net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #include <net/bluetooth/sco.h>
  38 #endif
  39
  40 #include "hci_request.h"
  41 #include "smp.h"
  42 #include "mgmt_util.h"
  43 #include "mgmt_config.h"
  44 #include "msft.h"
  45
  46 #define MGMT_VERSION    1
  47 #define MGMT_REVISION   21
  48
  49 static const u16 mgmt_commands[] = {
  50         MGMT_OP_READ_INDEX_LIST,
  51         MGMT_OP_READ_INFO,
  52         MGMT_OP_SET_POWERED,
  53         MGMT_OP_SET_DISCOVERABLE,
  54         MGMT_OP_SET_CONNECTABLE,
  55         MGMT_OP_SET_FAST_CONNECTABLE,
  56         MGMT_OP_SET_BONDABLE,
  57         MGMT_OP_SET_LINK_SECURITY,
  58         MGMT_OP_SET_SSP,
  59         MGMT_OP_SET_HS,
  60         MGMT_OP_SET_LE,
  61         MGMT_OP_SET_DEV_CLASS,
  62         MGMT_OP_SET_LOCAL_NAME,
  63         MGMT_OP_ADD_UUID,
  64         MGMT_OP_REMOVE_UUID,
  65         MGMT_OP_LOAD_LINK_KEYS,
  66         MGMT_OP_LOAD_LONG_TERM_KEYS,
  67         MGMT_OP_DISCONNECT,
  68         MGMT_OP_GET_CONNECTIONS,
  69         MGMT_OP_PIN_CODE_REPLY,
  70         MGMT_OP_PIN_CODE_NEG_REPLY,
  71         MGMT_OP_SET_IO_CAPABILITY,
  72         MGMT_OP_PAIR_DEVICE,
  73         MGMT_OP_CANCEL_PAIR_DEVICE,
  74         MGMT_OP_UNPAIR_DEVICE,
  75         MGMT_OP_USER_CONFIRM_REPLY,
  76         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  77         MGMT_OP_USER_PASSKEY_REPLY,
  78         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  79         MGMT_OP_READ_LOCAL_OOB_DATA,
  80         MGMT_OP_ADD_REMOTE_OOB_DATA,
  81         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  82         MGMT_OP_START_DISCOVERY,
  83         MGMT_OP_STOP_DISCOVERY,
  84         MGMT_OP_CONFIRM_NAME,
  85         MGMT_OP_BLOCK_DEVICE,
  86         MGMT_OP_UNBLOCK_DEVICE,
  87         MGMT_OP_SET_DEVICE_ID,
  88         MGMT_OP_SET_ADVERTISING,
  89         MGMT_OP_SET_BREDR,
  90         MGMT_OP_SET_STATIC_ADDRESS,
  91         MGMT_OP_SET_SCAN_PARAMS,
  92         MGMT_OP_SET_SECURE_CONN,
  93         MGMT_OP_SET_DEBUG_KEYS,
  94         MGMT_OP_SET_PRIVACY,
  95         MGMT_OP_LOAD_IRKS,
  96         MGMT_OP_GET_CONN_INFO,
  97         MGMT_OP_GET_CLOCK_INFO,
  98         MGMT_OP_ADD_DEVICE,
  99         MGMT_OP_REMOVE_DEVICE,
 100         MGMT_OP_LOAD_CONN_PARAM,
 101         MGMT_OP_READ_UNCONF_INDEX_LIST,
 102         MGMT_OP_READ_CONFIG_INFO,
 103         MGMT_OP_SET_EXTERNAL_CONFIG,
 104         MGMT_OP_SET_PUBLIC_ADDRESS,
 105         MGMT_OP_START_SERVICE_DISCOVERY,
 106         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 107         MGMT_OP_READ_EXT_INDEX_LIST,
 108         MGMT_OP_READ_ADV_FEATURES,
 109         MGMT_OP_ADD_ADVERTISING,
 110         MGMT_OP_REMOVE_ADVERTISING,
 111         MGMT_OP_GET_ADV_SIZE_INFO,
 112         MGMT_OP_START_LIMITED_DISCOVERY,
 113         MGMT_OP_READ_EXT_INFO,
 114         MGMT_OP_SET_APPEARANCE,
 115         MGMT_OP_GET_PHY_CONFIGURATION,
 116         MGMT_OP_SET_PHY_CONFIGURATION,
 117         MGMT_OP_SET_BLOCKED_KEYS,
 118         MGMT_OP_SET_WIDEBAND_SPEECH,
 119         MGMT_OP_READ_CONTROLLER_CAP,
 120         MGMT_OP_READ_EXP_FEATURES_INFO,
 121         MGMT_OP_SET_EXP_FEATURE,
 122         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 123         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 124         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 125         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 126         MGMT_OP_GET_DEVICE_FLAGS,
 127         MGMT_OP_SET_DEVICE_FLAGS,
 128         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 129         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 130         MGMT_OP_REMOVE_ADV_MONITOR,
 131         MGMT_OP_ADD_EXT_ADV_PARAMS,
 132         MGMT_OP_ADD_EXT_ADV_DATA,
 133         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 134 };
 135
 136 static const u16 mgmt_events[] = {
 137         MGMT_EV_CONTROLLER_ERROR,
 138         MGMT_EV_INDEX_ADDED,
 139         MGMT_EV_INDEX_REMOVED,
 140         MGMT_EV_NEW_SETTINGS,
 141         MGMT_EV_CLASS_OF_DEV_CHANGED,
 142         MGMT_EV_LOCAL_NAME_CHANGED,
 143         MGMT_EV_NEW_LINK_KEY,
 144         MGMT_EV_NEW_LONG_TERM_KEY,
 145         MGMT_EV_DEVICE_CONNECTED,
 146         MGMT_EV_DEVICE_DISCONNECTED,
 147         MGMT_EV_CONNECT_FAILED,
 148         MGMT_EV_PIN_CODE_REQUEST,
 149         MGMT_EV_USER_CONFIRM_REQUEST,
 150         MGMT_EV_USER_PASSKEY_REQUEST,
 151         MGMT_EV_AUTH_FAILED,
 152         MGMT_EV_DEVICE_FOUND,
 153         MGMT_EV_DISCOVERING,
 154         MGMT_EV_DEVICE_BLOCKED,
 155         MGMT_EV_DEVICE_UNBLOCKED,
 156         MGMT_EV_DEVICE_UNPAIRED,
 157         MGMT_EV_PASSKEY_NOTIFY,
 158         MGMT_EV_NEW_IRK,
 159         MGMT_EV_NEW_CSRK,
 160         MGMT_EV_DEVICE_ADDED,
 161         MGMT_EV_DEVICE_REMOVED,
 162         MGMT_EV_NEW_CONN_PARAM,
 163         MGMT_EV_UNCONF_INDEX_ADDED,
 164         MGMT_EV_UNCONF_INDEX_REMOVED,
 165         MGMT_EV_NEW_CONFIG_OPTIONS,
 166         MGMT_EV_EXT_INDEX_ADDED,
 167         MGMT_EV_EXT_INDEX_REMOVED,
 168         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 169         MGMT_EV_ADVERTISING_ADDED,
 170         MGMT_EV_ADVERTISING_REMOVED,
 171         MGMT_EV_EXT_INFO_CHANGED,
 172         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 173         MGMT_EV_EXP_FEATURE_CHANGED,
 174         MGMT_EV_DEVICE_FLAGS_CHANGED,
 175         MGMT_EV_ADV_MONITOR_ADDED,
 176         MGMT_EV_ADV_MONITOR_REMOVED,
 177         MGMT_EV_CONTROLLER_SUSPEND,
 178         MGMT_EV_CONTROLLER_RESUME,
 179 };
 180
 181 static const u16 mgmt_untrusted_commands[] = {
 182         MGMT_OP_READ_INDEX_LIST,
 183         MGMT_OP_READ_INFO,
 184         MGMT_OP_READ_UNCONF_INDEX_LIST,
 185         MGMT_OP_READ_CONFIG_INFO,
 186         MGMT_OP_READ_EXT_INDEX_LIST,
 187         MGMT_OP_READ_EXT_INFO,
 188         MGMT_OP_READ_CONTROLLER_CAP,
 189         MGMT_OP_READ_EXP_FEATURES_INFO,
 190         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 191         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 192 };
 193
 194 static const u16 mgmt_untrusted_events[] = {
