgmt_pending_cmd *cmd = data;
6633         struct mgmt_mode *cp = cmd->param;
6634
6635         return hci_write_fast_connectable_sync(hdev, cp->val);
6636 }
6637
6638 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6639                                 void *data, u16 len)
6640 {
6641         struct mgmt_mode *cp = data;
6642         struct mgmt_pending_cmd *cmd;
6643         int err;
6644
6645         bt_dev_dbg(hdev, "sock %p", sk);
6646
6647         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6648             hdev->hci_ver < BLUETOOTH_VER_1_2)
6649                 return mgmt_cmd_status(sk, hdev->id,
6650                                        MGMT_OP_SET_FAST_CONNECTABLE,
6651                                        MGMT_STATUS_NOT_SUPPORTED);
6652
6653         if (cp->val != 0x00 && cp->val != 0x01)
6654                 return mgmt_cmd_status(sk, hdev->id,
6655                                        MGMT_OP_SET_FAST_CONNECTABLE,
6656                                        MGMT_STATUS_INVALID_PARAMS);
6657
6658         hci_dev_lock(hdev);
6659
6660         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6661                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6662                 goto unlock;
6663         }
6664
6665         if (!hdev_is_powered(hdev)) {
6666                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6667                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6668                 new_settings(hdev, sk);
6669                 goto unlock;
6670         }
6671
6672         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6673                                len);
6674         if (!cmd)
6675                 err = -ENOMEM;
6676         else
6677                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6678                                          fast_connectable_complete);
6679
6680         if (err < 0) {
6681                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6682                                 MGMT_STATUS_FAILED);
6683
6684                 if (cmd)
6685                         mgmt_pending_free(cmd);
6686         }
6687
6688 unlock:
6689         hci_dev_unlock(hdev);
6690
6691         return err;
6692 }
6693
6694 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6695 {
6696         struct mgmt_pending_cmd *cmd = data;
6697
6698         bt_dev_dbg(hdev, "err %d", err);
6699
6700         if (err) {
6701                 u8 mgmt_err = mgmt_status(err);
6702
6703                 /* We need to restore the flag if related HCI commands
6704                  * failed.
6705                  */
6706                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6707
6708                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6709         } else {
6710                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6711                 new_settings(hdev, cmd->sk);
6712         }
6713
6714         mgmt_pending_free(cmd);
6715 }
6716
6717 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6718 {
6719         int status;
6720
6721         status = hci_write_fast_connectable_sync(hdev, false);
6722
6723         if (!status)
6724                 status = hci_update_scan_sync(hdev);
6725
6726         /* Since only the advertising data flags will change, there
6727          * is no need to update the scan response data.
6728          */
6729         if (!status)
6730                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6731
6732         return status;
6733 }
6734
6735 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6736 {
6737         struct mgmt_mode *cp = data;
6738         struct mgmt_pending_cmd *cmd;
6739         int err;
6740
6741         bt_dev_dbg(hdev, "sock %p", sk);
6742
6743         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6744                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6745                                        MGMT_STATUS_NOT_SUPPORTED);
6746
6747         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6749                                        MGMT_STATUS_REJECTED);
6750
6751         if (cp->val != 0x00 && cp->val != 0x01)
6752                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6753                                        MGMT_STATUS_INVALID_PARAMS);
6754
6755         hci_dev_lock(hdev);
6756
6757         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6758                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6759                 goto unlock;
6760         }
6761
6762         if (!hdev_is_powered(hdev)) {
6763                 if (!cp->val) {
6764                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6765                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6766                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6767                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6768                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
6769                 }
6770
6771                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6772
6773                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6774                 if (err < 0)
6775                         goto unlock;
6776
6777                 err = new_settings(hdev, sk);
6778                 goto unlock;
6779         }
6780
6781         /* Reject disabling when powered on */
6782         if (!cp->val) {
6783                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6784                                       MGMT_STATUS_REJECTED);
6785                 goto unlock;
6786         } else {
6787                 /* When configuring a dual-mode controller to operate
6788                  * with LE only and using a static address, then switching
6789                  * BR/EDR back on is not allowed.
6790                  *
6791                  * Dual-mode controllers shall operate with the public
6792                  * address as its identity address for BR/EDR and LE. So
6793                  * reject the attempt to create an invalid configuration.
6794                  *
6795                  * The same restrictions applies when secure connections
6796                  * has been enabled. For BR/EDR this is a controller feature
6797                  * while for LE it is a host stack feature. This means that
6798                  * switching BR/EDR back on when secure connections has been
6799                  * enabled is not a supported transaction.
6800                  */
6801                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6802                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6803                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6804                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6805                                               MGMT_STATUS_REJECTED);
6806                         goto unlock;
6807                 }
6808         }
6809
6810         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6811         if (!cmd)
6812                 err = -ENOMEM;
6813         else
6814                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6815                                          set_bredr_complete);
6816
6817         if (err < 0) {
6818                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6819                                 MGMT_STATUS_FAILED);
6820                 if (cmd)
6821                         mgmt_pending_free(cmd);
6822
6823                 goto unlock;
6824         }
6825
6826         /* We need to flip the bit already here so that
6827          * hci_req_update_adv_data generates the correct flags.
6828          */
6829         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6830
6831 unlock:
6832         hci_dev_unlock(hdev);
6833         return err;
6834 }
6835
6836 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6837 {
6838         struct mgmt_pending_cmd *cmd = data;
6839         struct mgmt_mode *cp;
6840
6841         bt_dev_dbg(hdev, "err %d", err);
6842
6843         if (err) {
6844                 u8 mgmt_err = mgmt_status(err);
6845
6846                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6847                 goto done;
6848         }
6849
6850         cp = cmd->param;
6851
6852         switch (cp->val) {
6853         case 0x00:
6854                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6855                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6856                 break;
6857         case 0x01:
6858                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6859                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6860                 break;
6861         case 0x02:
6862                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6863                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6864                 break;
6865         }
6866
6867         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6868         new_settings(hdev, cmd->sk);
6869
6870 done:
6871         mgmt_pending_free(cmd);
6872 }
6873
6874 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6875 {
6876         struct mgmt_pending_cmd *cmd = data;
6877         struct mgmt_mode *cp = cmd->param;
6878         u8 val = !!cp->val;
6879
6880         /* Force write of val */
6881         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6882
6883         return hci_write_sc_support_sync(hdev, val);
6884 }
6885
6886 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6887                            void *data, u16 len)
6888 {
6889         struct mgmt_mode *cp = data;
6890         struct mgmt_pending_cmd *cmd;
6891         u8 val;
6892         int err;
6893
6894         bt_dev_dbg(hdev, "sock %p", sk);
6895
6896         if (!lmp_sc_capable(hdev) &&
6897             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6898                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6899                                        MGMT_STATUS_NOT_SUPPORTED);
6900
6901         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6902             lmp_sc_capable(hdev) &&
6903             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6904                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6905                                        MGMT_STATUS_REJECTED);
6906
6907         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6908                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6909                                        MGMT_STATUS_INVALID_PARAMS);
6910
6911         hci_dev_lock(hdev);
6912
6913         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6914             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6915                 bool changed;
6916
6917                 if (cp->val) {
6918                         changed = !hci_dev_test_and_set_flag(hdev,
6919                                                              HCI_SC_ENABLED);
6920                         if (cp->val == 0x02)
6921                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6922                         else
6923                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6924                 } else {
6925                         changed = hci_dev_test_and_clear_flag(hdev,
6926                                                               HCI_SC_ENABLED);
6927                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6928                 }
6929
6930                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6931                 if (err < 0)
6932                         goto failed;
6933
6934                 if (changed)
6935                         err = new_settings(hdev, sk);
6936
6937                 goto failed;
6938         }
6939
6940         val = !!cp->val;
6941
6942         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6943             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6944                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6945                 goto failed;
6946         }
6947
6948         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6949         if (!cmd)
6950                 err = -ENOMEM;
6951         else
6952                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6953                                          set_secure_conn_complete);
6954
6955         if (err < 0) {
6956                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6957                                 MGMT_STATUS_FAILED);
6958                 if (cmd)
6959                         mgmt_pending_free(cmd);
6960         }
6961
6962 failed:
6963         hci_dev_unlock(hdev);
6964         return err;
6965 }
6966
6967 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6968                           void *data, u16 len)
6969 {
6970         struct mgmt_mode *cp = data;
6971         bool changed, use_changed;
6972         int err;
6973
6974         bt_dev_dbg(hdev, "sock %p", sk);
6975
6976         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6977                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6978                                        MGMT_STATUS_INVALID_PARAMS);
6979
6980         hci_dev_lock(hdev);
6981
6982         if (cp->val)
6983                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6984         else
6985                 changed = hci_dev_test_and_clear_flag(hdev,
6986                                                       HCI_KEEP_DEBUG_KEYS);
6987
6988         if (cp->val == 0x02)
6989                 use_changed = !hci_dev_test_and_set_flag(hdev,
6990                                                          HCI_USE_DEBUG_KEYS);
6991         else
6992                 use_changed = hci_dev_test_and_clear_flag(hdev,
6993                                                           HCI_USE_DEBUG_KEYS);
6994
6995         if (hdev_is_powered(hdev) && use_changed &&
6996             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6997                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6998                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6999                              sizeof(mode), &mode);
7000         }
7001
7002         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
7003         if (err < 0)
7004                 goto unlock;
7005
7006         if (changed)
7007                 err = new_settings(hdev, sk);
7008
7009 unlock:
7010         hci_dev_unlock(hdev);
7011         return err;
7012 }
7013
7014 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7015                        u16 len)
7016 {
7017         struct mgmt_cp_set_privacy *cp = cp_data;
7018         bool changed;
7019         int err;
7020
7021         bt_dev_dbg(hdev, "sock %p", sk);
7022
7023         if (!lmp_le_capable(hdev))
7024                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7025                                        MGMT_STATUS_NOT_SUPPORTED);
7026
7027         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7028                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7029                                        MGMT_STATUS_INVALID_PARAMS);
7030
7031         if (hdev_is_powered(hdev))
7032                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7033                                        MGMT_STATUS_REJECTED);
7034
7035         hci_dev_lock(hdev);
7036
7037         /* If user space supports this command it is also expected to
7038          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7039          */
7040         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7041
7042         if (cp->privacy) {
7043                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7044                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7045                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7046                 hci_adv_instances_set_rpa_expired(hdev, true);
7047                 if (cp->privacy == 0x02)
7048                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7049                 else
7050                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7051         } else {
7052                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7053                 memset(hdev->irk, 0, sizeof(hdev->irk));
7054                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7055                 hci_adv_instances_set_rpa_expired(hdev, false);
7056                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7057         }
7058
7059         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7060         if (err < 0)
7061                 goto unlock;
7062
7063         if (changed)
7064                 err = new_settings(hdev, sk);
7065
7066 unlock:
7067         hci_dev_unlock(hdev);
7068         return err;
7069 }
7070
7071 static bool irk_is_valid(struct mgmt_irk_info *irk)
7072 {
7073         switch (irk->addr.type) {
7074         case BDADDR_LE_PUBLIC:
7075                 return true;
7076
7077         case BDADDR_LE_RANDOM:
7078                 /* Two most significant bits shall be set */
7079                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7080                         return false;
7081                 return true;
7082         }
7083
7084         return false;
7085 }
7086
7087 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7088                      u16 len)
7089 {
7090         struct mgmt_cp_load_irks *cp = cp_data;
7091         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7092                                    sizeof(struct mgmt_irk_info));
7093         u16 irk_count, expected_len;
7094         int i, err;
7095
7096         bt_dev_dbg(hdev, "sock %p", sk);
7097
7098         if (!lmp_le_capable(hdev))
7099                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7100                                        MGMT_STATUS_NOT_SUPPORTED);
7101
7102         irk_count = __le16_to_cpu(cp->irk_count);
7103         if (irk_count > max_irk_count) {
7104                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7105                            irk_count);
7106                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7107                                        MGMT_STATUS_INVALID_PARAMS);
7108         }
7109
7110         expected_len = struct_size(cp, irks, irk_count);
7111         if (expected_len != len) {
7112                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7113                            expected_len, len);
7114                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7115                                        MGMT_STATUS_INVALID_PARAMS);
7116         }
7117
7118         bt_dev_dbg(hdev, "irk_count %u", irk_count);
7119
7120         for (i = 0; i < irk_count; i++) {
7121                 struct mgmt_irk_info *key = &cp->irks[i];
7122
7123                 if (!irk_is_valid(key))
7124                         return mgmt_cmd_status(sk, hdev->id,
7125                                                MGMT_OP_LOAD_IRKS,
7126                                                MGMT_STATUS_INVALID_PARAMS);
7127         }
7128
7129         hci_dev_lock(hdev);
7130
7131         hci_smp_irks_clear(hdev);
7132
7133         for (i = 0; i < irk_count; i++) {
7134                 struct mgmt_irk_info *irk = &cp->irks[i];
7135
7136                 if (hci_is_blocked_key(hdev,
7137                                        HCI_BLOCKED_KEY_TYPE_IRK,
7138                                        irk->val)) {
7139                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7140                                     &irk->addr.bdaddr);
7141                         continue;
7142                 }
7143
7144                 hci_add_irk(hdev, &irk->addr.bdaddr,
7145                             le_addr_type(irk->addr.type), irk->val,
7146                             BDADDR_ANY);
7147         }
7148
7149         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7150
7151         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7152
7153         hci_dev_unlock(hdev);
7154
7155         return err;
7156 }
7157
7158 #ifdef TIZEN_BT
7159 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
7160                         void *data, u16 len)
7161 {
7162         struct mgmt_cp_set_advertising_params *cp = data;
7163         __u16 min_interval;
7164         __u16 max_interval;
7165         int err;
7166
7167         BT_DBG("%s", hdev->name);
7168
7169         if (!lmp_le_capable(hdev))
7170                 return mgmt_cmd_status(sk, hdev->id,
7171                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7172                                 MGMT_STATUS_NOT_SUPPORTED);
7173
7174         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7175                 return mgmt_cmd_status(sk, hdev->id,
7176                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7177                                 MGMT_STATUS_BUSY);
7178
7179         min_interval = __le16_to_cpu(cp->interval_min);
7180         max_interval = __le16_to_cpu(cp->interval_max);
7181
7182         if (min_interval > max_interval ||
7183             min_interval < 0x0020 || max_interval > 0x4000)
7184                 return mgmt_cmd_status(sk, hdev->id,
7185                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7186                                 MGMT_STATUS_INVALID_PARAMS);
7187
7188         hci_dev_lock(hdev);
7189
7190         hdev->le_adv_min_interval = min_interval;
7191         hdev->le_adv_max_interval = max_interval;
7192         hdev->adv_filter_policy = cp->filter_policy;
7193         hdev->adv_type = cp->type;
7194
7195         err = mgmt_cmd_complete(sk, hdev->id,
7196                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
7197
7198         hci_dev_unlock(hdev);
7199
7200         return err;
7201 }
7202
7203 static void set_advertising_data_complete(struct hci_dev *hdev,
7204                         u8 status, u16 opcode)
7205 {
7206         struct mgmt_cp_set_advertising_data *cp;
7207         struct mgmt_pending_cmd *cmd;
7208
7209         BT_DBG("status 0x%02x", status);
7210
7211         hci_dev_lock(hdev);
7212
7213         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
7214         if (!cmd)
7215                 goto unlock;
7216
7217         cp = cmd->param;
7218
7219         if (status)
7220                 mgmt_cmd_status(cmd->sk, hdev->id,
7221                                 MGMT_OP_SET_ADVERTISING_DATA,
7222                                 mgmt_status(status));
7223         else
7224                 mgmt_cmd_complete(cmd->sk, hdev->id,
7225                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
7226                                 cp, sizeof(*cp));
7227
7228         mgmt_pending_remove(cmd);
7229
7230 unlock:
7231         hci_dev_unlock(hdev);
7232 }
7233
7234 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
7235                         void *data, u16 len)
7236 {
7237         struct mgmt_pending_cmd *cmd;
7238         struct hci_request req;
7239         struct mgmt_cp_set_advertising_data *cp = data;
7240         struct hci_cp_le_set_adv_data adv;
7241         int err;
7242
7243         BT_DBG("%s", hdev->name);
7244
7245         if (!lmp_le_capable(hdev)) {
7246                 return mgmt_cmd_status(sk, hdev->id,
7247                                 MGMT_OP_SET_ADVERTISING_DATA,
7248                                 MGMT_STATUS_NOT_SUPPORTED);
7249         }
7250
7251         hci_dev_lock(hdev);
7252
7253         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
7254                 err = mgmt_cmd_status(sk, hdev->id,
7255                                 MGMT_OP_SET_ADVERTISING_DATA,
7256                                 MGMT_STATUS_BUSY);
7257                 goto unlocked;
7258         }
7259
7260         if (len > HCI_MAX_AD_LENGTH) {
7261                 err = mgmt_cmd_status(sk, hdev->id,
7262                                 MGMT_OP_SET_ADVERTISING_DATA,
7263                                 MGMT_STATUS_INVALID_PARAMS);
7264                 goto unlocked;
7265         }
7266
7267         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
7268                                hdev, data, len);
7269         if (!cmd) {
7270                 err = -ENOMEM;
7271                 goto unlocked;
7272         }
7273
7274         hci_req_init(&req, hdev);
7275
7276         memset(&adv, 0, sizeof(adv));
7277         memcpy(adv.data, cp->data, len);
7278         adv.length = len;
7279
7280         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
7281
7282         err = hci_req_run(&req, set_advertising_data_complete);
7283         if (err < 0)
7284                 mgmt_pending_remove(cmd);
7285
7286 unlocked:
7287         hci_dev_unlock(hdev);
7288
7289         return err;
7290 }
7291
7292 /* Adv White List feature */
7293 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7294 {
7295         struct mgmt_cp_add_dev_white_list *cp;
7296         struct mgmt_pending_cmd *cmd;
7297
7298         BT_DBG("status 0x%02x", status);
7299
7300         hci_dev_lock(hdev);
7301
7302         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
7303         if (!cmd)
7304                 goto unlock;
7305
7306         cp = cmd->param;
7307
7308         if (status)
7309                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7310                            mgmt_status(status));
7311         else
7312                 mgmt_cmd_complete(cmd->sk, hdev->id,
7313                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
7314
7315         mgmt_pending_remove(cmd);
7316
7317 unlock:
7318         hci_dev_unlock(hdev);
7319 }
7320
7321 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
7322                            void *data, u16 len)
7323 {
7324         struct mgmt_pending_cmd *cmd;
7325         struct mgmt_cp_add_dev_white_list *cp = data;
7326         struct hci_request req;
7327         int err;
7328
7329         BT_DBG("%s", hdev->name);
7330
7331         if (!lmp_le_capable(hdev))
7332                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7333                                   MGMT_STATUS_NOT_SUPPORTED);
7334
7335         if (!hdev_is_powered(hdev))
7336                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7337                                   MGMT_STATUS_REJECTED);
7338
7339         hci_dev_lock(hdev);
7340
7341         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
7342                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7343                                 MGMT_STATUS_BUSY);
7344                 goto unlocked;
7345         }
7346
7347         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
7348         if (!cmd) {
7349                 err = -ENOMEM;
7350                 goto unlocked;
7351         }
7352
7353         hci_req_init(&req, hdev);
7354
7355         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
7356
7357         err = hci_req_run(&req, add_white_list_complete);
7358         if (err < 0) {
7359                 mgmt_pending_remove(cmd);
7360                 goto unlocked;
7361         }
7362
7363 unlocked:
7364         hci_dev_unlock(hdev);
7365
7366         return err;
7367 }
7368
7369 static void remove_from_white_list_complete(struct hci_dev *hdev,
7370                         u8 status, u16 opcode)
7371 {
7372         struct mgmt_cp_remove_dev_from_white_list *cp;
7373         struct mgmt_pending_cmd *cmd;
7374
7375         BT_DBG("status 0x%02x", status);
7376
7377         hci_dev_lock(hdev);
7378
7379         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
7380         if (!cmd)
7381                 goto unlock;
7382
7383         cp = cmd->param;
7384
7385         if (status)
7386                 mgmt_cmd_status(cmd->sk, hdev->id,
7387                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7388                         mgmt_status(status));
7389         else
7390                 mgmt_cmd_complete(cmd->sk, hdev->id,
7391                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
7392                         cp, sizeof(*cp));
7393
7394         mgmt_pending_remove(cmd);
7395
7396 unlock:
7397         hci_dev_unlock(hdev);
7398 }
7399
7400 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
7401                            void *data, u16 len)
7402 {
7403         struct mgmt_pending_cmd *cmd;
7404         struct mgmt_cp_remove_dev_from_white_list *cp = data;
7405         struct hci_request req;
7406         int err;
7407
7408         BT_DBG("%s", hdev->name);
7409
7410         if (!lmp_le_capable(hdev))
7411                 return mgmt_cmd_status(sk, hdev->id,
7412                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7413                                 MGMT_STATUS_NOT_SUPPORTED);
7414
7415         if (!hdev_is_powered(hdev))
7416                 return mgmt_cmd_status(sk, hdev->id,
7417                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7418                                 MGMT_STATUS_REJECTED);
7419
7420         hci_dev_lock(hdev);
7421
7422         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
7423                 err = mgmt_cmd_status(sk, hdev->id,
7424                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7425                                 MGMT_STATUS_BUSY);
7426                 goto unlocked;
7427         }
7428
7429         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7430                                 hdev, data, len);
7431         if (!cmd) {
7432                 err = -ENOMEM;
7433                 goto unlocked;
7434         }
7435
7436         hci_req_init(&req, hdev);
7437
7438         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
7439
7440         err = hci_req_run(&req, remove_from_white_list_complete);
7441         if (err < 0) {
7442                 mgmt_pending_remove(cmd);
7443                 goto unlocked;
7444         }
7445
7446 unlocked:
7447         hci_dev_unlock(hdev);
7448
7449         return err;
7450 }
7451
7452 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
7453                         u16 opcode)
7454 {
7455         struct mgmt_pending_cmd *cmd;
7456
7457         BT_DBG("status 0x%02x", status);
7458
7459         hci_dev_lock(hdev);
7460
7461         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
7462         if (!cmd)
7463                 goto unlock;
7464
7465         if (status)
7466                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7467                            mgmt_status(status));
7468         else
7469                 mgmt_cmd_complete(cmd->sk, hdev->id,
7470                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7471                                 0, NULL, 0);
7472
7473         mgmt_pending_remove(cmd);
7474
7475 unlock:
7476         hci_dev_unlock(hdev);
7477 }
7478
7479 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
7480                            void *data, u16 len)
7481 {
7482         struct mgmt_pending_cmd *cmd;
7483         struct hci_request req;
7484         int err;
7485
7486         BT_DBG("%s", hdev->name);
7487
7488         if (!lmp_le_capable(hdev))
7489                 return mgmt_cmd_status(sk, hdev->id,
7490                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7491                                 MGMT_STATUS_NOT_SUPPORTED);
7492
7493         if (!hdev_is_powered(hdev))
7494                 return mgmt_cmd_status(sk, hdev->id,
7495                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7496                                 MGMT_STATUS_REJECTED);
7497
7498         hci_dev_lock(hdev);
7499
7500         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
7501                 err = mgmt_cmd_status(sk, hdev->id,
7502                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7503                                 MGMT_STATUS_BUSY);
7504                 goto unlocked;
7505         }
7506
7507         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7508                                 hdev, NULL, 0);
7509         if (!cmd) {
7510                 err = -ENOMEM;
7511                 goto unlocked;
7512         }
7513
7514         hci_req_init(&req, hdev);
7515
7516         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
7517
7518         err = hci_req_run(&req, clear_white_list_complete);
7519         if (err < 0) {
7520                 mgmt_pending_remove(cmd);
7521                 goto unlocked;
7522         }
7523
7524 unlocked:
7525         hci_dev_unlock(hdev);
7526
7527         return err;
7528 }
7529
7530 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
7531                         u16 opcode)
7532 {
7533         struct mgmt_cp_set_scan_rsp_data *cp;
7534         struct mgmt_pending_cmd *cmd;
7535
7536         BT_DBG("status 0x%02x", status);
7537
7538         hci_dev_lock(hdev);
7539
7540         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
7541         if (!cmd)
7542                 goto unlock;
7543
7544         cp = cmd->param;
7545
7546         if (status)
7547                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7548                                 mgmt_status(status));
7549         else
7550                 mgmt_cmd_complete(cmd->sk, hdev->id,
7551                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
7552                                 cp, sizeof(*cp));
7553
7554         mgmt_pending_remove(cmd);
7555
7556 unlock:
7557         hci_dev_unlock(hdev);
7558 }
7559
7560 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
7561                         u16 len)
7562 {
7563         struct mgmt_pending_cmd *cmd;
7564         struct hci_request req;
7565         struct mgmt_cp_set_scan_rsp_data *cp = data;
7566         struct hci_cp_le_set_scan_rsp_data rsp;
7567         int err;
7568
7569         BT_DBG("%s", hdev->name);
7570
7571         if (!lmp_le_capable(hdev))
7572                 return mgmt_cmd_status(sk, hdev->id,
7573                                 MGMT_OP_SET_SCAN_RSP_DATA,
7574                                 MGMT_STATUS_NOT_SUPPORTED);
7575
7576         hci_dev_lock(hdev);
7577
7578         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
7579                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7580                                 MGMT_STATUS_BUSY);
7581                 goto unlocked;
7582         }
7583
7584         if (len > HCI_MAX_AD_LENGTH) {
7585                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7586                                 MGMT_STATUS_INVALID_PARAMS);
7587                 goto unlocked;
7588         }
7589
7590         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
7591         if (!cmd) {
7592                 err = -ENOMEM;
7593                 goto unlocked;
7594         }
7595
7596         hci_req_init(&req, hdev);
7597
7598         memset(&rsp, 0, sizeof(rsp));
7599         memcpy(rsp.data, cp->data, len);
7600         rsp.length = len;
7601
7602         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
7603
7604         err = hci_req_run(&req, set_scan_rsp_data_complete);
7605         if (err < 0)
7606                 mgmt_pending_remove(cmd);
7607
7608 unlocked:
7609         hci_dev_unlock(hdev);
7610
7611         return err;
7612 }
7613
7614 static void set_rssi_threshold_complete(struct hci_dev *hdev,
7615                         u8 status, u16 opcode)
7616 {
7617         struct mgmt_pending_cmd *cmd;
7618
7619         BT_DBG("status 0x%02x", status);
7620
7621         hci_dev_lock(hdev);
7622
7623         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7624         if (!cmd)
7625                 goto unlock;
7626
7627         if (status)
7628                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7629                                 mgmt_status(status));
7630         else
7631                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7632                                 NULL, 0);
7633
7634         mgmt_pending_remove(cmd);
7635
7636 unlock:
7637         hci_dev_unlock(hdev);
7638 }
7639
7640 static void set_rssi_disable_complete(struct hci_dev *hdev,
7641                         u8 status, u16 opcode)
7642 {
7643         struct mgmt_pending_cmd *cmd;
7644
7645         BT_DBG("status 0x%02x", status);
7646
7647         hci_dev_lock(hdev);
7648
7649         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7650         if (!cmd)
7651                 goto unlock;
7652
7653         if (status)
7654                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7655                                 mgmt_status(status));
7656         else
7657                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7658                                 0, NULL, 0);
7659
7660         mgmt_pending_remove(cmd);
7661
7662 unlock:
7663         hci_dev_unlock(hdev);
7664 }
7665
7666 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
7667                 void *data, u16 len)
7668 {
7669         int err = 0;
7670         struct hci_cp_set_rssi_threshold th = { 0, };
7671         struct mgmt_cp_set_enable_rssi *cp = data;
7672         struct hci_conn *conn;
7673         struct mgmt_pending_cmd *cmd;
7674         struct hci_request req;
7675         __u8 dest_type;
7676
7677         hci_dev_lock(hdev);
7678
7679         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7680         if (!cmd) {
7681                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7682                                 MGMT_STATUS_FAILED);
7683                 goto unlocked;
7684         }
7685
7686         if (!lmp_le_capable(hdev)) {
7687                 mgmt_pending_remove(cmd);
7688                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7689                                 MGMT_STATUS_NOT_SUPPORTED);
7690                 goto unlocked;
7691         }
7692
7693         if (!hdev_is_powered(hdev)) {
7694                 BT_DBG("%s", hdev->name);
7695                 mgmt_pending_remove(cmd);
7696                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7697                                 MGMT_STATUS_NOT_POWERED);
7698                 goto unlocked;
7699         }
7700
7701         if (cp->link_type == 0x01)
7702                 dest_type = LE_LINK;
7703         else
7704                 dest_type = ACL_LINK;
7705
7706         /* Get LE/ACL link handle info */
7707         conn = hci_conn_hash_lookup_ba(hdev,
7708                         dest_type, &cp->bdaddr);
7709
7710         if (!conn) {
7711                 err = mgmt_cmd_complete(sk, hdev->id,
7712                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
7713                 mgmt_pending_remove(cmd);
7714                 goto unlocked;
7715         }
7716
7717         hci_req_init(&req, hdev);
7718
7719         th.hci_le_ext_opcode = 0x0B;
7720         th.mode = 0x01;
7721         th.conn_handle = conn->handle;
7722         th.alert_mask = 0x07;
7723         th.low_th = cp->low_th;
7724         th.in_range_th = cp->in_range_th;
7725         th.high_th = cp->high_th;
7726
7727         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7728         err = hci_req_run(&req, set_rssi_threshold_complete);
7729
7730         if (err < 0) {
7731                 mgmt_pending_remove(cmd);
7732                 BT_ERR("Error in requesting hci_req_run");
7733                 goto unlocked;
7734         }
7735
7736 unlocked:
7737         hci_dev_unlock(hdev);
7738         return err;
7739 }
7740
7741 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
7742                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7743 {
7744         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
7745         struct mgmt_cp_set_enable_rssi *cp = data;
7746         struct mgmt_pending_cmd *cmd;
7747
7748         if (!cp || !rp)
7749                 goto remove_cmd;
7750
7751         mgmt_rp.status = rp->status;
7752         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7753         mgmt_rp.bt_address = cp->bdaddr;
7754         mgmt_rp.link_type = cp->link_type;
7755
7756         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7757                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7758                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7759
7760         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
7761                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7762
7763         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
7764         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7765                         &mgmt_rp.bt_address, true);
7766
7767 remove_cmd:
7768         hci_dev_lock(hdev);
7769         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7770         if (cmd)
7771                 mgmt_pending_remove(cmd);
7772
7773         hci_dev_unlock(hdev);
7774 }
7775
7776 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
7777                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7778 {
7779         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
7780         struct mgmt_cp_disable_rssi *cp = data;
7781         struct mgmt_pending_cmd *cmd;
7782
7783         if (!cp || !rp)
7784                 goto remove_cmd;
7785
7786         mgmt_rp.status = rp->status;
7787         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7788         mgmt_rp.bt_address = cp->bdaddr;
7789         mgmt_rp.link_type = cp->link_type;
7790
7791         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7792                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7793                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7794
7795         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
7796                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7797
7798         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7799                         &mgmt_rp.bt_address, false);
7800
7801 remove_cmd:
7802         hci_dev_lock(hdev);
7803         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7804         if (cmd)
7805                 mgmt_pending_remove(cmd);
7806
7807         hci_dev_unlock(hdev);
7808 }
7809
7810 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
7811                 void *data, u16 len)
7812 {
7813         struct mgmt_pending_cmd *cmd;
7814         struct hci_request req;
7815         struct hci_cp_set_enable_rssi cp_en = { 0, };
7816         int err;
7817
7818         BT_DBG("Set Disable RSSI.");
7819
7820         cp_en.hci_le_ext_opcode = 0x01;
7821         cp_en.le_enable_cs_Features = 0x00;
7822         cp_en.data[0] = 0x00;
7823         cp_en.data[1] = 0x00;
7824         cp_en.data[2] = 0x00;
7825
7826         hci_dev_lock(hdev);
7827
7828         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7829         if (!cmd) {
7830                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7831                                 MGMT_STATUS_FAILED);
7832                 goto unlocked;
7833         }
7834
7835         if (!lmp_le_capable(hdev)) {
7836                 mgmt_pending_remove(cmd);
7837                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7838                                 MGMT_STATUS_NOT_SUPPORTED);
7839                 goto unlocked;
7840         }
7841
7842         if (!hdev_is_powered(hdev)) {
7843                 BT_DBG("%s", hdev->name);
7844                 mgmt_pending_remove(cmd);
7845                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7846                                 MGMT_STATUS_NOT_POWERED);
7847                 goto unlocked;
7848         }
7849
7850         hci_req_init(&req, hdev);
7851
7852         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7853                         sizeof(struct hci_cp_set_enable_rssi),
7854                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7855                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7856
7857         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7858         err = hci_req_run(&req, set_rssi_disable_complete);
7859
7860         if (err < 0) {
7861                 mgmt_pending_remove(cmd);
7862                 BT_ERR("Error in requesting hci_req_run");
7863                 goto unlocked;
7864         }
7865
7866 unlocked:
7867         hci_dev_unlock(hdev);
7868         return err;
7869 }
7870
7871 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
7872 {
7873         struct hci_cc_rsp_enable_rssi *rp = response;
7874         struct mgmt_pending_cmd *cmd_enable = NULL;
7875         struct mgmt_pending_cmd *cmd_disable = NULL;
7876         struct mgmt_cp_set_enable_rssi *cp_en;
7877         struct mgmt_cp_disable_rssi *cp_dis;
7878
7879         hci_dev_lock(hdev);
7880         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7881         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7882         hci_dev_unlock(hdev);
7883
7884         if (cmd_enable)
7885                 BT_DBG("Enable Request");
7886
7887         if (cmd_disable)
7888                 BT_DBG("Disable Request");
7889
7890         if (cmd_enable) {
7891                 cp_en = cmd_enable->param;
7892
7893                 if (status != 0x00)
7894                         return;
7895
7896                 switch (rp->le_ext_opcode) {
7897                 case 0x01:
7898                         BT_DBG("RSSI enabled.. Setting Threshold...");
7899                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
7900                                         cp_en, sizeof(*cp_en));
7901                         break;
7902
7903                 case 0x0B:
7904                         BT_DBG("Sending RSSI enable success");
7905                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
7906                                         cp_en, rp, rp->status);
7907                         break;
7908                 }
7909
7910         } else if (cmd_disable) {