 195         MGMT_EV_INDEX_ADDED,
 196         MGMT_EV_INDEX_REMOVED,
 197         MGMT_EV_NEW_SETTINGS,
 198         MGMT_EV_CLASS_OF_DEV_CHANGED,
 199         MGMT_EV_LOCAL_NAME_CHANGED,
 200         MGMT_EV_UNCONF_INDEX_ADDED,
 201         MGMT_EV_UNCONF_INDEX_REMOVED,
 202         MGMT_EV_NEW_CONFIG_OPTIONS,
 203         MGMT_EV_EXT_INDEX_ADDED,
 204         MGMT_EV_EXT_INDEX_REMOVED,
 205         MGMT_EV_EXT_INFO_CHANGED,
 206         MGMT_EV_EXP_FEATURE_CHANGED,
 207 };
 208
 209 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 210
 211 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 212                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 213
 214 /* HCI to MGMT error code conversion table */
 215 static const u8 mgmt_status_table[] = {
 216         MGMT_STATUS_SUCCESS,
 217         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 218         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 219         MGMT_STATUS_FAILED,             /* Hardware Failure */
 220         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 221         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 222         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 223         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 224         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 225         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 226         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 227         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 228         MGMT_STATUS_BUSY,               /* Command Disallowed */
 229         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 230         MGMT_STATUS_REJECTED,           /* Rejected Security */
 231         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 232         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 233         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 234         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 235         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 236         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 237         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 238         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 239         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 240         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 241         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 242         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 243         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 244         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 245         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 246         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 247         MGMT_STATUS_FAILED,             /* Unspecified Error */
 248         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 249         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 250         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 251         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 252         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 253         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 254         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 255         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 256         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 257         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 258         MGMT_STATUS_FAILED,             /* Transaction Collision */
 259         MGMT_STATUS_FAILED,             /* Reserved for future use */
 260         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 261         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 262         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 263         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 264         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 265         MGMT_STATUS_FAILED,             /* Reserved for future use */
 266         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 267         MGMT_STATUS_FAILED,             /* Reserved for future use */
 268         MGMT_STATUS_FAILED,             /* Slot Violation */
 269         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 270         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 271         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 272         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 273         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 274         MGMT_STATUS_BUSY,               /* Controller Busy */
 275         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 276         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 277         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 278         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 279         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 280 };
 281
 282 static u8 mgmt_status(u8 hci_status)
 283 {
 284         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 285                 return mgmt_status_table[hci_status];
 286
 287         return MGMT_STATUS_FAILED;
 288 }
 289
 290 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 291                             u16 len, int flag)
 292 {
 293         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 294                                flag, NULL);
 295 }
 296
 297 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 298                               u16 len, int flag, struct sock *skip_sk)
 299 {
 300         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 301                                flag, skip_sk);
 302 }
 303
 304 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 305                       struct sock *skip_sk)
 306 {
 307         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 308                                HCI_SOCK_TRUSTED, skip_sk);
 309 }
 310
 311 static u8 le_addr_type(u8 mgmt_addr_type)
 312 {
 313         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 314                 return ADDR_LE_DEV_PUBLIC;
 315         else
 316                 return ADDR_LE_DEV_RANDOM;
 317 }
 318
 319 void mgmt_fill_version_info(void *ver)
 320 {
 321         struct mgmt_rp_read_version *rp = ver;
 322
 323         rp->version = MGMT_VERSION;
 324         rp->revision = cpu_to_le16(MGMT_REVISION);
 325 }
 326
 327 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 328                         u16 data_len)
 329 {
 330         struct mgmt_rp_read_version rp;
 331
 332         bt_dev_dbg(hdev, "sock %p", sk);
 333
 334         mgmt_fill_version_info(&rp);
 335
 336         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 337                                  &rp, sizeof(rp));
 338 }
 339
 340 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 341                          u16 data_len)
 342 {
 343         struct mgmt_rp_read_commands *rp;
 344         u16 num_commands, num_events;
 345         size_t rp_size;
 346         int i, err;
 347
 348         bt_dev_dbg(hdev, "sock %p", sk);
 349
 350         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 351                 num_commands = ARRAY_SIZE(mgmt_commands);
 352                 num_events = ARRAY_SIZE(mgmt_events);
 353         } else {
 354                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 355                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 356         }
 357
 358         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 359
 360         rp = kmalloc(rp_size, GFP_KERNEL);
 361         if (!rp)
 362                 return -ENOMEM;
 363
 364         rp->num_commands = cpu_to_le16(num_commands);
 365         rp->num_events = cpu_to_le16(num_events);
 366
 367         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 368                 __le16 *opcode = rp->opcodes;
 369
 370                 for (i = 0; i < num_commands; i++, opcode++)
 371                         put_unaligned_le16(mgmt_commands[i], opcode);
 372
 373                 for (i = 0; i < num_events; i++, opcode++)
 374                         put_unaligned_le16(mgmt_events[i], opcode);
 375         } else {
 376                 __le16 *opcode = rp->opcodes;
 377
 378                 for (i = 0; i < num_commands; i++, opcode++)
 379                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 380
 381                 for (i = 0; i < num_events; i++, opcode++)
 382                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 383         }
 384
 385         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 386                                 rp, rp_size);
 387         kfree(rp);
 388
 389         return err;
 390 }
 391
 392 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 393                            u16 data_len)
 394 {
 395         struct mgmt_rp_read_index_list *rp;
 396         struct hci_dev *d;
 397         size_t rp_len;
 398         u16 count;
 399         int err;
 400
 401         bt_dev_dbg(hdev, "sock %p", sk);
 402
 403         read_lock(&hci_dev_list_lock);
 404
 405         count = 0;
 406         list_for_each_entry(d, &hci_dev_list, list) {
 407                 if (d->dev_type == HCI_PRIMARY &&
 408                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 409                         count++;
 410         }
 411
 412         rp_len = sizeof(*rp) + (2 * count);
 413         rp = kmalloc(rp_len, GFP_ATOMIC);
 414         if (!rp) {
 415                 read_unlock(&hci_dev_list_lock);
 416                 return -ENOMEM;
 417         }
 418
 419         count = 0;
 420         list_for_each_entry(d, &hci_dev_list, list) {
 421                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 422                     hci_dev_test_flag(d, HCI_CONFIG) ||
 423                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 424                         continue;
 425
 426                 /* Devices marked as raw-only are neither configured
 427                  * nor unconfigured controllers.
 428                  */
 429                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 430                         continue;
 431
 432                 if (d->dev_type == HCI_PRIMARY &&
 433                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 434                         rp->index[count++] = cpu_to_le16(d->id);
 435                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 436                 }
 437         }
 438
 439         rp->num_controllers = cpu_to_le16(count);
 440         rp_len = sizeof(*rp) + (2 * count);
 441
 442         read_unlock(&hci_dev_list_lock);
 443
 444         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 445                                 0, rp, rp_len);
 446
 447         kfree(rp);
 448
 449         return err;
 450 }
 451
 452 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 453                                   void *data, u16 data_len)
 454 {
 455         struct mgmt_rp_read_unconf_index_list *rp;
 456         struct hci_dev *d;
 457         size_t rp_len;
 458         u16 count;
 459         int err;
 460
 461         bt_dev_dbg(hdev, "sock %p", sk);
 462
 463         read_lock(&hci_dev_list_lock);
 464
 465         count = 0;
 466         list_for_each_entry(d, &hci_dev_list, list) {
 467                 if (d->dev_type == HCI_PRIMARY &&
 468                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 469                         count++;
 470         }
 471
 472         rp_len = sizeof(*rp) + (2 * count);
 473         rp = kmalloc(rp_len, GFP_ATOMIC);
 474         if (!rp) {
 475                 read_unlock(&hci_dev_list_lock);
 476                 return -ENOMEM;
 477         }
 478
 479         count = 0;
 480         list_for_each_entry(d, &hci_dev_list, list) {
 481                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 482                     hci_dev_test_flag(d, HCI_CONFIG) ||
 483                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 484                         continue;
 485
 486                 /* Devices marked as raw-only are neither configured
 487                  * nor unconfigured controllers.