7911                 cp_dis = cmd_disable->param;
7912
7913                 if (status != 0x00)
7914                         return;
7915
7916                 switch (rp->le_ext_opcode) {
7917                 case 0x01:
7918                         BT_DBG("Sending RSSI disable success");
7919                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7920                                         cp_dis, rp, rp->status);
7921                         break;
7922
7923                 case 0x0B:
7924                         /*
7925                          * Only unset RSSI Threshold values for the Link if
7926                          * RSSI is monitored for other BREDR or LE Links
7927                          */
7928                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
7929                                 BT_DBG("Unset Threshold. Other links being monitored");
7930                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7931                                                 cp_dis, rp, rp->status);
7932                         } else {
7933                                 BT_DBG("Unset Threshold. Disabling...");
7934                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
7935                                                 cp_dis, sizeof(*cp_dis));
7936                         }
7937                         break;
7938                 }
7939         }
7940 }
7941
7942 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
7943                 u16 opcode)
7944 {
7945         struct mgmt_pending_cmd *cmd;
7946
7947         BT_DBG("status 0x%02x", status);
7948
7949         hci_dev_lock(hdev);
7950
7951         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7952         if (!cmd)
7953                 goto unlock;
7954
7955         if (status)
7956                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7957                                 mgmt_status(status));
7958         else
7959                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7960                                 NULL, 0);
7961
7962         mgmt_pending_remove(cmd);
7963
7964 unlock:
7965         hci_dev_unlock(hdev);
7966 }
7967
7968 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7969                 void *data, u16 len)
7970 {
7971         struct mgmt_pending_cmd *cmd;
7972         struct hci_request req;
7973         struct mgmt_cp_set_enable_rssi *cp = data;
7974         struct hci_cp_set_enable_rssi cp_en = { 0, };
7975         int err;
7976
7977         BT_DBG("Set Enable RSSI.");
7978
7979         cp_en.hci_le_ext_opcode = 0x01;
7980         cp_en.le_enable_cs_Features = 0x04;
7981         cp_en.data[0] = 0x00;
7982         cp_en.data[1] = 0x00;
7983         cp_en.data[2] = 0x00;
7984
7985         hci_dev_lock(hdev);
7986
7987         if (!lmp_le_capable(hdev)) {
7988                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7989                                 MGMT_STATUS_NOT_SUPPORTED);
7990                 goto unlocked;
7991         }
7992
7993         if (!hdev_is_powered(hdev)) {
7994                 BT_DBG("%s", hdev->name);
7995                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7996                                 MGMT_STATUS_NOT_POWERED);
7997                 goto unlocked;
7998         }
7999
8000         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
8001                 BT_DBG("%s", hdev->name);
8002                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
8003                                 MGMT_STATUS_BUSY);
8004                 goto unlocked;
8005         }
8006
8007         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
8008                         sizeof(*cp));
8009         if (!cmd) {
8010                 BT_DBG("%s", hdev->name);
8011                 err = -ENOMEM;
8012                 goto unlocked;
8013         }
8014
8015         /* If RSSI is already enabled directly set Threshold values */
8016         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
8017                 hci_dev_unlock(hdev);
8018                 BT_DBG("RSSI Enabled. Directly set Threshold");
8019                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
8020                 return err;
8021         }
8022
8023         hci_req_init(&req, hdev);
8024
8025         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
8026                         sizeof(struct hci_cp_set_enable_rssi),
8027                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
8028                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
8029
8030         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
8031         err = hci_req_run(&req, set_rssi_enable_complete);
8032
8033         if (err < 0) {
8034                 mgmt_pending_remove(cmd);
8035                 BT_ERR("Error in requesting hci_req_run");
8036                 goto unlocked;
8037         }
8038
8039 unlocked:
8040         hci_dev_unlock(hdev);
8041
8042         return err;
8043 }
8044
8045 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8046 {
8047         struct mgmt_pending_cmd *cmd;
8048
8049         BT_DBG("status 0x%02x", status);
8050
8051         hci_dev_lock(hdev);
8052
8053         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
8054         if (!cmd)
8055                 goto unlock;
8056
8057         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8058                         MGMT_STATUS_SUCCESS, &status, 1);
8059
8060         mgmt_pending_remove(cmd);
8061
8062 unlock:
8063         hci_dev_unlock(hdev);
8064 }
8065
8066 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
8067                         u16 len)
8068 {
8069         struct mgmt_pending_cmd *cmd;
8070         struct hci_request req;
8071         struct mgmt_cp_get_raw_rssi *cp = data;
8072         struct hci_cp_get_raw_rssi hci_cp;
8073
8074         struct hci_conn *conn;
8075         int err;
8076         __u8 dest_type;
8077
8078         BT_DBG("Get Raw RSSI.");
8079
8080         hci_dev_lock(hdev);
8081
8082         if (!lmp_le_capable(hdev)) {
8083                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8084                                 MGMT_STATUS_NOT_SUPPORTED);
8085                 goto unlocked;
8086         }
8087
8088         if (cp->link_type == 0x01)
8089                 dest_type = LE_LINK;
8090         else
8091                 dest_type = ACL_LINK;
8092
8093         /* Get LE/BREDR link handle info */
8094         conn = hci_conn_hash_lookup_ba(hdev,
8095                         dest_type, &cp->bt_address);
8096         if (!conn) {
8097                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8098                                                    MGMT_STATUS_NOT_CONNECTED);
8099                 goto unlocked;
8100         }
8101         hci_cp.conn_handle = conn->handle;
8102
8103         if (!hdev_is_powered(hdev)) {
8104                 BT_DBG("%s", hdev->name);
8105                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8106                                 MGMT_STATUS_NOT_POWERED);
8107                 goto unlocked;
8108         }
8109
8110         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
8111                 BT_DBG("%s", hdev->name);
8112                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8113                                 MGMT_STATUS_BUSY);
8114                 goto unlocked;
8115         }
8116
8117         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
8118         if (!cmd) {
8119                 BT_DBG("%s", hdev->name);
8120                 err = -ENOMEM;
8121                 goto unlocked;
8122         }
8123
8124         hci_req_init(&req, hdev);
8125
8126         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
8127         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
8128         err = hci_req_run(&req, get_raw_rssi_complete);
8129
8130         if (err < 0) {
8131                 mgmt_pending_remove(cmd);
8132                 BT_ERR("Error in requesting hci_req_run");
8133         }
8134
8135 unlocked:
8136         hci_dev_unlock(hdev);
8137
8138         return err;
8139 }
8140
8141 void mgmt_raw_rssi_response(struct hci_dev *hdev,
8142                 struct hci_cc_rp_get_raw_rssi *rp, int success)
8143 {
8144         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
8145         struct hci_conn *conn;
8146
8147         mgmt_rp.status = rp->status;
8148         mgmt_rp.rssi_dbm = rp->rssi_dbm;
8149
8150         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
8151         if (!conn)
8152                 return;
8153
8154         bacpy(&mgmt_rp.bt_address, &conn->dst);
8155         if (conn->type == LE_LINK)
8156                 mgmt_rp.link_type = 0x01;
8157         else
8158                 mgmt_rp.link_type = 0x00;
8159
8160         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
8161                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
8162 }
8163
8164 static void set_disable_threshold_complete(struct hci_dev *hdev,
8165                         u8 status, u16 opcode)
8166 {
8167         struct mgmt_pending_cmd *cmd;
8168
8169         BT_DBG("status 0x%02x", status);
8170
8171         hci_dev_lock(hdev);
8172
8173         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
8174         if (!cmd)
8175                 goto unlock;
8176
8177         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8178                         MGMT_STATUS_SUCCESS, &status, 1);
8179
8180         mgmt_pending_remove(cmd);
8181
8182 unlock:
8183         hci_dev_unlock(hdev);
8184 }
8185
8186 /** Removes monitoring for a link*/
8187 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
8188                 void *data, u16 len)
8189 {
8190         int err = 0;
8191         struct hci_cp_set_rssi_threshold th = { 0, };
8192         struct mgmt_cp_disable_rssi *cp = data;
8193         struct hci_conn *conn;
8194         struct mgmt_pending_cmd *cmd;
8195         struct hci_request req;
8196         __u8 dest_type;
8197
8198         BT_DBG("Set Disable RSSI.");
8199
8200         hci_dev_lock(hdev);
8201
8202         if (!lmp_le_capable(hdev)) {
8203                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8204                                 MGMT_STATUS_NOT_SUPPORTED);
8205                 goto unlocked;
8206         }
8207
8208         /* Get LE/ACL link handle info*/
8209         if (cp->link_type == 0x01)
8210                 dest_type = LE_LINK;
8211         else
8212                 dest_type = ACL_LINK;
8213
8214         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
8215         if (!conn) {
8216                 err = mgmt_cmd_complete(sk, hdev->id,
8217                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
8218                 goto unlocked;
8219         }
8220
8221         th.hci_le_ext_opcode = 0x0B;
8222         th.mode = 0x01;
8223         th.conn_handle = conn->handle;
8224         th.alert_mask = 0x00;
8225         th.low_th = 0x00;
8226         th.in_range_th = 0x00;
8227         th.high_th = 0x00;
8228
8229         if (!hdev_is_powered(hdev)) {
8230                 BT_DBG("%s", hdev->name);
8231                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8232                                 0, data, len);
8233                 goto unlocked;
8234         }
8235
8236         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
8237                 BT_DBG("%s", hdev->name);
8238                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8239                                 MGMT_STATUS_BUSY);
8240                 goto unlocked;
8241         }
8242
8243         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
8244                         sizeof(*cp));
8245         if (!cmd) {
8246                 BT_DBG("%s", hdev->name);
8247                 err = -ENOMEM;
8248                 goto unlocked;
8249         }
8250
8251         hci_req_init(&req, hdev);
8252
8253         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
8254         err = hci_req_run(&req, set_disable_threshold_complete);
8255         if (err < 0) {
8256                 mgmt_pending_remove(cmd);
8257                 BT_ERR("Error in requesting hci_req_run");
8258                 goto unlocked;
8259         }
8260
8261 unlocked:
8262         hci_dev_unlock(hdev);
8263
8264         return err;
8265 }
8266
8267 void mgmt_rssi_alert_evt(struct hci_dev *hdev, struct sk_buff *skb)
8268 {
8269         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
8270         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
8271         struct hci_conn *conn;
8272
8273         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
8274                         ev->conn_handle, ev->alert_type, ev->rssi_dbm);
8275
8276         conn = hci_conn_hash_lookup_handle(hdev, ev->conn_handle);
8277
8278         if (!conn) {
8279                 BT_ERR("RSSI alert Error: Device not found for handle");
8280                 return;
8281         }
8282         bacpy(&mgmt_ev.bdaddr, &conn->dst);
8283
8284         if (conn->type == LE_LINK)
8285                 mgmt_ev.link_type = 0x01;
8286         else
8287                 mgmt_ev.link_type = 0x00;
8288
8289         mgmt_ev.alert_type = ev->alert_type;
8290         mgmt_ev.rssi_dbm = ev->rssi_dbm;
8291
8292         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
8293                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
8294                         NULL);
8295 }
8296 #endif /* TIZEN_BT */
8297
8298 static bool ltk_is_valid(struct mgmt_ltk_info *key)
8299 {
8300         if (key->initiator != 0x00 && key->initiator != 0x01)
8301                 return false;
8302
8303         switch (key->addr.type) {
8304         case BDADDR_LE_PUBLIC:
8305                 return true;
8306
8307         case BDADDR_LE_RANDOM:
8308                 /* Two most significant bits shall be set */
8309                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
8310                         return false;
8311                 return true;
8312         }
8313
8314         return false;
8315 }
8316
8317 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
8318                                void *cp_data, u16 len)
8319 {
8320         struct mgmt_cp_load_long_term_keys *cp = cp_data;
8321         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
8322                                    sizeof(struct mgmt_ltk_info));
8323         u16 key_count, expected_len;
8324         int i, err;
8325
8326         bt_dev_dbg(hdev, "sock %p", sk);
8327
8328         if (!lmp_le_capable(hdev))
8329                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8330                                        MGMT_STATUS_NOT_SUPPORTED);
8331
8332         key_count = __le16_to_cpu(cp->key_count);
8333         if (key_count > max_key_count) {
8334                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
8335                            key_count);
8336                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8337                                        MGMT_STATUS_INVALID_PARAMS);
8338         }
8339
8340         expected_len = struct_size(cp, keys, key_count);
8341         if (expected_len != len) {
8342                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
8343                            expected_len, len);
8344                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8345                                        MGMT_STATUS_INVALID_PARAMS);
8346         }
8347
8348         bt_dev_dbg(hdev, "key_count %u", key_count);
8349
8350         for (i = 0; i < key_count; i++) {
8351                 struct mgmt_ltk_info *key = &cp->keys[i];
8352
8353                 if (!ltk_is_valid(key))
8354                         return mgmt_cmd_status(sk, hdev->id,
8355                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
8356                                                MGMT_STATUS_INVALID_PARAMS);
8357         }
8358
8359         hci_dev_lock(hdev);
8360
8361         hci_smp_ltks_clear(hdev);
8362
8363         for (i = 0; i < key_count; i++) {
8364                 struct mgmt_ltk_info *key = &cp->keys[i];
8365                 u8 type, authenticated;
8366
8367                 if (hci_is_blocked_key(hdev,
8368                                        HCI_BLOCKED_KEY_TYPE_LTK,
8369                                        key->val)) {
8370                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
8371                                     &key->addr.bdaddr);
8372                         continue;
8373                 }
8374
8375                 switch (key->type) {
8376                 case MGMT_LTK_UNAUTHENTICATED:
8377                         authenticated = 0x00;
8378                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8379                         break;
8380                 case MGMT_LTK_AUTHENTICATED:
8381                         authenticated = 0x01;
8382                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8383                         break;
8384                 case MGMT_LTK_P256_UNAUTH:
8385                         authenticated = 0x00;
8386                         type = SMP_LTK_P256;
8387                         break;
8388                 case MGMT_LTK_P256_AUTH:
8389                         authenticated = 0x01;
8390                         type = SMP_LTK_P256;
8391                         break;
8392                 case MGMT_LTK_P256_DEBUG:
8393                         authenticated = 0x00;
8394                         type = SMP_LTK_P256_DEBUG;
8395                         fallthrough;
8396                 default:
8397                         continue;
8398                 }
8399
8400                 hci_add_ltk(hdev, &key->addr.bdaddr,
8401                             le_addr_type(key->addr.type), type, authenticated,
8402                             key->val, key->enc_size, key->ediv, key->rand);
8403         }
8404
8405         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
8406                            NULL, 0);
8407
8408         hci_dev_unlock(hdev);
8409
8410         return err;
8411 }
8412
8413 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
8414 {
8415         struct mgmt_pending_cmd *cmd = data;
8416         struct hci_conn *conn = cmd->user_data;
8417         struct mgmt_cp_get_conn_info *cp = cmd->param;
8418         struct mgmt_rp_get_conn_info rp;
8419         u8 status;
8420
8421         bt_dev_dbg(hdev, "err %d", err);
8422
8423         memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
8424
8425         status = mgmt_status(err);
8426         if (status == MGMT_STATUS_SUCCESS) {
8427                 rp.rssi = conn->rssi;
8428                 rp.tx_power = conn->tx_power;
8429                 rp.max_tx_power = conn->max_tx_power;
8430         } else {
8431                 rp.rssi = HCI_RSSI_INVALID;
8432                 rp.tx_power = HCI_TX_POWER_INVALID;
8433                 rp.max_tx_power = HCI_TX_POWER_INVALID;
8434         }
8435
8436         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
8437                           &rp, sizeof(rp));
8438
8439         mgmt_pending_free(cmd);
8440 }
8441
8442 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
8443 {
8444         struct mgmt_pending_cmd *cmd = data;
8445         struct mgmt_cp_get_conn_info *cp = cmd->param;
8446         struct hci_conn *conn;
8447         int err;
8448         __le16   handle;
8449
8450         /* Make sure we are still connected */
8451         if (cp->addr.type == BDADDR_BREDR)
8452                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8453                                                &cp->addr.bdaddr);
8454         else
8455                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8456
8457         if (!conn || conn->state != BT_CONNECTED)
8458                 return MGMT_STATUS_NOT_CONNECTED;
8459
8460         cmd->user_data = conn;
8461         handle = cpu_to_le16(conn->handle);
8462
8463         /* Refresh RSSI each time */
8464         err = hci_read_rssi_sync(hdev, handle);
8465
8466         /* For LE links TX power does not change thus we don't need to
8467          * query for it once value is known.
8468          */
8469         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
8470                      conn->tx_power == HCI_TX_POWER_INVALID))
8471                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
8472
8473         /* Max TX power needs to be read only once per connection */
8474         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
8475                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
8476
8477         return err;
8478 }
8479
8480 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
8481                          u16 len)
8482 {
8483         struct mgmt_cp_get_conn_info *cp = data;
8484         struct mgmt_rp_get_conn_info rp;
8485         struct hci_conn *conn;
8486         unsigned long conn_info_age;
8487         int err = 0;
8488
8489         bt_dev_dbg(hdev, "sock %p", sk);
8490
8491         memset(&rp, 0, sizeof(rp));
8492         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8493         rp.addr.type = cp->addr.type;
8494
8495         if (!bdaddr_type_is_valid(cp->addr.type))
8496                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8497                                          MGMT_STATUS_INVALID_PARAMS,
8498                                          &rp, sizeof(rp));
8499
8500         hci_dev_lock(hdev);
8501
8502         if (!hdev_is_powered(hdev)) {
8503                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8504                                         MGMT_STATUS_NOT_POWERED, &rp,
8505                                         sizeof(rp));
8506                 goto unlock;
8507         }
8508
8509         if (cp->addr.type == BDADDR_BREDR)
8510                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8511                                                &cp->addr.bdaddr);
8512         else
8513                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8514
8515         if (!conn || conn->state != BT_CONNECTED) {
8516                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8517                                         MGMT_STATUS_NOT_CONNECTED, &rp,
8518                                         sizeof(rp));
8519                 goto unlock;
8520         }
8521
8522         /* To avoid client trying to guess when to poll again for information we
8523          * calculate conn info age as random value between min/max set in hdev.
8524          */
8525         conn_info_age = hdev->conn_info_min_age +
8526                         prandom_u32_max(hdev->conn_info_max_age -
8527                                         hdev->conn_info_min_age);
8528
8529         /* Query controller to refresh cached values if they are too old or were
8530          * never read.