 488                  */
 489                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 490                         continue;
 491
 492                 if (d->dev_type == HCI_PRIMARY &&
 493                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 494                         rp->index[count++] = cpu_to_le16(d->id);
 495                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 496                 }
 497         }
 498
 499         rp->num_controllers = cpu_to_le16(count);
 500         rp_len = sizeof(*rp) + (2 * count);
 501
 502         read_unlock(&hci_dev_list_lock);
 503
 504         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 505                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 506
 507         kfree(rp);
 508
 509         return err;
 510 }
 511
 512 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 513                                void *data, u16 data_len)
 514 {
 515         struct mgmt_rp_read_ext_index_list *rp;
 516         struct hci_dev *d;
 517         u16 count;
 518         int err;
 519
 520         bt_dev_dbg(hdev, "sock %p", sk);
 521
 522         read_lock(&hci_dev_list_lock);
 523
 524         count = 0;
 525         list_for_each_entry(d, &hci_dev_list, list) {
 526                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 527                         count++;
 528         }
 529
 530         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 531         if (!rp) {
 532                 read_unlock(&hci_dev_list_lock);
 533                 return -ENOMEM;
 534         }
 535
 536         count = 0;
 537         list_for_each_entry(d, &hci_dev_list, list) {
 538                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 539                     hci_dev_test_flag(d, HCI_CONFIG) ||
 540                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 541                         continue;
 542
 543                 /* Devices marked as raw-only are neither configured
 544                  * nor unconfigured controllers.
 545                  */
 546                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 547                         continue;
 548
 549                 if (d->dev_type == HCI_PRIMARY) {
 550                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 551                                 rp->entry[count].type = 0x01;
 552                         else
 553                                 rp->entry[count].type = 0x00;
 554                 } else if (d->dev_type == HCI_AMP) {
 555                         rp->entry[count].type = 0x02;
 556                 } else {
 557                         continue;
 558                 }
 559
 560                 rp->entry[count].bus = d->bus;
 561                 rp->entry[count++].index = cpu_to_le16(d->id);
 562                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 563         }
 564
 565         rp->num_controllers = cpu_to_le16(count);
 566
 567         read_unlock(&hci_dev_list_lock);
 568
 569         /* If this command is called at least once, then all the
 570          * default index and unconfigured index events are disabled
 571          * and from now on only extended index events are used.
 572          */
 573         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 574         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 575         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 576
 577         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 578                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 579                                 struct_size(rp, entry, count));
 580
 581         kfree(rp);
 582
 583         return err;
 584 }
 585
 586 static bool is_configured(struct hci_dev *hdev)
 587 {
 588         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 589             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 590                 return false;
 591
 592         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 593              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 594             !bacmp(&hdev->public_addr, BDADDR_ANY))
 595                 return false;
 596
 597         return true;
 598 }
 599
 600 static __le32 get_missing_options(struct hci_dev *hdev)
 601 {
 602         u32 options = 0;
 603
 604         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 605             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 606                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 607
 608         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 609              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 610             !bacmp(&hdev->public_addr, BDADDR_ANY))
 611                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 612
 613         return cpu_to_le32(options);
 614 }
 615
 616 static int new_options(struct hci_dev *hdev, struct sock *skip)
 617 {
 618         __le32 options = get_missing_options(hdev);
 619
 620         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 621                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 622 }
 623
 624 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 625 {
 626         __le32 options = get_missing_options(hdev);
 627
 628         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 629                                  sizeof(options));
 630 }
 631
 632 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 633                             void *data, u16 data_len)
 634 {
 635         struct mgmt_rp_read_config_info rp;
 636         u32 options = 0;
 637
 638         bt_dev_dbg(hdev, "sock %p", sk);
 639
 640         hci_dev_lock(hdev);
 641
 642         memset(&rp, 0, sizeof(rp));
 643         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 644
 645         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 646                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 647
 648         if (hdev->set_bdaddr)
 649                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 650
 651         rp.supported_options = cpu_to_le32(options);
 652         rp.missing_options = get_missing_options(hdev);
 653
 654         hci_dev_unlock(hdev);
 655
 656         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 657                                  &rp, sizeof(rp));
 658 }
 659
 660 static u32 get_supported_phys(struct hci_dev *hdev)
 661 {
 662         u32 supported_phys = 0;
 663
 664         if (lmp_bredr_capable(hdev)) {
 665                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 666
 667                 if (hdev->features[0][0] & LMP_3SLOT)
 668                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 669
 670                 if (hdev->features[0][0] & LMP_5SLOT)
 671                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 672
 673                 if (lmp_edr_2m_capable(hdev)) {
 674                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 675
 676                         if (lmp_edr_3slot_capable(hdev))
 677                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 678
 679                         if (lmp_edr_5slot_capable(hdev))
 680                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 681
 682                         if (lmp_edr_3m_capable(hdev)) {
 683                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 684
 685                                 if (lmp_edr_3slot_capable(hdev))
 686                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 687
 688                                 if (lmp_edr_5slot_capable(hdev))
 689                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 690                         }
 691                 }
 692         }
 693
 694         if (lmp_le_capable(hdev)) {
 695                 supported_phys |= MGMT_PHY_LE_1M_TX;
 696                 supported_phys |= MGMT_PHY_LE_1M_RX;
 697
 698                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 699                         supported_phys |= MGMT_PHY_LE_2M_TX;
 700                         supported_phys |= MGMT_PHY_LE_2M_RX;
 701                 }
 702
 703                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 704                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 705                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 706                 }
 707         }
 708
 709         return supported_phys;
 710 }
 711
 712 static u32 get_selected_phys(struct hci_dev *hdev)
 713 {
 714         u32 selected_phys = 0;
 715
 716         if (lmp_bredr_capable(hdev)) {
 717                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 718
 719                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 720                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 721
 722                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 723                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 724
 725                 if (lmp_edr_2m_capable(hdev)) {
 726                         if (!(hdev->pkt_type & HCI_2DH1))
 727                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 728
 729                         if (lmp_edr_3slot_capable(hdev) &&
 730                             !(hdev->pkt_type & HCI_2DH3))
 731                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 732
 733                         if (lmp_edr_5slot_capable(hdev) &&
 734                             !(hdev->pkt_type & HCI_2DH5))
 735                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 736
 737                         if (lmp_edr_3m_capable(hdev)) {
 738                                 if (!(hdev->pkt_type & HCI_3DH1))
 739                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 740
 741                                 if (lmp_edr_3slot_capable(hdev) &&
 742                                     !(hdev->pkt_type & HCI_3DH3))
 743                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 744
 745                                 if (lmp_edr_5slot_capable(hdev) &&
 746                                     !(hdev->pkt_type & HCI_3DH5))
 747                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 748                         }
 749                 }
 750         }
 751
 752         if (lmp_le_capable(hdev)) {
 753                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 754                         selected_phys |= MGMT_PHY_LE_1M_TX;
 755
 756                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 757                         selected_phys |= MGMT_PHY_LE_1M_RX;
 758
 759                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 760                         selected_phys |= MGMT_PHY_LE_2M_TX;
 761
 762                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 763                         selected_phys |= MGMT_PHY_LE_2M_RX;
 764
 765                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 766                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 767
 768                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 769                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 770         }
 771
 772         return selected_phys;
 773 }
 774
 775 static u32 get_configurable_phys(struct hci_dev *hdev)
 776 {
 777         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 778                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 779 }
 780
 781 static u32 get_supported_settings(struct hci_dev *hdev)
 782 {
 783         u32 settings = 0;
 784
 785         settings |= MGMT_SETTING_POWERED;
 786         settings |= MGMT_SETTING_BONDABLE;
 787         settings |= MGMT_SETTING_DEBUG_KEYS;
 788         settings |= MGMT_SETTING_CONNECTABLE;
 789         settings |= MGMT_SETTING_DISCOVERABLE;
 790
 791         if (lmp_bredr_capable(hdev)) {
 792                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 793                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 794                 settings |= MGMT_SETTING_BREDR;
 795                 settings |= MGMT_SETTING_LINK_SECURITY;
 796
 797                 if (lmp_ssp_capable(hdev)) {
 798                         settings |= MGMT_SETTING_SSP;
 799                         if (IS_ENABLED(CONFIG_BT_HS))
 800                                 settings |= MGMT_SETTING_HS;
 801                 }
 802
 803                 if (lmp_sc_capable(hdev))
 804                         settings |= MGMT_SETTING_SECURE_CONN;
 805
 806                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 807                              &hdev->quirks))
 808                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 809         }
 810
 811         if (lmp_le_capable(hdev)) {
 812                 settings |= MGMT_SETTING_LE;
 813                 settings |= MGMT_SETTING_SECURE_CONN;
 814                 settings |= MGMT_SETTING_PRIVACY;
 815                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 816
 817                 /* When the experimental feature for LL Privacy support is
 818                  * enabled, then advertising is no longer supported.
 819                  */
 820                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 821                         settings |= MGMT_SETTING_ADVERTISING;
 822         }
 823
 824         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 825             hdev->set_bdaddr)
 826                 settings |= MGMT_SETTING_CONFIGURATION;
 827
 828         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 829
 830         return settings;
 831 }
 832
 833 static u32 get_current_settings(struct hci_dev *hdev)
 834 {
 835         u32 settings = 0;
 836
 837         if (hdev_is_powered(hdev))
 838                 settings |= MGMT_SETTING_POWERED;
 839
 840         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 841                 settings |= MGMT_SETTING_CONNECTABLE;
 842
 843         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 844                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 845
 846         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 847                 settings |= MGMT_SETTING_DISCOVERABLE;
 848
 849         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 850                 settings |= MGMT_SETTING_BONDABLE;
 851
 852         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 853                 settings |= MGMT_SETTING_BREDR;
 854
 855         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 856                 settings |= MGMT_SETTING_LE;
 857
 858         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 859                 settings |= MGMT_SETTING_LINK_SECURITY;
 860
 861         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 862                 settings |= MGMT_SETTING_SSP;
 863
 864         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 865                 settings |= MGMT_SETTING_HS;
 866
 867         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 868                 settings |= MGMT_SETTING_ADVERTISING;
 869
 870         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 871                 settings |= MGMT_SETTING_SECURE_CONN;
 872
 873         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 874                 settings |= MGMT_SETTING_DEBUG_KEYS;
 875
 876         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 877                 settings |= MGMT_SETTING_PRIVACY;
 878
 879         /* The current setting for static address has two purposes. The
 880          * first is to indicate if the static address will be used and
 881          * the second is to indicate if it is actually set.
 882          *
 883          * This means if the static address is not configured, this flag
 884          * will never be set. If the address is configured, then if the
 885          * address is actually used decides if the flag is set or not.
 886          *
 887          * For single mode LE only controllers and dual-mode controllers
 888          * with BR/EDR disabled, the existence of the static address will
 889          * be evaluated.
 890          */
 891         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 892             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 893             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 894                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 895                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 896         }
 897
 898         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 899                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 900
 901         return settings;
 902 }
 903
 904 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 905 {
 906         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 907 }
 908
 909 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 910                                                   struct hci_dev *hdev,
 911                                                   const void *data)
 912 {
 913         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 914 }
 915
 916 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 917 {
 918         struct mgmt_pending_cmd *cmd;
 919
 920         /* If there's a pending mgmt command the flags will not yet have
 921          * their final values, so check for this first.
 922          */
 923         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 924         if (cmd) {
 925                 struct mgmt_mode *cp = cmd->param;
 926                 if (cp->val == 0x01)
 927                         return LE_AD_GENERAL;
 928                 else if (cp->val == 0x02)
 929                         return LE_AD_LIMITED;
 930         } else {
 931                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 932                         return LE_AD_LIMITED;
 933                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 934                         return LE_AD_GENERAL;
 935         }
 936
 937         return 0;
 938 }
 939
 940 bool mgmt_get_connectable(struct hci_dev *hdev)
 941 {
 942         struct mgmt_pending_cmd *cmd;
 943
 944         /* If there's a pending mgmt command the flag will not yet have
 945          * it's final value, so check for this first.