8531          */
8532         if (time_after(jiffies, conn->conn_info_timestamp +
8533                        msecs_to_jiffies(conn_info_age)) ||
8534             !conn->conn_info_timestamp) {
8535                 struct mgmt_pending_cmd *cmd;
8536
8537                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
8538                                        len);
8539                 if (!cmd) {
8540                         err = -ENOMEM;
8541                 } else {
8542                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
8543                                                  cmd, get_conn_info_complete);
8544                 }
8545
8546                 if (err < 0) {
8547                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8548                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
8549
8550                         if (cmd)
8551                                 mgmt_pending_free(cmd);
8552
8553                         goto unlock;
8554                 }
8555
8556                 conn->conn_info_timestamp = jiffies;
8557         } else {
8558                 /* Cache is valid, just reply with values cached in hci_conn */
8559                 rp.rssi = conn->rssi;
8560                 rp.tx_power = conn->tx_power;
8561                 rp.max_tx_power = conn->max_tx_power;
8562
8563                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8564                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8565         }
8566
8567 unlock:
8568         hci_dev_unlock(hdev);
8569         return err;
8570 }
8571
8572 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
8573 {
8574         struct mgmt_pending_cmd *cmd = data;
8575         struct mgmt_cp_get_clock_info *cp = cmd->param;
8576         struct mgmt_rp_get_clock_info rp;
8577         struct hci_conn *conn = cmd->user_data;
8578         u8 status = mgmt_status(err);
8579
8580         bt_dev_dbg(hdev, "err %d", err);
8581
8582         memset(&rp, 0, sizeof(rp));
8583         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8584         rp.addr.type = cp->addr.type;
8585
8586         if (err)
8587                 goto complete;
8588
8589         rp.local_clock = cpu_to_le32(hdev->clock);
8590
8591         if (conn) {
8592                 rp.piconet_clock = cpu_to_le32(conn->clock);
8593                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
8594         }
8595
8596 complete:
8597         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
8598                           sizeof(rp));
8599
8600         mgmt_pending_free(cmd);
8601 }
8602
8603 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
8604 {
8605         struct mgmt_pending_cmd *cmd = data;
8606         struct mgmt_cp_get_clock_info *cp = cmd->param;
8607         struct hci_cp_read_clock hci_cp;
8608         struct hci_conn *conn;
8609
8610         memset(&hci_cp, 0, sizeof(hci_cp));
8611         hci_read_clock_sync(hdev, &hci_cp);
8612
8613         /* Make sure connection still exists */
8614         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
8615         if (!conn || conn->state != BT_CONNECTED)
8616                 return MGMT_STATUS_NOT_CONNECTED;
8617
8618         cmd->user_data = conn;
8619         hci_cp.handle = cpu_to_le16(conn->handle);
8620         hci_cp.which = 0x01; /* Piconet clock */
8621
8622         return hci_read_clock_sync(hdev, &hci_cp);
8623 }
8624
8625 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8626                                                                 u16 len)
8627 {
8628         struct mgmt_cp_get_clock_info *cp = data;
8629         struct mgmt_rp_get_clock_info rp;
8630         struct mgmt_pending_cmd *cmd;
8631         struct hci_conn *conn;
8632         int err;
8633
8634         bt_dev_dbg(hdev, "sock %p", sk);
8635
8636         memset(&rp, 0, sizeof(rp));
8637         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8638         rp.addr.type = cp->addr.type;
8639
8640         if (cp->addr.type != BDADDR_BREDR)
8641                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8642                                          MGMT_STATUS_INVALID_PARAMS,
8643                                          &rp, sizeof(rp));
8644
8645         hci_dev_lock(hdev);
8646
8647         if (!hdev_is_powered(hdev)) {
8648                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8649                                         MGMT_STATUS_NOT_POWERED, &rp,
8650                                         sizeof(rp));
8651                 goto unlock;
8652         }
8653
8654         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8655                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8656                                                &cp->addr.bdaddr);
8657                 if (!conn || conn->state != BT_CONNECTED) {
8658                         err = mgmt_cmd_complete(sk, hdev->id,
8659                                                 MGMT_OP_GET_CLOCK_INFO,
8660                                                 MGMT_STATUS_NOT_CONNECTED,
8661                                                 &rp, sizeof(rp));
8662                         goto unlock;
8663                 }
8664         } else {
8665                 conn = NULL;
8666         }
8667
8668         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8669         if (!cmd)
8670                 err = -ENOMEM;
8671         else
8672                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
8673                                          get_clock_info_complete);
8674
8675         if (err < 0) {
8676                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8677                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
8678
8679                 if (cmd)
8680                         mgmt_pending_free(cmd);
8681         }
8682
8683
8684 unlock:
8685         hci_dev_unlock(hdev);
8686         return err;
8687 }
8688
8689 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8690 {
8691         struct hci_conn *conn;
8692
8693         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8694         if (!conn)
8695                 return false;
8696
8697         if (conn->dst_type != type)
8698                 return false;
8699
8700         if (conn->state != BT_CONNECTED)
8701                 return false;
8702
8703         return true;
8704 }
8705
8706 /* This function requires the caller holds hdev->lock */
8707 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
8708                                u8 addr_type, u8 auto_connect)
8709 {
8710         struct hci_conn_params *params;
8711
8712         params = hci_conn_params_add(hdev, addr, addr_type);
8713         if (!params)
8714                 return -EIO;
8715
8716         if (params->auto_connect == auto_connect)
8717                 return 0;
8718
8719         list_del_init(&params->action);
8720
8721         switch (auto_connect) {
8722         case HCI_AUTO_CONN_DISABLED:
8723         case HCI_AUTO_CONN_LINK_LOSS:
8724                 /* If auto connect is being disabled when we're trying to
8725                  * connect to device, keep connecting.
8726                  */
8727                 if (params->explicit_connect)
8728                         list_add(&params->action, &hdev->pend_le_conns);
8729                 break;
8730         case HCI_AUTO_CONN_REPORT:
8731                 if (params->explicit_connect)
8732                         list_add(&params->action, &hdev->pend_le_conns);
8733                 else
8734                         list_add(&params->action, &hdev->pend_le_reports);
8735                 break;
8736         case HCI_AUTO_CONN_DIRECT:
8737         case HCI_AUTO_CONN_ALWAYS:
8738                 if (!is_connected(hdev, addr, addr_type))
8739                         list_add(&params->action, &hdev->pend_le_conns);
8740                 break;
8741         }
8742
8743         params->auto_connect = auto_connect;
8744
8745         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
8746                    addr, addr_type, auto_connect);
8747
8748         return 0;
8749 }
8750
8751 static void device_added(struct sock *sk, struct hci_dev *hdev,
8752                          bdaddr_t *bdaddr, u8 type, u8 action)
8753 {
8754         struct mgmt_ev_device_added ev;
8755
8756         bacpy(&ev.addr.bdaddr, bdaddr);
8757         ev.addr.type = type;
8758         ev.action = action;
8759
8760         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
8761 }
8762
8763 static int add_device_sync(struct hci_dev *hdev, void *data)
8764 {
8765         return hci_update_passive_scan_sync(hdev);
8766 }
8767
8768 static int add_device(struct sock *sk, struct hci_dev *hdev,
8769                       void *data, u16 len)
8770 {
8771         struct mgmt_cp_add_device *cp = data;
8772         u8 auto_conn, addr_type;
8773         struct hci_conn_params *params;
8774         int err;
8775         u32 current_flags = 0;
8776         u32 supported_flags;
8777
8778         bt_dev_dbg(hdev, "sock %p", sk);
8779
8780         if (!bdaddr_type_is_valid(cp->addr.type) ||
8781             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
8782                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8783                                          MGMT_STATUS_INVALID_PARAMS,
8784                                          &cp->addr, sizeof(cp->addr));
8785
8786         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
8787                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8788                                          MGMT_STATUS_INVALID_PARAMS,
8789                                          &cp->addr, sizeof(cp->addr));
8790
8791         hci_dev_lock(hdev);
8792
8793         if (cp->addr.type == BDADDR_BREDR) {
8794                 /* Only incoming connections action is supported for now */
8795                 if (cp->action != 0x01) {
8796                         err = mgmt_cmd_complete(sk, hdev->id,
8797                                                 MGMT_OP_ADD_DEVICE,
8798                                                 MGMT_STATUS_INVALID_PARAMS,
8799                                                 &cp->addr, sizeof(cp->addr));
8800                         goto unlock;
8801                 }
8802
8803                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
8804                                                      &cp->addr.bdaddr,
8805                                                      cp->addr.type, 0);
8806                 if (err)
8807                         goto unlock;
8808
8809                 hci_update_scan(hdev);
8810
8811                 goto added;
8812         }
8813
8814         addr_type = le_addr_type(cp->addr.type);
8815
8816         if (cp->action == 0x02)
8817                 auto_conn = HCI_AUTO_CONN_ALWAYS;
8818         else if (cp->action == 0x01)
8819                 auto_conn = HCI_AUTO_CONN_DIRECT;
8820         else
8821                 auto_conn = HCI_AUTO_CONN_REPORT;
8822
8823         /* Kernel internally uses conn_params with resolvable private
8824          * address, but Add Device allows only identity addresses.
8825          * Make sure it is enforced before calling
8826          * hci_conn_params_lookup.
8827          */
8828         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8829                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8830                                         MGMT_STATUS_INVALID_PARAMS,
8831                                         &cp->addr, sizeof(cp->addr));
8832                 goto unlock;
8833         }
8834
8835         /* If the connection parameters don't exist for this device,
8836          * they will be created and configured with defaults.
8837          */
8838         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
8839                                 auto_conn) < 0) {
8840                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8841                                         MGMT_STATUS_FAILED, &cp->addr,
8842                                         sizeof(cp->addr));
8843                 goto unlock;
8844         } else {
8845                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8846                                                 addr_type);
8847                 if (params)
8848                         current_flags = params->flags;
8849         }
8850
8851         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
8852         if (err < 0)
8853                 goto unlock;
8854
8855 added:
8856         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
8857         supported_flags = hdev->conn_flags;
8858         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
8859                              supported_flags, current_flags);
8860
8861         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8862                                 MGMT_STATUS_SUCCESS, &cp->addr,
8863                                 sizeof(cp->addr));
8864
8865 unlock:
8866         hci_dev_unlock(hdev);
8867         return err;
8868 }
8869
8870 static void device_removed(struct sock *sk, struct hci_dev *hdev,
8871                            bdaddr_t *bdaddr, u8 type)
8872 {
8873         struct mgmt_ev_device_removed ev;
8874
8875         bacpy(&ev.addr.bdaddr, bdaddr);
8876         ev.addr.type = type;
8877
8878         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
8879 }
8880
8881 static int remove_device_sync(struct hci_dev *hdev, void *data)
8882 {
8883         return hci_update_passive_scan_sync(hdev);
8884 }
8885
8886 static int remove_device(struct sock *sk, struct hci_dev *hdev,
8887                          void *data, u16 len)
8888 {
8889         struct mgmt_cp_remove_device *cp = data;
8890         int err;
8891
8892         bt_dev_dbg(hdev, "sock %p", sk);
8893
8894         hci_dev_lock(hdev);
8895
8896         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8897                 struct hci_conn_params *params;
8898                 u8 addr_type;
8899
8900                 if (!bdaddr_type_is_valid(cp->addr.type)) {
8901                         err = mgmt_cmd_complete(sk, hdev->id,
8902                                                 MGMT_OP_REMOVE_DEVICE,
8903                                                 MGMT_STATUS_INVALID_PARAMS,
8904                                                 &cp->addr, sizeof(cp->addr));
8905                         goto unlock;
8906                 }
8907
8908                 if (cp->addr.type == BDADDR_BREDR) {
8909                         err = hci_bdaddr_list_del(&hdev->accept_list,
8910                                                   &cp->addr.bdaddr,
8911                                                   cp->addr.type);
8912                         if (err) {
8913                                 err = mgmt_cmd_complete(sk, hdev->id,
8914                                                         MGMT_OP_REMOVE_DEVICE,
8915                                                         MGMT_STATUS_INVALID_PARAMS,
8916                                                         &cp->addr,
8917                                                         sizeof(cp->addr));
8918                                 goto unlock;
8919                         }
8920
8921                         hci_update_scan(hdev);
8922
8923                         device_removed(sk, hdev, &cp->addr.bdaddr,
8924                                        cp->addr.type);
8925                         goto complete;
8926                 }
8927
8928                 addr_type = le_addr_type(cp->addr.type);
8929
8930                 /* Kernel internally uses conn_params with resolvable private
8931                  * address, but Remove Device allows only identity addresses.
8932                  * Make sure it is enforced before calling
8933                  * hci_conn_params_lookup.
8934                  */
8935                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8936                         err = mgmt_cmd_complete(sk, hdev->id,
8937                                                 MGMT_OP_REMOVE_DEVICE,
8938                                                 MGMT_STATUS_INVALID_PARAMS,
8939                                                 &cp->addr, sizeof(cp->addr));
8940                         goto unlock;
8941                 }
8942
8943                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8944                                                 addr_type);
8945                 if (!params) {
8946                         err = mgmt_cmd_complete(sk, hdev->id,
8947                                                 MGMT_OP_REMOVE_DEVICE,
8948                                                 MGMT_STATUS_INVALID_PARAMS,
8949                                                 &cp->addr, sizeof(cp->addr));
8950                         goto unlock;
8951                 }
8952
8953                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
8954                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
8955                         err = mgmt_cmd_complete(sk, hdev->id,
8956                                                 MGMT_OP_REMOVE_DEVICE,
8957                                                 MGMT_STATUS_INVALID_PARAMS,
8958                                                 &cp->addr, sizeof(cp->addr));
8959                         goto unlock;
8960                 }
8961
8962                 list_del(&params->action);
8963                 list_del(&params->list);
8964                 kfree(params);
8965
8966                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8967         } else {
8968                 struct hci_conn_params *p, *tmp;
8969                 struct bdaddr_list *b, *btmp;
8970
8971                 if (cp->addr.type) {
8972                         err = mgmt_cmd_complete(sk, hdev->id,
8973                                                 MGMT_OP_REMOVE_DEVICE,
8974                                                 MGMT_STATUS_INVALID_PARAMS,
8975                                                 &cp->addr, sizeof(cp->addr));
8976                         goto unlock;
8977                 }
8978
8979                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
8980                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8981                         list_del(&b->list);
8982                         kfree(b);
8983                 }
8984
8985                 hci_update_scan(hdev);
8986
8987                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8988                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8989                                 continue;
8990                         device_removed(sk, hdev, &p->addr, p->addr_type);
8991                         if (p->explicit_connect) {
8992                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8993                                 continue;
8994                         }
8995                         list_del(&p->action);
8996                         list_del(&p->list);
8997                         kfree(p);
8998                 }
8999
9000                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
9001         }
9002
9003         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
9004
9005 complete:
9006         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
9007                                 MGMT_STATUS_SUCCESS, &cp->addr,
9008                                 sizeof(cp->addr));
9009 unlock:
9010         hci_dev_unlock(hdev);
9011         return err;
9012 }
9013
9014 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
9015                            u16 len)
9016 {
9017         struct mgmt_cp_load_conn_param *cp = data;
9018         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
9019                                      sizeof(struct mgmt_conn_param));
9020         u16 param_count, expected_len;
9021         int i;
9022
9023         if (!lmp_le_capable(hdev))
9024                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9025                                        MGMT_STATUS_NOT_SUPPORTED);
9026
9027         param_count = __le16_to_cpu(cp->param_count);
9028         if (param_count > max_param_count) {
9029                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
9030                            param_count);
9031                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9032                                        MGMT_STATUS_INVALID_PARAMS);
9033         }
9034
9035         expected_len = struct_size(cp, params, param_count);
9036         if (expected_len != len) {
9037                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
9038                            expected_len, len);
9039                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9040                                        MGMT_STATUS_INVALID_PARAMS);
9041         }
9042
9043         bt_dev_dbg(hdev, "param_count %u", param_count);
9044
9045         hci_dev_lock(hdev);
9046
9047         hci_conn_params_clear_disabled(hdev);
9048
9049         for (i = 0; i < param_count; i++) {
9050                 struct mgmt_conn_param *param = &cp->params[i];
9051                 struct hci_conn_params *hci_param;
9052                 u16 min, max, latency, timeout;
9053                 u8 addr_type;
9054
9055                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
9056                            param->addr.type);
9057
9058                 if (param->addr.type == BDADDR_LE_PUBLIC) {
9059                         addr_type = ADDR_LE_DEV_PUBLIC;
9060                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
9061                         addr_type = ADDR_LE_DEV_RANDOM;
9062                 } else {
9063                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9064                         continue;
9065                 }
9066
9067                 min = le16_to_cpu(param->min_interval);
9068                 max = le16_to_cpu(param->max_interval);
9069                 latency = le16_to_cpu(param->latency);
9070                 timeout = le16_to_cpu(param->timeout);
9071
9072                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
9073                            min, max, latency, timeout);
9074
9075                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
9076                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9077                         continue;
9078                 }
9079
9080                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
9081                                                 addr_type);
9082                 if (!hci_param) {
9083                         bt_dev_err(hdev, "failed to add connection parameters");
9084                         continue;
9085                 }
9086
9087                 hci_param->conn_min_interval = min;
9088                 hci_param->conn_max_interval = max;
9089                 hci_param->conn_latency = latency;
9090                 hci_param->supervision_timeout = timeout;
9091         }
9092
9093         hci_dev_unlock(hdev);
9094
9095         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
9096                                  NULL, 0);
9097 }
9098
9099 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
9100                                void *data, u16 len)
9101 {
9102         struct mgmt_cp_set_external_config *cp = data;
9103         bool changed;
9104         int err;
9105
9106         bt_dev_dbg(hdev, "sock %p", sk);
9107
9108         if (hdev_is_powered(hdev))
9109                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9110                                        MGMT_STATUS_REJECTED);
9111
9112         if (cp->config != 0x00 && cp->config != 0x01)
9113                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9114                                          MGMT_STATUS_INVALID_PARAMS);
9115
9116         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
9117                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9118                                        MGMT_STATUS_NOT_SUPPORTED);
9119
9120         hci_dev_lock(hdev);
9121
9122         if (cp->config)
9123                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
9124         else
9125                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
9126
9127         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
9128         if (err < 0)
9129                 goto unlock;
9130
9131         if (!changed)
9132                 goto unlock;
9133
9134         err = new_options(hdev, sk);
9135
9136         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
9137                 mgmt_index_removed(hdev);
9138
9139                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
9140                         hci_dev_set_flag(hdev, HCI_CONFIG);
9141                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9142
9143                         queue_work(hdev->req_workqueue, &hdev->power_on);
9144                 } else {
9145                         set_bit(HCI_RAW, &hdev->flags);
9146                         mgmt_index_added(hdev);
9147                 }
9148         }
9149
9150 unlock:
9151         hci_dev_unlock(hdev);
9152         return err;
9153 }
9154
9155 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
9156                               void *data, u16 len)
9157 {
9158         struct mgmt_cp_set_public_address *cp = data;
9159         bool changed;
9160         int err;
9161
9162         bt_dev_dbg(hdev, "sock %p", sk);
9163
9164         if (hdev_is_powered(hdev))
9165                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9166                                        MGMT_STATUS_REJECTED);
9167
9168         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
9169                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9170                                        MGMT_STATUS_INVALID_PARAMS);
9171
9172         if (!hdev->set_bdaddr)
9173                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9174                                        MGMT_STATUS_NOT_SUPPORTED);
9175
9176         hci_dev_lock(hdev);
9177
9178         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
9179         bacpy(&hdev->public_addr, &cp->bdaddr);
9180
9181         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
9182         if (err < 0)
9183                 goto unlock;
9184
9185         if (!changed)
9186                 goto unlock;
9187