 946          */
 947         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 948         if (cmd) {
 949                 struct mgmt_mode *cp = cmd->param;
 950
 951                 return cp->val;
 952         }
 953
 954         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 955 }
 956
 957 static void service_cache_off(struct work_struct *work)
 958 {
 959         struct hci_dev *hdev = container_of(work, struct hci_dev,
 960                                             service_cache.work);
 961         struct hci_request req;
 962
 963         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 964                 return;
 965
 966         hci_req_init(&req, hdev);
 967
 968         hci_dev_lock(hdev);
 969
 970         __hci_req_update_eir(&req);
 971         __hci_req_update_class(&req);
 972
 973         hci_dev_unlock(hdev);
 974
 975         hci_req_run(&req, NULL);
 976 }
 977
 978 static void rpa_expired(struct work_struct *work)
 979 {
 980         struct hci_dev *hdev = container_of(work, struct hci_dev,
 981                                             rpa_expired.work);
 982         struct hci_request req;
 983
 984         bt_dev_dbg(hdev, "");
 985
 986         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 987
 988         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 989                 return;
 990
 991         /* The generation of a new RPA and programming it into the
 992          * controller happens in the hci_req_enable_advertising()
 993          * function.
 994          */
 995         hci_req_init(&req, hdev);
 996         if (ext_adv_capable(hdev))
 997                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 998         else
 999                 __hci_req_enable_advertising(&req);
1000         hci_req_run(&req, NULL);
1001 }
1002
1003 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1004 {
1005         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1006                 return;
1007
1008         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1009         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1010
1011         /* Non-mgmt controlled devices get this bit set
1012          * implicitly so that pairing works for them, however
1013          * for mgmt we require user-space to explicitly enable
1014          * it
1015          */
1016         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1017 }
1018
1019 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1020                                 void *data, u16 data_len)
1021 {
1022         struct mgmt_rp_read_info rp;
1023
1024         bt_dev_dbg(hdev, "sock %p", sk);
1025
1026         hci_dev_lock(hdev);
1027
1028         memset(&rp, 0, sizeof(rp));
1029
1030         bacpy(&rp.bdaddr, &hdev->bdaddr);
1031
1032         rp.version = hdev->hci_ver;
1033         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1034
1035         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1036         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1037
1038         memcpy(rp.dev_class, hdev->dev_class, 3);
1039
1040         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1041         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1042
1043         hci_dev_unlock(hdev);
1044
1045         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1046                                  sizeof(rp));
1047 }
1048
1049 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1050 {
1051         u16 eir_len = 0;
1052         size_t name_len;
1053
1054         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1055                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1056                                           hdev->dev_class, 3);
1057
1058         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1059                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1060                                           hdev->appearance);
1061
1062         name_len = strlen(hdev->dev_name);
1063         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1064                                   hdev->dev_name, name_len);
1065
1066         name_len = strlen(hdev->short_name);
1067         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1068                                   hdev->short_name, name_len);
1069
1070         return eir_len;
1071 }
1072
1073 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1074                                     void *data, u16 data_len)
1075 {
1076         char buf[512];
1077         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1078         u16 eir_len;
1079
1080         bt_dev_dbg(hdev, "sock %p", sk);
1081
1082         memset(&buf, 0, sizeof(buf));
1083
1084         hci_dev_lock(hdev);
1085
1086         bacpy(&rp->bdaddr, &hdev->bdaddr);
1087
1088         rp->version = hdev->hci_ver;
1089         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1090
1091         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1092         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1093
1094
1095         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1096         rp->eir_len = cpu_to_le16(eir_len);
1097
1098         hci_dev_unlock(hdev);
1099
1100         /* If this command is called at least once, then the events
1101          * for class of device and local name changes are disabled
1102          * and only the new extended controller information event
1103          * is used.