9188         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9189                 err = new_options(hdev, sk);
9190
9191         if (is_configured(hdev)) {
9192                 mgmt_index_removed(hdev);
9193
9194                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9195
9196                 hci_dev_set_flag(hdev, HCI_CONFIG);
9197                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9198
9199                 queue_work(hdev->req_workqueue, &hdev->power_on);
9200         }
9201
9202 unlock:
9203         hci_dev_unlock(hdev);
9204         return err;
9205 }
9206
9207 #ifdef TIZEN_BT
9208 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
9209                             u8 name_len)
9210 {
9211         char buf[512];
9212         struct mgmt_ev_device_name_update *ev = (void *)buf;
9213         u16 eir_len = 0;
9214
9215         if (name_len <= 0)
9216                 return -EINVAL;
9217
9218         bacpy(&ev->addr.bdaddr, bdaddr);
9219         ev->addr.type = BDADDR_BREDR;
9220
9221         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9222                                   name_len);
9223
9224         ev->eir_len = cpu_to_le16(eir_len);
9225
9226         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
9227                           sizeof(*ev) + eir_len, NULL);
9228 }
9229 #endif
9230
9231 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
9232                                              int err)
9233 {
9234         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
9235         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
9236         u8 *h192, *r192, *h256, *r256;
9237         struct mgmt_pending_cmd *cmd = data;
9238         struct sk_buff *skb = cmd->skb;
9239         u8 status = mgmt_status(err);
9240         u16 eir_len;
9241
9242         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
9243                 return;
9244
9245         if (!status) {
9246                 if (!skb)
9247                         status = MGMT_STATUS_FAILED;
9248                 else if (IS_ERR(skb))
9249                         status = mgmt_status(PTR_ERR(skb));
9250                 else
9251                         status = mgmt_status(skb->data[0]);
9252         }
9253
9254         bt_dev_dbg(hdev, "status %u", status);
9255
9256         mgmt_cp = cmd->param;
9257
9258         if (status) {
9259                 status = mgmt_status(status);
9260                 eir_len = 0;
9261
9262                 h192 = NULL;
9263                 r192 = NULL;
9264                 h256 = NULL;
9265                 r256 = NULL;
9266         } else if (!bredr_sc_enabled(hdev)) {
9267                 struct hci_rp_read_local_oob_data *rp;
9268
9269                 if (skb->len != sizeof(*rp)) {
9270                         status = MGMT_STATUS_FAILED;
9271                         eir_len = 0;
9272                 } else {
9273                         status = MGMT_STATUS_SUCCESS;
9274                         rp = (void *)skb->data;
9275
9276                         eir_len = 5 + 18 + 18;
9277                         h192 = rp->hash;
9278                         r192 = rp->rand;
9279                         h256 = NULL;
9280                         r256 = NULL;
9281                 }
9282         } else {
9283                 struct hci_rp_read_local_oob_ext_data *rp;
9284
9285                 if (skb->len != sizeof(*rp)) {
9286                         status = MGMT_STATUS_FAILED;
9287                         eir_len = 0;
9288                 } else {
9289                         status = MGMT_STATUS_SUCCESS;
9290                         rp = (void *)skb->data;
9291
9292                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
9293                                 eir_len = 5 + 18 + 18;
9294                                 h192 = NULL;
9295                                 r192 = NULL;
9296                         } else {
9297                                 eir_len = 5 + 18 + 18 + 18 + 18;
9298                                 h192 = rp->hash192;
9299                                 r192 = rp->rand192;
9300                         }
9301
9302                         h256 = rp->hash256;
9303                         r256 = rp->rand256;
9304                 }
9305         }
9306
9307         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
9308         if (!mgmt_rp)
9309                 goto done;
9310
9311         if (eir_len == 0)
9312                 goto send_rsp;
9313
9314         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
9315                                   hdev->dev_class, 3);
9316
9317         if (h192 && r192) {
9318                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9319                                           EIR_SSP_HASH_C192, h192, 16);
9320                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9321                                           EIR_SSP_RAND_R192, r192, 16);
9322         }
9323
9324         if (h256 && r256) {
9325                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9326                                           EIR_SSP_HASH_C256, h256, 16);
9327                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9328                                           EIR_SSP_RAND_R256, r256, 16);
9329         }
9330
9331 send_rsp:
9332         mgmt_rp->type = mgmt_cp->type;
9333         mgmt_rp->eir_len = cpu_to_le16(eir_len);
9334
9335         err = mgmt_cmd_complete(cmd->sk, hdev->id,
9336                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
9337                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
9338         if (err < 0 || status)
9339                 goto done;
9340
9341         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
9342
9343         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9344                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
9345                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
9346 done:
9347         if (skb && !IS_ERR(skb))
9348                 kfree_skb(skb);
9349
9350         kfree(mgmt_rp);
9351         mgmt_pending_remove(cmd);
9352 }
9353
9354 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
9355                                   struct mgmt_cp_read_local_oob_ext_data *cp)
9356 {
9357         struct mgmt_pending_cmd *cmd;
9358         int err;
9359
9360         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
9361                                cp, sizeof(*cp));
9362         if (!cmd)
9363                 return -ENOMEM;
9364
9365         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
9366                                  read_local_oob_ext_data_complete);
9367
9368         if (err < 0) {
9369                 mgmt_pending_remove(cmd);
9370                 return err;
9371         }
9372
9373         return 0;
9374 }
9375
9376 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
9377                                    void *data, u16 data_len)
9378 {
9379         struct mgmt_cp_read_local_oob_ext_data *cp = data;
9380         struct mgmt_rp_read_local_oob_ext_data *rp;
9381         size_t rp_len;
9382         u16 eir_len;
9383         u8 status, flags, role, addr[7], hash[16], rand[16];
9384         int err;
9385
9386         bt_dev_dbg(hdev, "sock %p", sk);
9387
9388         if (hdev_is_powered(hdev)) {
9389                 switch (cp->type) {
9390                 case BIT(BDADDR_BREDR):
9391                         status = mgmt_bredr_support(hdev);
9392                         if (status)
9393                                 eir_len = 0;
9394                         else
9395                                 eir_len = 5;
9396                         break;
9397                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9398                         status = mgmt_le_support(hdev);
9399                         if (status)
9400                                 eir_len = 0;
9401                         else
9402                                 eir_len = 9 + 3 + 18 + 18 + 3;
9403                         break;
9404                 default:
9405                         status = MGMT_STATUS_INVALID_PARAMS;
9406                         eir_len = 0;
9407                         break;
9408                 }
9409         } else {
9410                 status = MGMT_STATUS_NOT_POWERED;
9411                 eir_len = 0;
9412         }
9413
9414         rp_len = sizeof(*rp) + eir_len;
9415         rp = kmalloc(rp_len, GFP_ATOMIC);
9416         if (!rp)
9417                 return -ENOMEM;
9418
9419         if (!status && !lmp_ssp_capable(hdev)) {
9420                 status = MGMT_STATUS_NOT_SUPPORTED;
9421                 eir_len = 0;
9422         }
9423
9424         if (status)
9425                 goto complete;
9426
9427         hci_dev_lock(hdev);
9428
9429         eir_len = 0;
9430         switch (cp->type) {
9431         case BIT(BDADDR_BREDR):
9432                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9433                         err = read_local_ssp_oob_req(hdev, sk, cp);
9434                         hci_dev_unlock(hdev);
9435                         if (!err)
9436                                 goto done;
9437
9438                         status = MGMT_STATUS_FAILED;
9439                         goto complete;
9440                 } else {
9441                         eir_len = eir_append_data(rp->eir, eir_len,
9442                                                   EIR_CLASS_OF_DEV,
9443                                                   hdev->dev_class, 3);
9444                 }
9445                 break;
9446         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9447                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
9448                     smp_generate_oob(hdev, hash, rand) < 0) {
9449                         hci_dev_unlock(hdev);
9450                         status = MGMT_STATUS_FAILED;
9451                         goto complete;
9452                 }
9453
9454                 /* This should return the active RPA, but since the RPA
9455                  * is only programmed on demand, it is really hard to fill
9456                  * this in at the moment. For now disallow retrieving
9457                  * local out-of-band data when privacy is in use.
9458                  *
9459                  * Returning the identity address will not help here since
9460                  * pairing happens before the identity resolving key is
9461                  * known and thus the connection establishment happens
9462                  * based on the RPA and not the identity address.
9463                  */
9464                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
9465                         hci_dev_unlock(hdev);
9466                         status = MGMT_STATUS_REJECTED;
9467                         goto complete;
9468                 }
9469
9470                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
9471                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
9472                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
9473                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
9474                         memcpy(addr, &hdev->static_addr, 6);
9475                         addr[6] = 0x01;
9476                 } else {
9477                         memcpy(addr, &hdev->bdaddr, 6);
9478                         addr[6] = 0x00;
9479                 }
9480
9481                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
9482                                           addr, sizeof(addr));
9483
9484                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
9485                         role = 0x02;
9486                 else
9487                         role = 0x01;
9488
9489                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
9490                                           &role, sizeof(role));
9491
9492                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
9493                         eir_len = eir_append_data(rp->eir, eir_len,
9494                                                   EIR_LE_SC_CONFIRM,
9495                                                   hash, sizeof(hash));
9496
9497                         eir_len = eir_append_data(rp->eir, eir_len,
9498                                                   EIR_LE_SC_RANDOM,
9499                                                   rand, sizeof(rand));
9500                 }
9501
9502                 flags = mgmt_get_adv_discov_flags(hdev);
9503
9504                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9505                         flags |= LE_AD_NO_BREDR;
9506
9507                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
9508                                           &flags, sizeof(flags));
9509                 break;
9510         }
9511
9512         hci_dev_unlock(hdev);
9513
9514         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
9515
9516         status = MGMT_STATUS_SUCCESS;
9517
9518 complete:
9519         rp->type = cp->type;
9520         rp->eir_len = cpu_to_le16(eir_len);
9521
9522         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
9523                                 status, rp, sizeof(*rp) + eir_len);
9524         if (err < 0 || status)
9525                 goto done;
9526
9527         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9528                                  rp, sizeof(*rp) + eir_len,
9529                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
9530
9531 done:
9532         kfree(rp);
9533
9534         return err;
9535 }
9536
9537 static u32 get_supported_adv_flags(struct hci_dev *hdev)
9538 {
9539         u32 flags = 0;
9540
9541         flags |= MGMT_ADV_FLAG_CONNECTABLE;
9542         flags |= MGMT_ADV_FLAG_DISCOV;
9543         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
9544         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
9545         flags |= MGMT_ADV_FLAG_APPEARANCE;
9546         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
9547         flags |= MGMT_ADV_PARAM_DURATION;
9548         flags |= MGMT_ADV_PARAM_TIMEOUT;
9549         flags |= MGMT_ADV_PARAM_INTERVALS;
9550         flags |= MGMT_ADV_PARAM_TX_POWER;
9551         flags |= MGMT_ADV_PARAM_SCAN_RSP;
9552
9553         /* In extended adv TX_POWER returned from Set Adv Param
9554          * will be always valid.
9555          */
9556         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
9557                 flags |= MGMT_ADV_FLAG_TX_POWER;
9558
9559         if (ext_adv_capable(hdev)) {
9560                 flags |= MGMT_ADV_FLAG_SEC_1M;
9561                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
9562                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
9563
9564                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
9565                         flags |= MGMT_ADV_FLAG_SEC_2M;
9566
9567                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
9568                         flags |= MGMT_ADV_FLAG_SEC_CODED;
9569         }
9570
9571         return flags;
9572 }
9573
9574 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
9575                              void *data, u16 data_len)
9576 {
9577         struct mgmt_rp_read_adv_features *rp;
9578         size_t rp_len;
9579         int err;
9580         struct adv_info *adv_instance;
9581         u32 supported_flags;
9582         u8 *instance;
9583
9584         bt_dev_dbg(hdev, "sock %p", sk);
9585
9586         if (!lmp_le_capable(hdev))
9587                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9588                                        MGMT_STATUS_REJECTED);
9589
9590         hci_dev_lock(hdev);
9591
9592         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
9593         rp = kmalloc(rp_len, GFP_ATOMIC);
9594         if (!rp) {
9595                 hci_dev_unlock(hdev);
9596                 return -ENOMEM;
9597         }
9598
9599         supported_flags = get_supported_adv_flags(hdev);
9600
9601         rp->supported_flags = cpu_to_le32(supported_flags);
9602         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
9603         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
9604         rp->max_instances = hdev->le_num_of_adv_sets;
9605         rp->num_instances = hdev->adv_instance_cnt;
9606
9607         instance = rp->instance;
9608         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9609                 /* Only instances 1-le_num_of_adv_sets are externally visible */
9610                 if (adv_instance->instance <= hdev->adv_instance_cnt) {
9611                         *instance = adv_instance->instance;
9612                         instance++;
9613                 } else {
9614                         rp->num_instances--;
9615                         rp_len--;
9616                 }
9617         }
9618
9619         hci_dev_unlock(hdev);
9620
9621         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9622                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9623
9624         kfree(rp);
9625
9626         return err;
9627 }
9628
9629 static u8 calculate_name_len(struct hci_dev *hdev)
9630 {
9631         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9632
9633         return eir_append_local_name(hdev, buf, 0);
9634 }
9635
9636 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9637                            bool is_adv_data)
9638 {
9639         u8 max_len = HCI_MAX_AD_LENGTH;
9640
9641         if (is_adv_data) {
9642                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9643                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9644                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9645                         max_len -= 3;
9646
9647                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9648                         max_len -= 3;
9649         } else {
9650                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9651                         max_len -= calculate_name_len(hdev);
9652
9653                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9654                         max_len -= 4;
9655         }
9656
9657         return max_len;
9658 }
9659
9660 static bool flags_managed(u32 adv_flags)
9661 {
9662         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
9663                             MGMT_ADV_FLAG_LIMITED_DISCOV |
9664                             MGMT_ADV_FLAG_MANAGED_FLAGS);
9665 }
9666
9667 static bool tx_power_managed(u32 adv_flags)
9668 {
9669         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
9670 }
9671
9672 static bool name_managed(u32 adv_flags)
9673 {
9674         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
9675 }
9676
9677 static bool appearance_managed(u32 adv_flags)
9678 {
9679         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
9680 }
9681
9682 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
9683                               u8 len, bool is_adv_data)
9684 {
9685         int i, cur_len;
9686         u8 max_len;
9687
9688         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
9689
9690         if (len > max_len)
9691                 return false;
9692
9693         /* Make sure that the data is correctly formatted. */
9694         for (i = 0; i < len; i += (cur_len + 1)) {
9695                 cur_len = data[i];
9696
9697                 if (!cur_len)
9698                         continue;
9699
9700                 if (data[i + 1] == EIR_FLAGS &&
9701                     (!is_adv_data || flags_managed(adv_flags)))
9702                         return false;
9703
9704                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
9705                         return false;
9706
9707                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
9708                         return false;
9709
9710                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
9711                         return false;
9712
9713                 if (data[i + 1] == EIR_APPEARANCE &&
9714                     appearance_managed(adv_flags))
9715                         return false;
9716
9717                 /* If the current field length would exceed the total data
9718                  * length, then it's invalid.
9719                  */
9720                 if (i + cur_len >= len)
9721                         return false;
9722         }
9723
9724         return true;
9725 }
9726
9727 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
9728 {
9729         u32 supported_flags, phy_flags;
9730
9731         /* The current implementation only supports a subset of the specified
9732          * flags. Also need to check mutual exclusiveness of sec flags.
9733          */
9734         supported_flags = get_supported_adv_flags(hdev);
9735         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
9736         if (adv_flags & ~supported_flags ||
9737             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
9738                 return false;
9739
9740         return true;
9741 }
9742
9743 static bool adv_busy(struct hci_dev *hdev)
9744 {
9745         return pending_find(MGMT_OP_SET_LE, hdev);
9746 }
9747
9748 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
9749                              int err)
9750 {
9751         struct adv_info *adv, *n;
9752
9753         bt_dev_dbg(hdev, "err %d", err);
9754
9755         hci_dev_lock(hdev);
9756
9757         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
9758                 u8 instance;
9759
9760                 if (!adv->pending)
9761                         continue;
9762
9763                 if (!err) {
9764                         adv->pending = false;
9765                         continue;
9766                 }
9767
9768                 instance = adv->instance;
9769
9770                 if (hdev->cur_adv_instance == instance)
9771                         cancel_adv_timeout(hdev);
9772
9773                 hci_remove_adv_instance(hdev, instance);
9774                 mgmt_advertising_removed(sk, hdev, instance);
9775         }
9776
9777         hci_dev_unlock(hdev);
9778 }
9779
9780 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
9781 {
9782         struct mgmt_pending_cmd *cmd = data;
9783         struct mgmt_cp_add_advertising *cp = cmd->param;
9784         struct mgmt_rp_add_advertising rp;
9785
9786         memset(&rp, 0, sizeof(rp));
9787
9788         rp.instance = cp->instance;
9789
9790         if (err)
9791                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9792                                 mgmt_status(err));
9793         else
9794                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9795                                   mgmt_status(err), &rp, sizeof(rp));
9796
9797         add_adv_complete(hdev, cmd->sk, cp->instance, err);
9798
9799         mgmt_pending_free(cmd);
9800 }
9801
9802 static int add_advertising_sync(struct hci_dev *hdev, void *data)
9803 {
9804         struct mgmt_pending_cmd *cmd = data;
9805         struct mgmt_cp_add_advertising *cp = cmd->param;
9806
9807         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
9808 }
9809
9810 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
9811                            void *data, u16 data_len)
9812 {
9813         struct mgmt_cp_add_advertising *cp = data;
9814         struct mgmt_rp_add_advertising rp;
9815         u32 flags;
9816         u8 status;
9817         u16 timeout, duration;
9818         unsigned int prev_instance_cnt;
9819         u8 schedule_instance = 0;
9820         struct adv_info *adv, *next_instance;
9821         int err;
9822         struct mgmt_pending_cmd *cmd;
9823
9824         bt_dev_dbg(hdev, "sock %p", sk);
9825
9826         status = mgmt_le_support(hdev);
9827         if (status)
9828                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9829                                        status);
9830
9831         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9832                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9833                                        MGMT_STATUS_INVALID_PARAMS);
9834
9835         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9836                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9837                                        MGMT_STATUS_INVALID_PARAMS);
9838
9839         flags = __le32_to_cpu(cp->flags);
9840         timeout = __le16_to_cpu(cp->timeout);
9841         duration = __le16_to_cpu(cp->duration);
9842
9843         if (!requested_adv_flags_are_valid(hdev, flags))
9844                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9845                                        MGMT_STATUS_INVALID_PARAMS);
9846
9847         hci_dev_lock(hdev);
9848
9849         if (timeout && !hdev_is_powered(hdev)) {
9850                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9851                                       MGMT_STATUS_REJECTED);
9852                 goto unlock;
9853         }
9854
9855         if (adv_busy(hdev)) {
9856                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9857                                       MGMT_STATUS_BUSY);
9858                 goto unlock;
9859         }
9860
9861         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9862             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9863                                cp->scan_rsp_len, false)) {
9864                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9865                                       MGMT_STATUS_INVALID_PARAMS);
9866                 goto unlock;
9867         }
9868
9869         prev_instance_cnt = hdev->adv_instance_cnt;
9870
9871         adv = hci_add_adv_instance(hdev, cp->instance, flags,
9872                                    cp->adv_data_len, cp->data,
9873                                    cp->scan_rsp_len,
9874                                    cp->data + cp->adv_data_len,
9875                                    timeout, duration,
9876                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
9877                                    hdev->le_adv_min_interval,
9878                                    hdev->le_adv_max_interval, 0);
9879         if (IS_ERR(adv)) {
9880                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9881                                       MGMT_STATUS_FAILED);
9882                 goto unlock;
9883         }
9884
9885         /* Only trigger an advertising added event if a new instance was
9886          * actually added.
9887          */
9888         if (hdev->adv_instance_cnt > prev_instance_cnt)
9889                 mgmt_advertising_added(sk, hdev, cp->instance);
9890
9891         if (hdev->cur_adv_instance == cp->instance) {
9892                 /* If the currently advertised instance is being changed then
9893                  * cancel the current advertising and schedule the next
9894                  * instance. If there is only one instance then the overridden
9895                  * advertising data will be visible right away.
9896                  */
9897                 cancel_adv_timeout(hdev);
9898
9899                 next_instance = hci_get_next_instance(hdev, cp->instance);
9900                 if (next_instance)
9901                         schedule_instance = next_instance->instance;
9902         } else if (!hdev->adv_instance_timeout) {
9903                 /* Immediately advertise the new instance if no other
9904                  * instance is currently being advertised.
9905                  */
9906                 schedule_instance = cp->instance;
9907         }
9908
9909         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9910          * there is no instance to be advertised then we have no HCI
9911          * communication to make. Simply return.
9912          */
9913         if (!hdev_is_powered(hdev) ||
9914             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9915             !schedule_instance) {
9916                 rp.instance = cp->instance;
9917                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9918                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9919                 goto unlock;
9920         }
9921
9922         /* We're good to go, update advertising data, parameters, and start
9923          * advertising.
9924          */
9925         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9926                                data_len);
9927         if (!cmd) {
9928                 err = -ENOMEM;
9929                 goto unlock;
9930         }
9931
9932         cp->instance = schedule_instance;
9933
9934         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
9935                                  add_advertising_complete);
9936         if (err < 0)
9937                 mgmt_pending_free(cmd);
9938
9939 unlock:
9940         hci_dev_unlock(hdev);
9941
9942         return err;
9943 }
9944
9945 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
9946                                         int err)
9947 {
9948         struct mgmt_pending_cmd *cmd = data;
9949         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
9950         struct mgmt_rp_add_ext_adv_params rp;
9951         struct adv_info *adv;
9952         u32 flags;
9953
9954         BT_DBG("%s", hdev->name);
9955
9956         hci_dev_lock(hdev);
9957
9958         adv = hci_find_adv_instance(hdev, cp->instance);
9959         if (!adv)
9960                 goto unlock;
9961
9962         rp.instance = cp->instance;
9963         rp.tx_power = adv->tx_power;
9964
9965         /* While we're at it, inform userspace of the available space for this
9966          * advertisement, given the flags that will be used.
9967          */
9968         flags = __le32_to_cpu(cp->flags);
9969         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9970         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9971
9972         if (err) {
9973                 /* If this advertisement was previously advertising and we
9974                  * failed to update it, we signal that it has been removed and
9975                  * delete its structure
9976                  */
9977                 if (!adv->pending)
9978                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
9979
9980                 hci_remove_adv_instance(hdev, cp->instance);
9981
9982                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9983                                 mgmt_status(err));
9984         } else {
9985                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9986                                   mgmt_status(err), &rp, sizeof(rp));
9987         }
9988
9989 unlock:
9990         if (cmd)
9991                 mgmt_pending_free(cmd);
9992
9993         hci_dev_unlock(hdev);
9994 }
9995
9996 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
9997 {
9998         struct mgmt_pending_cmd *cmd = data;
9999         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
10000
10001         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
10002 }
10003
10004 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
10005                               void *data, u16 data_len)
10006 {
10007         struct mgmt_cp_add_ext_adv_params *cp = data;
10008         struct mgmt_rp_add_ext_adv_params rp;
10009         struct mgmt_pending_cmd *cmd = NULL;
10010         struct adv_info *adv;
10011         u32 flags, min_interval, max_interval;
10012         u16 timeout, duration;
10013         u8 status;
10014         s8 tx_power;
10015         int err;
10016
10017         BT_DBG("%s", hdev->name);
10018
10019         status = mgmt_le_support(hdev);
10020         if (status)
10021                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10022                                        status);
10023
10024         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10025                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10026                                        MGMT_STATUS_INVALID_PARAMS);
10027
10028         /* The purpose of breaking add_advertising into two separate MGMT calls
10029          * for params and data is to allow more parameters to be added to this
10030          * structure in the future. For this reason, we verify that we have the
10031          * bare minimum structure we know of when the interface was defined. Any
10032          * extra parameters we don't know about will be ignored in this request.
10033          */
10034         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
10035                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10036                                        MGMT_STATUS_INVALID_PARAMS);
10037
10038         flags = __le32_to_cpu(cp->flags);
10039
10040         if (!requested_adv_flags_are_valid(hdev, flags))
10041                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10042                                        MGMT_STATUS_INVALID_PARAMS);
10043
10044         hci_dev_lock(hdev);
10045
10046         /* In new interface, we require that we are powered to register */
10047         if (!hdev_is_powered(hdev)) {
10048                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10049                                       MGMT_STATUS_REJECTED);
10050                 goto unlock;
10051         }
10052
10053         if (adv_busy(hdev)) {
10054                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10055                                       MGMT_STATUS_BUSY);
10056                 goto unlock;
10057         }
10058
10059         /* Parse defined parameters from request, use defaults otherwise */
10060         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
10061                   __le16_to_cpu(cp->timeout) : 0;
10062
10063         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
10064                    __le16_to_cpu(cp->duration) :
10065                    hdev->def_multi_adv_rotation_duration;
10066
10067         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10068                        __le32_to_cpu(cp->min_interval) :
10069                        hdev->le_adv_min_interval;
10070
10071         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10072                        __le32_to_cpu(cp->max_interval) :
10073                        hdev->le_adv_max_interval;
10074
10075         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
10076                    cp->tx_power :
10077                    HCI_ADV_TX_POWER_NO_PREFERENCE;
10078
10079         /* Create advertising instance with no advertising or response data */
10080         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
10081                                    timeout, duration, tx_power, min_interval,
10082                                    max_interval, 0);
10083
10084         if (IS_ERR(adv)) {
10085                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10086                                       MGMT_STATUS_FAILED);
10087                 goto unlock;
10088         }
10089
10090         /* Submit request for advertising params if ext adv available */
10091         if (ext_adv_capable(hdev)) {
10092                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
10093                                        data, data_len);
10094                 if (!cmd) {
10095                         err = -ENOMEM;
10096                         hci_remove_adv_instance(hdev, cp->instance);
10097                         goto unlock;
10098                 }
10099
10100                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
10101                                          add_ext_adv_params_complete);
10102                 if (err < 0)
10103                         mgmt_pending_free(cmd);
10104         } else {
10105                 rp.instance = cp->instance;
10106                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
10107                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10108                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10109                 err = mgmt_cmd_complete(sk, hdev->id,
10110                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
10111                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10112         }
10113
10114 unlock:
10115         hci_dev_unlock(hdev);
10116
10117         return err;
10118 }
10119
10120 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
10121 {
10122         struct mgmt_pending_cmd *cmd = data;
10123         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
10124         struct mgmt_rp_add_advertising rp;
10125
10126         add_adv_complete(hdev, cmd->sk, cp->instance, err);
10127
10128         memset(&rp, 0, sizeof(rp));
10129
10130         rp.instance = cp->instance;
10131
10132         if (err)
10133                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10134                                 mgmt_status(err));
10135         else
10136                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10137                                   mgmt_status(err), &rp, sizeof(rp));
10138
10139         mgmt_pending_free(cmd);
10140 }
10141
10142 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
10143 {
10144         struct mgmt_pending_cmd *cmd = data;
10145         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
10146         int err;
10147
10148         if (ext_adv_capable(hdev)) {
10149                 err = hci_update_adv_data_sync(hdev, cp->instance);
10150                 if (err)
10151                         return err;
10152
10153                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
10154                 if (err)
10155                         return err;
10156
10157                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
10158         }
10159
10160         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
10161 }
10162
10163 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
10164                             u16 data_len)
10165 {
10166         struct mgmt_cp_add_ext_adv_data *cp = data;
10167         struct mgmt_rp_add_ext_adv_data rp;
10168         u8 schedule_instance = 0;
10169         struct adv_info *next_instance;
10170         struct adv_info *adv_instance;
10171         int err = 0;
10172         struct mgmt_pending_cmd *cmd;
10173
10174         BT_DBG("%s", hdev->name);
10175
10176         hci_dev_lock(hdev);
10177
10178         adv_instance = hci_find_adv_instance(hdev, cp->instance);
10179
10180         if (!adv_instance) {
10181                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10182                                       MGMT_STATUS_INVALID_PARAMS);
10183                 goto unlock;
10184         }
10185
10186         /* In new interface, we require that we are powered to register */
10187         if (!hdev_is_powered(hdev)) {
10188                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10189                                       MGMT_STATUS_REJECTED);
10190                 goto clear_new_instance;
10191         }
10192
10193         if (adv_busy(hdev)) {
10194                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10195                                       MGMT_STATUS_BUSY);
10196                 goto clear_new_instance;
10197         }
10198
10199         /* Validate new data */
10200         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
10201                                cp->adv_data_len, true) ||
10202             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
10203                                cp->adv_data_len, cp->scan_rsp_len, false)) {
10204                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10205                                       MGMT_STATUS_INVALID_PARAMS);
10206                 goto clear_new_instance;
10207         }
10208
10209         /* Set the data in the advertising instance */
10210         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
10211                                   cp->data, cp->scan_rsp_len,
10212                                   cp->data + cp->adv_data_len);
10213
10214         /* If using software rotation, determine next instance to use */
10215         if (hdev->cur_adv_instance == cp->instance) {
10216                 /* If the currently advertised instance is being changed
10217                  * then cancel the current advertising and schedule the
10218                  * next instance. If there is only one instance then the
10219                  * overridden advertising data will be visible right
10220                  * away
10221                  */
10222                 cancel_adv_timeout(hdev);
10223
10224                 next_instance = hci_get_next_instance(hdev, cp->instance);
10225                 if (next_instance)
10226                         schedule_instance = next_instance->instance;
10227         } else if (!hdev->adv_instance_timeout) {
10228                 /* Immediately advertise the new instance if no other
10229                  * instance is currently being advertised.
10230                  */
10231                 schedule_instance = cp->instance;
10232         }
10233
10234         /* If the HCI_ADVERTISING flag is set or there is no instance to
10235          * be advertised then we have no HCI communication to make.
10236          * Simply return.
10237          */
10238         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
10239                 if (adv_instance->pending) {
10240                         mgmt_advertising_added(sk, hdev, cp->instance);
10241                         adv_instance->pending = false;
10242                 }
10243                 rp.instance = cp->instance;
10244                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10245                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10246                 goto unlock;
10247         }
10248
10249         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
10250                                data_len);
10251         if (!cmd) {
10252                 err = -ENOMEM;
10253                 goto clear_new_instance;
10254         }
10255
10256         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
10257                                  add_ext_adv_data_complete);
10258         if (err < 0) {
10259                 mgmt_pending_free(cmd);
10260                 goto clear_new_instance;
10261         }
10262
10263         /* We were successful in updating data, so trigger advertising_added
10264          * event if this is an instance that wasn't previously advertising. If
10265          * a failure occurs in the requests we initiated, we will remove the
10266          * instance again in add_advertising_complete
10267          */
10268         if (adv_instance->pending)
10269                 mgmt_advertising_added(sk, hdev, cp->instance);
10270
10271         goto unlock;
10272
10273 clear_new_instance:
10274         hci_remove_adv_instance(hdev, cp->instance);
10275
10276 unlock:
10277         hci_dev_unlock(hdev);
10278
10279         return err;
10280 }
10281
10282 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
10283                                         int err)
10284 {
10285         struct mgmt_pending_cmd *cmd = data;
10286         struct mgmt_cp_remove_advertising *cp = cmd->param;
10287         struct mgmt_rp_remove_advertising rp;
10288
10289         bt_dev_dbg(hdev, "err %d", err);
10290
10291         memset(&rp, 0, sizeof(rp));
10292         rp.instance = cp->instance;
10293
10294         if (err)
10295                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10296                                 mgmt_status(err));
10297         else
10298                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10299                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10300
10301         mgmt_pending_free(cmd);
10302 }
10303
10304 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
10305 {
10306         struct mgmt_pending_cmd *cmd = data;
10307         struct mgmt_cp_remove_advertising *cp = cmd->param;
10308         int err;
10309
10310         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
10311         if (err)
10312                 return err;
10313
10314         if (list_empty(&hdev->adv_instances))
10315                 err = hci_disable_advertising_sync(hdev);
10316
10317         return err;
10318 }
10319
10320 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
10321                               void *data, u16 data_len)
10322 {
10323         struct mgmt_cp_remove_advertising *cp = data;
10324         struct mgmt_pending_cmd *cmd;
10325         int err;
10326
10327         bt_dev_dbg(hdev, "sock %p", sk);
10328
10329         hci_dev_lock(hdev);
10330
10331         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
10332                 err = mgmt_cmd_status(sk, hdev->id,
10333                                       MGMT_OP_REMOVE_ADVERTISING,
10334                                       MGMT_STATUS_INVALID_PARAMS);
10335                 goto unlock;
10336         }
10337
10338         if (pending_find(MGMT_OP_SET_LE, hdev)) {
10339                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10340                                       MGMT_STATUS_BUSY);
10341                 goto unlock;
10342         }
10343
10344         if (list_empty(&hdev->adv_instances)) {
10345                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10346                                       MGMT_STATUS_INVALID_PARAMS);
10347                 goto unlock;
10348         }
10349
10350         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
10351                                data_len);
10352         if (!cmd) {
10353                 err = -ENOMEM;
10354                 goto unlock;
10355         }
10356
10357         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
10358                                  remove_advertising_complete);
10359         if (err < 0)
10360                 mgmt_pending_free(cmd);
10361
10362 unlock:
10363         hci_dev_unlock(hdev);
10364
10365         return err;
10366 }
10367
10368 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
10369                              void *data, u16 data_len)
10370 {
10371         struct mgmt_cp_get_adv_size_info *cp = data;
10372         struct mgmt_rp_get_adv_size_info rp;
10373         u32 flags, supported_flags;
10374
10375         bt_dev_dbg(hdev, "sock %p", sk);
10376
10377         if (!lmp_le_capable(hdev))
10378                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10379                                        MGMT_STATUS_REJECTED);
10380
10381         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10382                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10383                                        MGMT_STATUS_INVALID_PARAMS);
10384
10385         flags = __le32_to_cpu(cp->flags);
10386
10387         /* The current implementation only supports a subset of the specified
10388          * flags.