1104          */
1105         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1106         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1107         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1108
1109         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1110                                  sizeof(*rp) + eir_len);
1111 }
1112
1113 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1114 {
1115         char buf[512];
1116         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1117         u16 eir_len;
1118
1119         memset(buf, 0, sizeof(buf));
1120
1121         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1122         ev->eir_len = cpu_to_le16(eir_len);
1123
1124         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1125                                   sizeof(*ev) + eir_len,
1126                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1127 }
1128
1129 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1130 {
1131         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1132
1133         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1134                                  sizeof(settings));
1135 }
1136
1137 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1138 {
1139         bt_dev_dbg(hdev, "status 0x%02x", status);
1140
1141         if (hci_conn_count(hdev) == 0) {
1142                 cancel_delayed_work(&hdev->power_off);
1143                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1144         }
1145 }
1146
1147 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1148 {
1149         struct mgmt_ev_advertising_added ev;
1150
1151         ev.instance = instance;
1152
1153         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1154 }
1155
1156 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1157                               u8 instance)
1158 {
1159         struct mgmt_ev_advertising_removed ev;
1160
1161         ev.instance = instance;
1162
1163         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1164 }
1165
1166 static void cancel_adv_timeout(struct hci_dev *hdev)
1167 {
1168         if (hdev->adv_instance_timeout) {
1169                 hdev->adv_instance_timeout = 0;
1170                 cancel_delayed_work(&hdev->adv_instance_expire);
1171         }
1172 }
1173
1174 static int clean_up_hci_state(struct hci_dev *hdev)
1175 {
1176         struct hci_request req;
1177         struct hci_conn *conn;
1178         bool discov_stopped;
1179         int err;
1180
1181         hci_req_init(&req, hdev);
1182
1183         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1184             test_bit(HCI_PSCAN, &hdev->flags)) {
1185                 u8 scan = 0x00;
1186                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1187         }
1188
1189         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1190
1191         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1192                 __hci_req_disable_advertising(&req);
1193
1194         discov_stopped = hci_req_stop_discovery(&req);
1195
1196         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1197                 /* 0x15 == Terminated due to Power Off */
1198                 __hci_abort_conn(&req, conn, 0x15);
1199         }
1200
1201         err = hci_req_run(&req, clean_up_hci_complete);
1202         if (!err && discov_stopped)
1203                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1204
1205         return err;
1206 }
1207
1208 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1209                        u16 len)
1210 {
1211         struct mgmt_mode *cp = data;
1212         struct mgmt_pending_cmd *cmd;
1213         int err;
1214
1215         bt_dev_dbg(hdev, "sock %p", sk);
1216
1217         if (cp->val != 0x00 && cp->val != 0x01)
1218                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1219                                        MGMT_STATUS_INVALID_PARAMS);
1220
1221         hci_dev_lock(hdev);
1222
1223         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1224                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1225                                       MGMT_STATUS_BUSY);
1226                 goto failed;
1227         }
1228
1229         if (!!cp->val == hdev_is_powered(hdev)) {
1230                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1231                 goto failed;
1232         }
1233
1234         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1235         if (!cmd) {
1236                 err = -ENOMEM;
1237                 goto failed;
1238         }
1239
1240         if (cp->val) {
1241                 queue_work(hdev->req_workqueue, &hdev->power_on);
1242                 err = 0;
1243         } else {
1244                 /* Disconnect connections, stop scans, etc */
1245                 err = clean_up_hci_state(hdev);
1246                 if (!err)
1247                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1248                                            HCI_POWER_OFF_TIMEOUT);
1249
1250                 /* ENODATA means there were no HCI commands queued */
1251                 if (err == -ENODATA) {
1252                         cancel_delayed_work(&hdev->power_off);
1253                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1254                         err = 0;
1255                 }
1256         }
1257
1258 failed:
1259         hci_dev_unlock(hdev);
1260         return err;
1261 }
1262
1263 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1264 {
1265         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1266
1267         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1268                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1269 }
1270
1271 int mgmt_new_settings(struct hci_dev *hdev)
1272 {
1273         return new_settings(hdev, NULL);
1274 }
1275
1276 struct cmd_lookup {
1277         struct sock *sk;
1278         struct hci_dev *hdev;
1279         u8 mgmt_status;
1280 };
1281
1282 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1283 {
1284         struct cmd_lookup *match = data;
1285
1286         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1287
1288         list_del(&cmd->list);
1289
1290         if (match->sk == NULL) {
1291                 match->sk = cmd->sk;
1292                 sock_hold(match->sk);
1293         }
1294
1295         mgmt_pending_free(cmd);
1296 }
1297
1298 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1299 {
1300         u8 *status = data;
1301
1302         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1303         mgmt_pending_remove(cmd);
1304 }
1305
1306 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1307 {
1308         if (cmd->cmd_complete) {
1309                 u8 *status = data;
1310
1311                 cmd->cmd_complete(cmd, *status);
1312                 mgmt_pending_remove(cmd);
1313
1314                 return;
1315         }
1316
1317         cmd_status_rsp(cmd, data);
1318 }
1319
1320 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1321 {
1322         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1323                                  cmd->param, cmd->param_len);
1324 }
1325
1326 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1327 {
1328         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1329                                  cmd->param, sizeof(struct mgmt_addr_info));
1330 }
1331
1332 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1333 {
1334         if (!lmp_bredr_capable(hdev))
1335                 return MGMT_STATUS_NOT_SUPPORTED;
1336         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1337                 return MGMT_STATUS_REJECTED;
1338         else
1339                 return MGMT_STATUS_SUCCESS;
1340 }
1341
1342 static u8 mgmt_le_support(struct hci_dev *hdev)
1343 {
1344         if (!lmp_le_capable(hdev))
1345                 return MGMT_STATUS_NOT_SUPPORTED;
1346         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1347                 return MGMT_STATUS_REJECTED;
1348         else
1349                 return MGMT_STATUS_SUCCESS;
1350 }
1351
1352 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1353 {
1354         struct mgmt_pending_cmd *cmd;
1355
1356         bt_dev_dbg(hdev, "status 0x%02x", status);
1357
1358         hci_dev_lock(hdev);
1359
1360         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1361         if (!cmd)
1362                 goto unlock;
1363
1364         if (status) {
1365                 u8 mgmt_err = mgmt_status(status);
1366                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1367                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1368                 goto remove_cmd;
1369         }
1370
1371         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1372             hdev->discov_timeout > 0) {
1373                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1374                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1375         }
1376
1377         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1378         new_settings(hdev, cmd->sk);
1379
1380 remove_cmd:
1381         mgmt_pending_remove(cmd);
1382
1383 unlock:
1384         hci_dev_unlock(hdev);
1385 }
1386
1387 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1388                             u16 len)
1389 {
1390         struct mgmt_cp_set_discoverable *cp = data;
1391         struct mgmt_pending_cmd *cmd;
1392         u16 timeout;
1393         int err;
1394
1395         bt_dev_dbg(hdev, "sock %p", sk);
1396
1397         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1398             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1400                                        MGMT_STATUS_REJECTED);
1401
1402         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1403                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1404                                        MGMT_STATUS_INVALID_PARAMS);
1405
1406         timeout = __le16_to_cpu(cp->timeout);
1407
1408         /* Disabling discoverable requires that no timeout is set,
1409          * and enabling limited discoverable requires a timeout.