10389          */
10390         supported_flags = get_supported_adv_flags(hdev);
10391         if (flags & ~supported_flags)
10392                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10393                                        MGMT_STATUS_INVALID_PARAMS);
10394
10395         rp.instance = cp->instance;
10396         rp.flags = cp->flags;
10397         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10398         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10399
10400         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10401                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10402 }
10403
10404 static const struct hci_mgmt_handler mgmt_handlers[] = {
10405         { NULL }, /* 0x0000 (no command) */
10406         { read_version,            MGMT_READ_VERSION_SIZE,
10407                                                 HCI_MGMT_NO_HDEV |
10408                                                 HCI_MGMT_UNTRUSTED },
10409         { read_commands,           MGMT_READ_COMMANDS_SIZE,
10410                                                 HCI_MGMT_NO_HDEV |
10411                                                 HCI_MGMT_UNTRUSTED },
10412         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
10413                                                 HCI_MGMT_NO_HDEV |
10414                                                 HCI_MGMT_UNTRUSTED },
10415         { read_controller_info,    MGMT_READ_INFO_SIZE,
10416                                                 HCI_MGMT_UNTRUSTED },
10417         { set_powered,             MGMT_SETTING_SIZE },
10418         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
10419         { set_connectable,         MGMT_SETTING_SIZE },
10420         { set_fast_connectable,    MGMT_SETTING_SIZE },
10421         { set_bondable,            MGMT_SETTING_SIZE },
10422         { set_link_security,       MGMT_SETTING_SIZE },
10423         { set_ssp,                 MGMT_SETTING_SIZE },
10424         { set_hs,                  MGMT_SETTING_SIZE },
10425         { set_le,                  MGMT_SETTING_SIZE },
10426         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
10427         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
10428         { add_uuid,                MGMT_ADD_UUID_SIZE },
10429         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
10430         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
10431                                                 HCI_MGMT_VAR_LEN },
10432         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
10433                                                 HCI_MGMT_VAR_LEN },
10434         { disconnect,              MGMT_DISCONNECT_SIZE },
10435         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
10436         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
10437         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
10438         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
10439         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
10440         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
10441         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
10442         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
10443         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
10444         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
10445         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
10446         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
10447         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
10448                                                 HCI_MGMT_VAR_LEN },
10449         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
10450         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
10451         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
10452         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
10453         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
10454         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
10455         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
10456         { set_advertising,         MGMT_SETTING_SIZE },
10457         { set_bredr,               MGMT_SETTING_SIZE },
10458         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
10459         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
10460         { set_secure_conn,         MGMT_SETTING_SIZE },
10461         { set_debug_keys,          MGMT_SETTING_SIZE },
10462         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
10463         { load_irks,               MGMT_LOAD_IRKS_SIZE,
10464                                                 HCI_MGMT_VAR_LEN },
10465         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
10466         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
10467         { add_device,              MGMT_ADD_DEVICE_SIZE },
10468         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
10469         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
10470                                                 HCI_MGMT_VAR_LEN },
10471         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
10472                                                 HCI_MGMT_NO_HDEV |
10473                                                 HCI_MGMT_UNTRUSTED },
10474         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
10475                                                 HCI_MGMT_UNCONFIGURED |
10476                                                 HCI_MGMT_UNTRUSTED },
10477         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
10478                                                 HCI_MGMT_UNCONFIGURED },
10479         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
10480                                                 HCI_MGMT_UNCONFIGURED },
10481         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
10482                                                 HCI_MGMT_VAR_LEN },
10483         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
10484         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
10485                                                 HCI_MGMT_NO_HDEV |
10486                                                 HCI_MGMT_UNTRUSTED },
10487         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
10488         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
10489                                                 HCI_MGMT_VAR_LEN },
10490         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
10491         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
10492         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
10493         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
10494                                                 HCI_MGMT_UNTRUSTED },
10495         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
10496         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
10497         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
10498         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
10499                                                 HCI_MGMT_VAR_LEN },
10500         { set_wideband_speech,     MGMT_SETTING_SIZE },
10501         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
10502                                                 HCI_MGMT_UNTRUSTED },
10503         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
10504                                                 HCI_MGMT_UNTRUSTED |
10505                                                 HCI_MGMT_HDEV_OPTIONAL },
10506         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
10507                                                 HCI_MGMT_VAR_LEN |
10508                                                 HCI_MGMT_HDEV_OPTIONAL },
10509         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
10510                                                 HCI_MGMT_UNTRUSTED },
10511         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
10512                                                 HCI_MGMT_VAR_LEN },
10513         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
10514                                                 HCI_MGMT_UNTRUSTED },
10515         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
10516                                                 HCI_MGMT_VAR_LEN },
10517         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
10518         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
10519         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
10520         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
10521                                                 HCI_MGMT_VAR_LEN },
10522         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
10523         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
10524                                                 HCI_MGMT_VAR_LEN },
10525         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
10526                                                 HCI_MGMT_VAR_LEN },
10527         { add_adv_patterns_monitor_rssi,
10528                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
10529                                                 HCI_MGMT_VAR_LEN },
10530         { set_mesh,                MGMT_SET_MESH_RECEIVER_SIZE,
10531                                                 HCI_MGMT_VAR_LEN },
10532         { mesh_features,           MGMT_MESH_READ_FEATURES_SIZE },
10533         { mesh_send,               MGMT_MESH_SEND_SIZE,
10534                                                 HCI_MGMT_VAR_LEN },
10535         { mesh_send_cancel,        MGMT_MESH_SEND_CANCEL_SIZE },
10536 };
10537
10538 #ifdef TIZEN_BT
10539 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
10540         { NULL }, /* 0x0000 (no command) */
10541         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
10542         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
10543                                                 HCI_MGMT_VAR_LEN },
10544         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
10545                                                 HCI_MGMT_VAR_LEN },
10546         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
10547         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
10548         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
10549         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
10550         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
10551         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
10552 };
10553 #endif
10554
10555 void mgmt_index_added(struct hci_dev *hdev)
10556 {
10557         struct mgmt_ev_ext_index ev;
10558
10559         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10560                 return;
10561
10562         switch (hdev->dev_type) {
10563         case HCI_PRIMARY:
10564                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10565                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
10566                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10567                         ev.type = 0x01;
10568                 } else {
10569                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
10570                                          HCI_MGMT_INDEX_EVENTS);
10571                         ev.type = 0x00;
10572                 }
10573                 break;
10574         case HCI_AMP:
10575                 ev.type = 0x02;
10576                 break;
10577         default:
10578                 return;
10579         }
10580
10581         ev.bus = hdev->bus;
10582
10583         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
10584                          HCI_MGMT_EXT_INDEX_EVENTS);
10585 }
10586
10587 void mgmt_index_removed(struct hci_dev *hdev)
10588 {
10589         struct mgmt_ev_ext_index ev;
10590         u8 status = MGMT_STATUS_INVALID_INDEX;
10591
10592         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10593                 return;
10594
10595         switch (hdev->dev_type) {
10596         case HCI_PRIMARY:
10597                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10598
10599                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10600                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
10601                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10602                         ev.type = 0x01;
10603                 } else {
10604                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
10605                                          HCI_MGMT_INDEX_EVENTS);
10606                         ev.type = 0x00;
10607                 }
10608                 break;
10609         case HCI_AMP:
10610                 ev.type = 0x02;
10611                 break;
10612         default:
10613                 return;
10614         }
10615
10616         ev.bus = hdev->bus;
10617
10618         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
10619                          HCI_MGMT_EXT_INDEX_EVENTS);
10620
10621         /* Cancel any remaining timed work */
10622         if (!hci_dev_test_flag(hdev, HCI_MGMT))
10623                 return;
10624         cancel_delayed_work_sync(&hdev->discov_off);
10625         cancel_delayed_work_sync(&hdev->service_cache);
10626         cancel_delayed_work_sync(&hdev->rpa_expired);
10627 }
10628
10629 void mgmt_power_on(struct hci_dev *hdev, int err)
10630 {
10631         struct cmd_lookup match = { NULL, hdev };
10632
10633         bt_dev_dbg(hdev, "err %d", err);
10634
10635         hci_dev_lock(hdev);
10636
10637         if (!err) {
10638                 restart_le_actions(hdev);
10639                 hci_update_passive_scan(hdev);
10640         }
10641
10642         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10643
10644         new_settings(hdev, match.sk);
10645
10646         if (match.sk)
10647                 sock_put(match.sk);
10648
10649         hci_dev_unlock(hdev);
10650 }
10651
10652 void __mgmt_power_off(struct hci_dev *hdev)
10653 {
10654         struct cmd_lookup match = { NULL, hdev };
10655         u8 status, zero_cod[] = { 0, 0, 0 };
10656
10657         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10658
10659         /* If the power off is because of hdev unregistration let
10660          * use the appropriate INVALID_INDEX status. Otherwise use
10661          * NOT_POWERED. We cover both scenarios here since later in
10662          * mgmt_index_removed() any hci_conn callbacks will have already
10663          * been triggered, potentially causing misleading DISCONNECTED
10664          * status responses.
10665          */
10666         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
10667                 status = MGMT_STATUS_INVALID_INDEX;
10668         else
10669                 status = MGMT_STATUS_NOT_POWERED;
10670
10671         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10672
10673         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
10674                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
10675                                    zero_cod, sizeof(zero_cod),
10676                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10677                 ext_info_changed(hdev, NULL);
10678         }
10679
10680         new_settings(hdev, match.sk);
10681
10682         if (match.sk)
10683                 sock_put(match.sk);
10684 }
10685
10686 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
10687 {
10688         struct mgmt_pending_cmd *cmd;
10689         u8 status;
10690
10691         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10692         if (!cmd)
10693                 return;
10694
10695         if (err == -ERFKILL)
10696                 status = MGMT_STATUS_RFKILLED;
10697         else
10698                 status = MGMT_STATUS_FAILED;
10699
10700         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
10701
10702         mgmt_pending_remove(cmd);
10703 }
10704
10705 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
10706                        bool persistent)
10707 {
10708         struct mgmt_ev_new_link_key ev;
10709
10710         memset(&ev, 0, sizeof(ev));
10711
10712         ev.store_hint = persistent;
10713         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10714         ev.key.addr.type = BDADDR_BREDR;
10715         ev.key.type = key->type;
10716         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
10717         ev.key.pin_len = key->pin_len;
10718
10719         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
10720 }
10721
10722 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
10723 {
10724         switch (ltk->type) {
10725         case SMP_LTK:
10726         case SMP_LTK_RESPONDER:
10727                 if (ltk->authenticated)
10728                         return MGMT_LTK_AUTHENTICATED;
10729                 return MGMT_LTK_UNAUTHENTICATED;
10730         case SMP_LTK_P256:
10731                 if (ltk->authenticated)
10732                         return MGMT_LTK_P256_AUTH;
10733                 return MGMT_LTK_P256_UNAUTH;
10734         case SMP_LTK_P256_DEBUG:
10735                 return MGMT_LTK_P256_DEBUG;
10736         }
10737
10738         return MGMT_LTK_UNAUTHENTICATED;
10739 }
10740
10741 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
10742 {
10743         struct mgmt_ev_new_long_term_key ev;
10744
10745         memset(&ev, 0, sizeof(ev));
10746
10747         /* Devices using resolvable or non-resolvable random addresses
10748          * without providing an identity resolving key don't require
10749          * to store long term keys. Their addresses will change the
10750          * next time around.
10751          *
10752          * Only when a remote device provides an identity address
10753          * make sure the long term key is stored. If the remote
10754          * identity is known, the long term keys are internally
10755          * mapped to the identity address. So allow static random
10756          * and public addresses here.
10757          */
10758         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10759             (key->bdaddr.b[5] & 0xc0) != 0xc0)
10760                 ev.store_hint = 0x00;
10761         else
10762                 ev.store_hint = persistent;
10763
10764         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10765         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
10766         ev.key.type = mgmt_ltk_type(key);
10767         ev.key.enc_size = key->enc_size;
10768         ev.key.ediv = key->ediv;
10769         ev.key.rand = key->rand;
10770
10771         if (key->type == SMP_LTK)
10772                 ev.key.initiator = 1;
10773
10774         /* Make sure we copy only the significant bytes based on the
10775          * encryption key size, and set the rest of the value to zeroes.
10776          */
10777         memcpy(ev.key.val, key->val, key->enc_size);
10778         memset(ev.key.val + key->enc_size, 0,
10779                sizeof(ev.key.val) - key->enc_size);
10780
10781         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
10782 }
10783
10784 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
10785 {
10786         struct mgmt_ev_new_irk ev;
10787
10788         memset(&ev, 0, sizeof(ev));
10789
10790         ev.store_hint = persistent;
10791
10792         bacpy(&ev.rpa, &irk->rpa);
10793         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
10794         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
10795         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
10796
10797         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
10798 }
10799
10800 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
10801                    bool persistent)
10802 {
10803         struct mgmt_ev_new_csrk ev;
10804
10805         memset(&ev, 0, sizeof(ev));
10806
10807         /* Devices using resolvable or non-resolvable random addresses
10808          * without providing an identity resolving key don't require
10809          * to store signature resolving keys. Their addresses will change
10810          * the next time around.
10811          *
10812          * Only when a remote device provides an identity address
10813          * make sure the signature resolving key is stored. So allow
10814          * static random and public addresses here.
10815          */
10816         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10817             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
10818                 ev.store_hint = 0x00;
10819         else
10820                 ev.store_hint = persistent;
10821
10822         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
10823         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
10824         ev.key.type = csrk->type;
10825         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
10826
10827         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
10828 }
10829
10830 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
10831                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
10832                          u16 max_interval, u16 latency, u16 timeout)
10833 {
10834         struct mgmt_ev_new_conn_param ev;
10835
10836         if (!hci_is_identity_address(bdaddr, bdaddr_type))
10837                 return;
10838
10839         memset(&ev, 0, sizeof(ev));
10840         bacpy(&ev.addr.bdaddr, bdaddr);
10841         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
10842         ev.store_hint = store_hint;
10843         ev.min_interval = cpu_to_le16(min_interval);
10844         ev.max_interval = cpu_to_le16(max_interval);
10845         ev.latency = cpu_to_le16(latency);
10846         ev.timeout = cpu_to_le16(timeout);
10847
10848         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
10849 }
10850
10851 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
10852                            u8 *name, u8 name_len)
10853 {
10854         struct sk_buff *skb;
10855         struct mgmt_ev_device_connected *ev;
10856         u16 eir_len = 0;
10857         u32 flags = 0;
10858
10859         /* allocate buff for LE or BR/EDR adv */
10860         if (conn->le_adv_data_len > 0)
10861                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
10862                                      sizeof(*ev) + conn->le_adv_data_len);
10863         else
10864                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
10865                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
10866                                      eir_precalc_len(sizeof(conn->dev_class)));
10867
10868         ev = skb_put(skb, sizeof(*ev));
10869         bacpy(&ev->addr.bdaddr, &conn->dst);
10870         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10871
10872         if (conn->out)
10873                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
10874
10875         ev->flags = __cpu_to_le32(flags);
10876
10877         /* We must ensure that the EIR Data fields are ordered and
10878          * unique. Keep it simple for now and avoid the problem by not
10879          * adding any BR/EDR data to the LE adv.
10880          */
10881         if (conn->le_adv_data_len > 0) {
10882                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
10883                 eir_len = conn->le_adv_data_len;
10884         } else {
10885                 if (name)
10886                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10887
10888                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
10889                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
10890                                                     conn->dev_class, sizeof(conn->dev_class));
10891         }
10892
10893         ev->eir_len = cpu_to_le16(eir_len);
10894
10895         mgmt_event_skb(skb, NULL);
10896 }
10897
10898 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
10899 {
10900         struct sock **sk = data;
10901
10902         cmd->cmd_complete(cmd, 0);
10903
10904         *sk = cmd->sk;
10905         sock_hold(*sk);
10906
10907         mgmt_pending_remove(cmd);
10908 }
10909
10910 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
10911 {
10912         struct hci_dev *hdev = data;
10913         struct mgmt_cp_unpair_device *cp = cmd->param;
10914
10915         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
10916
10917         cmd->cmd_complete(cmd, 0);
10918         mgmt_pending_remove(cmd);
10919 }
10920
10921 bool mgmt_powering_down(struct hci_dev *hdev)
10922 {
10923         struct mgmt_pending_cmd *cmd;
10924         struct mgmt_mode *cp;
10925
10926         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10927         if (!cmd)
10928                 return false;
10929
10930         cp = cmd->param;
10931         if (!cp->val)
10932                 return true;
10933
10934         return false;
10935 }
10936
10937 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10938                               u8 link_type, u8 addr_type, u8 reason,
10939                               bool mgmt_connected)
10940 {
10941         struct mgmt_ev_device_disconnected ev;
10942         struct sock *sk = NULL;
10943
10944         /* The connection is still in hci_conn_hash so test for 1
10945          * instead of 0 to know if this is the last one.
10946          */
10947         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10948                 cancel_delayed_work(&hdev->power_off);
10949                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10950         }
10951
10952         if (!mgmt_connected)
10953                 return;
10954
10955         if (link_type != ACL_LINK && link_type != LE_LINK)
10956                 return;
10957
10958         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
10959
10960         bacpy(&ev.addr.bdaddr, bdaddr);
10961         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10962         ev.reason = reason;
10963
10964         /* Report disconnects due to suspend */
10965         if (hdev->suspended)
10966                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10967
10968         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10969
10970         if (sk)
10971                 sock_put(sk);
10972
10973         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10974                              hdev);
10975 }
10976
10977 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10978                             u8 link_type, u8 addr_type, u8 status)
10979 {
10980         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10981         struct mgmt_cp_disconnect *cp;
10982         struct mgmt_pending_cmd *cmd;
10983
10984         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10985                              hdev);
10986
10987         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10988         if (!cmd)
10989                 return;
10990
10991         cp = cmd->param;
10992
10993         if (bacmp(bdaddr, &cp->addr.bdaddr))
10994                 return;
10995
10996         if (cp->addr.type != bdaddr_type)
10997                 return;
10998
10999         cmd->cmd_complete(cmd, mgmt_status(status));
11000         mgmt_pending_remove(cmd);
11001 }
11002
11003 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11004                          u8 addr_type, u8 status)
11005 {
11006         struct mgmt_ev_connect_failed ev;
11007
11008         /* The connection is still in hci_conn_hash so test for 1
11009          * instead of 0 to know if this is the last one.
11010          */
11011         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11012                 cancel_delayed_work(&hdev->power_off);
11013                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11014         }
11015
11016         bacpy(&ev.addr.bdaddr, bdaddr);
11017         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11018         ev.status = mgmt_status(status);
11019
11020         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
11021 }
11022
11023 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
11024 {
11025         struct mgmt_ev_pin_code_request ev;
11026
11027         bacpy(&ev.addr.bdaddr, bdaddr);
11028         ev.addr.type = BDADDR_BREDR;
11029         ev.secure = secure;
11030
11031         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
11032 }
11033
11034 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11035                                   u8 status)
11036 {
11037         struct mgmt_pending_cmd *cmd;
11038
11039         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
11040         if (!cmd)
11041                 return;
11042
11043         cmd->cmd_complete(cmd, mgmt_status(status));
11044         mgmt_pending_remove(cmd);
11045 }
11046
11047 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11048                                       u8 status)
11049 {
11050         struct mgmt_pending_cmd *cmd;
11051
11052         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
11053         if (!cmd)
11054                 return;
11055
11056         cmd->cmd_complete(cmd, mgmt_status(status));
11057         mgmt_pending_remove(cmd);
11058 }
11059
11060 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11061                               u8 link_type, u8 addr_type, u32 value,
11062                               u8 confirm_hint)
11063 {
11064         struct mgmt_ev_user_confirm_request ev;
11065
11066         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11067
11068         bacpy(&ev.addr.bdaddr, bdaddr);
11069         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11070         ev.confirm_hint = confirm_hint;
11071         ev.value = cpu_to_le32(value);
11072
11073         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
11074                           NULL);
11075 }
11076
11077 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11078                               u8 link_type, u8 addr_type)
11079 {
11080         struct mgmt_ev_user_passkey_request ev;
11081
11082         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11083
11084         bacpy(&ev.addr.bdaddr, bdaddr);
11085         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11086
11087         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
11088                           NULL);
11089 }
11090
11091 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11092                                       u8 link_type, u8 addr_type, u8 status,
11093                                       u8 opcode)
11094 {
11095         struct mgmt_pending_cmd *cmd;
11096
11097         cmd = pending_find(opcode, hdev);
11098         if (!cmd)
11099                 return -ENOENT;
11100
11101         cmd->cmd_complete(cmd, mgmt_status(status));
11102         mgmt_pending_remove(cmd);
11103
11104         return 0;
11105 }
11106
11107 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11108                                      u8 link_type, u8 addr_type, u8 status)
11109 {
11110         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11111                                           status, MGMT_OP_USER_CONFIRM_REPLY);
11112 }
11113
11114 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11115                                          u8 link_type, u8 addr_type, u8 status)
11116 {
11117         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11118                                           status,
11119                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
11120 }
11121
11122 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11123                                      u8 link_type, u8 addr_type, u8 status)
11124 {
11125         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11126                                           status, MGMT_OP_USER_PASSKEY_REPLY);
11127 }
11128
11129 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11130                                          u8 link_type, u8 addr_type, u8 status)
11131 {
11132         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11133                                           status,
11134                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
11135 }
11136
11137 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
11138                              u8 link_type, u8 addr_type, u32 passkey,
11139                              u8 entered)
11140 {
11141         struct mgmt_ev_passkey_notify ev;
11142
11143         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11144
11145         bacpy(&ev.addr.bdaddr, bdaddr);
11146         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11147         ev.passkey = __cpu_to_le32(passkey);
11148         ev.entered = entered;
11149
11150         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
11151 }
11152
11153 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
11154 {
11155         struct mgmt_ev_auth_failed ev;
11156         struct mgmt_pending_cmd *cmd;
11157         u8 status = mgmt_status(hci_status);
11158
11159         bacpy(&ev.addr.bdaddr, &conn->dst);
11160         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11161         ev.status = status;
11162
11163         cmd = find_pairing(conn);
11164
11165         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
11166                     cmd ? cmd->sk : NULL);
11167
11168         if (cmd) {
11169                 cmd->cmd_complete(cmd, status);
11170                 mgmt_pending_remove(cmd);
11171         }
11172 }
11173
11174 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
11175 {
11176         struct cmd_lookup match = { NULL, hdev };
11177         bool changed;
11178
11179         if (status) {
11180                 u8 mgmt_err = mgmt_status(status);
11181                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
11182                                      cmd_status_rsp, &mgmt_err);
11183                 return;
11184         }
11185
11186         if (test_bit(HCI_AUTH, &hdev->flags))
11187                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
11188         else
11189                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
11190
11191         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
11192                              &match);
11193
11194         if (changed)
11195                 new_settings(hdev, match.sk);
11196
11197         if (match.sk)
11198                 sock_put(match.sk);
11199 }
11200
11201 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
11202 {
11203         struct cmd_lookup *match = data;
11204
11205         if (match->sk == NULL) {
11206                 match->sk = cmd->sk;
11207                 sock_hold(match->sk);
11208         }
11209 }
11210
11211 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
11212                                     u8 status)
11213 {
11214         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
11215
11216         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
11217         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
11218         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
11219
11220         if (!status) {
11221                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
11222                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11223                 ext_info_changed(hdev, NULL);
11224         }
11225
11226         if (match.sk)
11227                 sock_put(match.sk);
11228 }
11229
11230 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
11231 {
11232         struct mgmt_cp_set_local_name ev;
11233         struct mgmt_pending_cmd *cmd;
11234
11235         if (status)
11236                 return;
11237
11238         memset(&ev, 0, sizeof(ev));
11239         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
11240         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
11241
11242         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
11243         if (!cmd) {
11244                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
11245
11246                 /* If this is a HCI command related to powering on the
11247                  * HCI dev don't send any mgmt signals.
11248                  */
11249                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
11250                         return;
11251         }
11252
11253         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
11254                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
11255         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
11256 }
11257
11258 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
11259 {
11260         int i;
11261
11262         for (i = 0; i < uuid_count; i++) {
11263                 if (!memcmp(uuid, uuids[i], 16))
11264                         return true;
11265         }
11266
11267         return false;
11268 }
11269
11270 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
11271 {
11272         u16 parsed = 0;
11273
11274         while (parsed < eir_len) {
11275                 u8 field_len = eir[0];
11276                 u8 uuid[16];
11277                 int i;
11278
11279                 if (field_len == 0)
11280                         break;
11281
11282                 if (eir_len - parsed < field_len + 1)
11283                         break;
11284
11285                 switch (eir[1]) {
11286                 case EIR_UUID16_ALL:
11287                 case EIR_UUID16_SOME:
11288                         for (i = 0; i + 3 <= field_len; i += 2) {
11289                                 memcpy(uuid, bluetooth_base_uuid, 16);
11290                                 uuid[13] = eir[i + 3];
11291                                 uuid[12] = eir[i + 2];
11292                                 if (has_uuid(uuid, uuid_count, uuids))
11293                                         return true;
11294                         }
11295                         break;
11296                 case EIR_UUID32_ALL:
11297                 case EIR_UUID32_SOME:
11298                         for (i = 0; i + 5 <= field_len; i += 4) {
11299                                 memcpy(uuid, bluetooth_base_uuid, 16);
11300                                 uuid[15] = eir[i + 5];
11301                                 uuid[14] = eir[i + 4];
11302                                 uuid[13] = eir[i + 3];
11303                                 uuid[12] = eir[i + 2];
11304                                 if (has_uuid(uuid, uuid_count, uuids))
11305                                         return true;
11306                         }
11307                         break;
11308                 case EIR_UUID128_ALL:
11309                 case EIR_UUID128_SOME:
11310                         for (i = 0; i + 17 <= field_len; i += 16) {
11311                                 memcpy(uuid, eir + i + 2, 16);
11312                                 if (has_uuid(uuid, uuid_count, uuids))
11313                                         return true;
11314                         }
11315                         break;
11316                 }
11317
11318                 parsed += field_len + 1;
11319                 eir += field_len + 1;
11320         }
11321
11322         return false;
11323 }
11324
11325 static void restart_le_scan(struct hci_dev *hdev)
11326 {
11327         /* If controller is not scanning we are done. */
11328         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
11329                 return;
11330
11331         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
11332                        hdev->discovery.scan_start +
11333                        hdev->discovery.scan_duration))
11334                 return;
11335
11336         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
11337                            DISCOV_LE_RESTART_DELAY);
11338 }
11339
11340 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
11341                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11342 {
11343         /* If a RSSI threshold has been specified, and
11344          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
11345          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
11346          * is set, let it through for further processing, as we might need to
11347          * restart the scan.
11348          *
11349          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
11350          * the results are also dropped.
11351          */
11352         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11353             (rssi == HCI_RSSI_INVALID ||
11354             (rssi < hdev->discovery.rssi &&
11355              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
11356                 return  false;
11357
11358         if (hdev->discovery.uuid_count != 0) {
11359                 /* If a list of UUIDs is provided in filter, results with no
11360                  * matching UUID should be dropped.
11361                  */
11362                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
11363                                    hdev->discovery.uuids) &&
11364                     !eir_has_uuids(scan_rsp, scan_rsp_len,
11365                                    hdev->discovery.uuid_count,
11366                                    hdev->discovery.uuids))
11367                         return false;
11368         }
11369
11370         /* If duplicate filtering does not report RSSI changes, then restart
11371          * scanning to ensure updated result with updated RSSI values.
11372          */
11373         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
11374                 restart_le_scan(hdev);
11375
11376                 /* Validate RSSI value against the RSSI threshold once more. */
11377                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11378                     rssi < hdev->discovery.rssi)
11379                         return false;
11380         }
11381
11382         return true;
11383 }
11384
11385 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
11386                                   bdaddr_t *bdaddr, u8 addr_type)
11387 {
11388         struct mgmt_ev_adv_monitor_device_lost ev;
11389
11390         ev.monitor_handle = cpu_to_le16(handle);
11391         bacpy(&ev.addr.bdaddr, bdaddr);
11392         ev.addr.type = addr_type;
11393
11394         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
11395                    NULL);
11396 }
11397
11398 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
11399                                                struct sk_buff *skb,
11400                                                struct sock *skip_sk,
11401                                                u16 handle)
11402 {
11403         struct sk_buff *advmon_skb;
11404         size_t advmon_skb_len;
11405         __le16 *monitor_handle;
11406
11407         if (!skb)
11408                 return;
11409
11410         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
11411                           sizeof(struct mgmt_ev_device_found)) + skb->len;
11412         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
11413                                     advmon_skb_len);
11414         if (!advmon_skb)
11415                 return;
11416
11417         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
11418          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
11419          * store monitor_handle of the matched monitor.
11420          */
11421         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
11422         *monitor_handle = cpu_to_le16(handle);
11423         skb_put_data(advmon_skb, skb->data, skb->len);
11424
11425         mgmt_event_skb(advmon_skb, skip_sk);
11426 }
11427
11428 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
11429                                           bdaddr_t *bdaddr, bool report_device,
11430                                           struct sk_buff *skb,
11431                                           struct sock *skip_sk)
11432 {
11433         struct monitored_device *dev, *tmp;
11434         bool matched = false;
11435         bool notified = false;
11436
11437         /* We have received the Advertisement Report because:
11438          * 1. the kernel has initiated active discovery
11439          * 2. if not, we have pend_le_reports > 0 in which case we are doing
11440          *    passive scanning
11441          * 3. if none of the above is true, we have one or more active
11442          *    Advertisement Monitor
11443          *
11444          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
11445          * and report ONLY one advertisement per device for the matched Monitor
11446          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
11447          *
11448          * For case 3, since we are not active scanning and all advertisements
11449          * received are due to a matched Advertisement Monitor, report all
11450          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
11451          */
11452         if (report_device && !hdev->advmon_pend_notify) {
11453                 mgmt_event_skb(skb, skip_sk);
11454                 return;
11455         }
11456
11457         hdev->advmon_pend_notify = false;
11458
11459         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
11460                 if (!bacmp(&dev->bdaddr, bdaddr)) {
11461                         matched = true;
11462
11463                         if (!dev->notified) {
11464                                 mgmt_send_adv_monitor_device_found(hdev, skb,
11465                                                                    skip_sk,
11466                                                                    dev->handle);
11467                                 notified = true;
11468                                 dev->notified = true;
11469                         }
11470                 }
11471
11472                 if (!dev->notified)
11473                         hdev->advmon_pend_notify = true;
11474         }
11475
11476         if (!report_device &&
11477             ((matched && !notified) || !msft_monitor_supported(hdev))) {
11478                 /* Handle 0 indicates that we are not active scanning and this
11479                  * is a subsequent advertisement report for an already matched
11480                  * Advertisement Monitor or the controller offloading support
11481                  * is not available.
11482                  */
11483                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
11484         }
11485
11486         if (report_device)
11487                 mgmt_event_skb(skb, skip_sk);
11488         else
11489                 kfree_skb(skb);
11490 }
11491
11492 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
11493                               u8 addr_type, s8 rssi, u32 flags, u8 *eir,
11494                               u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
11495                               u64 instant)
11496 {
11497         struct sk_buff *skb;
11498         struct mgmt_ev_mesh_device_found *ev;
11499         int i, j;
11500
11501         if (!hdev->mesh_ad_types[0])
11502                 goto accepted;
11503
11504         /* Scan for requested AD types */
11505         if (eir_len > 0) {
11506                 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
11507                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
11508                                 if (!hdev->mesh_ad_types[j])
11509                                         break;
11510
11511                                 if (hdev->mesh_ad_types[j] == eir[i + 1])
11512                                         goto accepted;
11513                         }
11514                 }
11515         }
11516
11517         if (scan_rsp_len > 0) {
11518                 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
11519                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
11520                                 if (!hdev->mesh_ad_types[j])
11521                                         break;
11522
11523                                 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
11524                                         goto accepted;
11525                         }
11526                 }
11527         }
11528
11529         return;
11530
11531 accepted:
11532         skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
11533                              sizeof(*ev) + eir_len + scan_rsp_len);
11534         if (!skb)
11535                 return;
11536
11537         ev = skb_put(skb, sizeof(*ev));
11538
11539         bacpy(&ev->addr.bdaddr, bdaddr);
11540         ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
11541         ev->rssi = rssi;
11542         ev->flags = cpu_to_le32(flags);
11543         ev->instant = cpu_to_le64(instant);
11544
11545         if (eir_len > 0)
11546                 /* Copy EIR or advertising data into event */
11547                 skb_put_data(skb, eir, eir_len);
11548
11549         if (scan_rsp_len > 0)
11550                 /* Append scan response data to event */
11551                 skb_put_data(skb, scan_rsp, scan_rsp_len);
11552
11553         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11554
11555         mgmt_event_skb(skb, NULL);
11556 }
11557
11558 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11559                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
11560                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
11561                        u64 instant)
11562 {
11563         struct sk_buff *skb;
11564         struct mgmt_ev_device_found *ev;
11565         bool report_device = hci_discovery_active(hdev);
11566
11567         if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
11568                 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
11569                                   eir, eir_len, scan_rsp, scan_rsp_len,
11570                                   instant);
11571
11572         /* Don't send events for a non-kernel initiated discovery. With
11573          * LE one exception is if we have pend_le_reports > 0 in which
11574          * case we're doing passive scanning and want these events.
11575          */
11576         if (!hci_discovery_active(hdev)) {
11577                 if (link_type == ACL_LINK)
11578                         return;
11579                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
11580                         report_device = true;
11581                 else if (!hci_is_adv_monitoring(hdev))
11582                         return;
11583         }
11584
11585         if (hdev->discovery.result_filtering) {
11586                 /* We are using service discovery */
11587                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
11588                                      scan_rsp_len))
11589                         return;
11590         }
11591
11592         if (hdev->discovery.limited) {
11593                 /* Check for limited discoverable bit */
11594                 if (dev_class) {
11595                         if (!(dev_class[1] & 0x20))
11596                                 return;
11597                 } else {
11598                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
11599                         if (!flags || !(flags[0] & LE_AD_LIMITED))
11600                                 return;
11601                 }
11602         }
11603
11604         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
11605         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
11606                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
11607         if (!skb)
11608                 return;
11609
11610         ev = skb_put(skb, sizeof(*ev));
11611
11612         /* In case of device discovery with BR/EDR devices (pre 1.2), the
11613          * RSSI value was reported as 0 when not available. This behavior
11614          * is kept when using device discovery. This is required for full
11615          * backwards compatibility with the API.
11616          *
11617          * However when using service discovery, the value 127 will be
11618          * returned when the RSSI is not available.
11619          */
11620         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
11621             link_type == ACL_LINK)
11622                 rssi = 0;
11623
11624         bacpy(&ev->addr.bdaddr, bdaddr);
11625         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11626         ev->rssi = rssi;
11627         ev->flags = cpu_to_le32(flags);
11628
11629         if (eir_len > 0)
11630                 /* Copy EIR or advertising data into event */
11631                 skb_put_data(skb, eir, eir_len);
11632
11633         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
11634                 u8 eir_cod[5];
11635
11636                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
11637                                            dev_class, 3);
11638                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
11639         }
11640
11641         if (scan_rsp_len > 0)
11642                 /* Append scan response data to event */
11643                 skb_put_data(skb, scan_rsp, scan_rsp_len);
11644
11645         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11646
11647         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
11648 }
11649
11650 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11651                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
11652 {
11653         struct sk_buff *skb;
11654         struct mgmt_ev_device_found *ev;
11655         u16 eir_len = 0;
11656         u32 flags = 0;
11657
11658         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
11659                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
11660
11661         ev = skb_put(skb, sizeof(*ev));
11662         bacpy(&ev->addr.bdaddr, bdaddr);
11663         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11664         ev->rssi = rssi;
11665
11666         if (name)
11667                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
11668         else
11669                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
11670
11671         ev->eir_len = cpu_to_le16(eir_len);
11672         ev->flags = cpu_to_le32(flags);
11673
11674         mgmt_event_skb(skb, NULL);
11675 }
11676
11677 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
11678 {
11679         struct mgmt_ev_discovering ev;
11680
11681         bt_dev_dbg(hdev, "discovering %u", discovering);
11682
11683         memset(&ev, 0, sizeof(ev));
11684         ev.type = hdev->discovery.type;
11685         ev.discovering = discovering;
11686
11687         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
11688 }
11689
11690 void mgmt_suspending(struct hci_dev *hdev, u8 state)
11691 {
11692         struct mgmt_ev_controller_suspend ev;
11693
11694         ev.suspend_state = state;
11695         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
11696 }
11697
11698 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
11699                    u8 addr_type)
11700 {
11701         struct mgmt_ev_controller_resume ev;
11702
11703         ev.wake_reason = reason;
11704         if (bdaddr) {
11705                 bacpy(&ev.addr.bdaddr, bdaddr);
11706                 ev.addr.type = addr_type;
11707         } else {
11708                 memset(&ev.addr, 0, sizeof(ev.addr));
11709         }
11710
11711         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
11712 }
11713
11714 static struct hci_mgmt_chan chan = {
11715         .channel        = HCI_CHANNEL_CONTROL,
11716         .handler_count  = ARRAY_SIZE(mgmt_handlers),
11717         .handlers       = mgmt_handlers,
11718 #ifdef TIZEN_BT
11719         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
11720         .tizen_handlers = tizen_mgmt_handlers,
11721 #endif
11722         .hdev_init      = mgmt_init_hdev,
11723 };
11724
11725 int mgmt_init(void)
11726 {
11727         return hci_mgmt_chan_register(&chan);
11728 }
11729
11730 void mgmt_exit(void)
11731 {
11732         hci_mgmt_chan_unregister(&chan);
11733 }
11734
11735 void mgmt_cleanup(struct sock *sk)
11736 {
11737         struct mgmt_mesh_tx *mesh_tx;
11738         struct hci_dev *hdev;
11739
11740         read_lock(&hci_dev_list_lock);
11741
11742         list_for_each_entry(hdev, &hci_dev_list, list) {
11743                 do {
11744                         mesh_tx = mgmt_mesh_next(hdev, sk);
11745
11746                         if (mesh_tx)
11747                                 mesh_send_complete(hdev, mesh_tx, true);
11748                 } while (mesh_tx);
11749         }
11750
11751         read_unlock(&hci_dev_list_lock);
11752 }