1410          */
1411         if ((cp->val == 0x00 && timeout > 0) ||
1412             (cp->val == 0x02 && timeout == 0))
1413                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1414                                        MGMT_STATUS_INVALID_PARAMS);
1415
1416         hci_dev_lock(hdev);
1417
1418         if (!hdev_is_powered(hdev) && timeout > 0) {
1419                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1420                                       MGMT_STATUS_NOT_POWERED);
1421                 goto failed;
1422         }
1423
1424         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1425             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1426                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1427                                       MGMT_STATUS_BUSY);
1428                 goto failed;
1429         }
1430
1431         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1432                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1433                                       MGMT_STATUS_REJECTED);
1434                 goto failed;
1435         }
1436
1437         if (hdev->advertising_paused) {
1438                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1439                                       MGMT_STATUS_BUSY);
1440                 goto failed;
1441         }
1442
1443         if (!hdev_is_powered(hdev)) {
1444                 bool changed = false;
1445
1446                 /* Setting limited discoverable when powered off is
1447                  * not a valid operation since it requires a timeout
1448                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1449                  */
1450                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1451                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1452                         changed = true;
1453                 }
1454
1455                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1456                 if (err < 0)
1457                         goto failed;
1458
1459                 if (changed)
1460                         err = new_settings(hdev, sk);
1461
1462                 goto failed;
1463         }
1464
1465         /* If the current mode is the same, then just update the timeout
1466          * value with the new value. And if only the timeout gets updated,
1467          * then no need for any HCI transactions.
1468          */
1469         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1470             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1471                                                    HCI_LIMITED_DISCOVERABLE)) {
1472                 cancel_delayed_work(&hdev->discov_off);
1473                 hdev->discov_timeout = timeout;
1474
1475                 if (cp->val && hdev->discov_timeout > 0) {
1476                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1477                         queue_delayed_work(hdev->req_workqueue,
1478                                            &hdev->discov_off, to);
1479                 }
1480
1481                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1482                 goto failed;
1483         }
1484
1485         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1486         if (!cmd) {
1487                 err = -ENOMEM;
1488                 goto failed;
1489         }
1490
1491         /* Cancel any potential discoverable timeout that might be
1492          * still active and store new timeout value. The arming of
1493          * the timeout happens in the complete handler.
1494          */
1495         cancel_delayed_work(&hdev->discov_off);
1496         hdev->discov_timeout = timeout;
1497
1498         if (cp->val)
1499                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1500         else
1501                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1502
1503         /* Limited discoverable mode */
1504         if (cp->val == 0x02)
1505                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1506         else
1507                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1508
1509         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1510         err = 0;
1511
1512 failed:
1513         hci_dev_unlock(hdev);
1514         return err;
1515 }
1516
1517 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1518 {
1519         struct mgmt_pending_cmd *cmd;
1520
1521         bt_dev_dbg(hdev, "status 0x%02x", status);
1522
1523         hci_dev_lock(hdev);
1524
1525         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1526         if (!cmd)
1527                 goto unlock;
1528
1529         if (status) {
1530                 u8 mgmt_err = mgmt_status(status);
1531                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1532                 goto remove_cmd;
1533         }
1534
1535         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1536         new_settings(hdev, cmd->sk);
1537
1538 remove_cmd:
1539         mgmt_pending_remove(cmd);
1540
1541 unlock:
1542         hci_dev_unlock(hdev);
1543 }
1544
1545 static int set_connectable_update_settings(struct hci_dev *hdev,
1546                                            struct sock *sk, u8 val)
1547 {
1548         bool changed = false;
1549         int err;
1550
1551         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1552                 changed = true;
1553
1554         if (val) {
1555                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1556         } else {
1557                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1558                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1559         }
1560
1561         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1562         if (err < 0)
1563                 return err;
1564
1565         if (changed) {
1566                 hci_req_update_scan(hdev);
1567                 hci_update_background_scan(hdev);
1568                 return new_settings(hdev, sk);
1569         }
1570
1571         return 0;
1572 }
1573
1574 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1575                            u16 len)
1576 {
1577         struct mgmt_mode *cp = data;
1578         struct mgmt_pending_cmd *cmd;
1579         int err;
1580
1581         bt_dev_dbg(hdev, "sock %p", sk);
1582
1583         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1584             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1585                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1586                                        MGMT_STATUS_REJECTED);
1587
1588         if (cp->val != 0x00 && cp->val != 0x01)
1589                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1590                                        MGMT_STATUS_INVALID_PARAMS);
1591
1592         hci_dev_lock(hdev);
1593
1594         if (!hdev_is_powered(hdev)) {
1595                 err = set_connectable_update_settings(hdev, sk, cp->val);
1596                 goto failed;
1597         }
1598
1599         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1600             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1601                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1602                                       MGMT_STATUS_BUSY);
1603                 goto failed;
1604         }
1605
1606         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1607         if (!cmd) {
1608                 err = -ENOMEM;
1609                 goto failed;
1610         }
1611
1612         if (cp->val) {
1613                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1614         } else {
1615                 if (hdev->discov_timeout > 0)
1616                         cancel_delayed_work(&hdev->discov_off);
1617
1618                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1619                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1620                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1621         }
1622
1623         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1624         err = 0;
1625
1626 failed:
1627         hci_dev_unlock(hdev);
1628         return err;
1629 }
1630
1631 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1632                         u16 len)
1633 {
1634         struct mgmt_mode *cp = data;
1635         bool changed;
1636         int err;
1637
1638         bt_dev_dbg(hdev, "sock %p", sk);
1639
1640         if (cp->val != 0x00 && cp->val != 0x01)
1641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1642                                        MGMT_STATUS_INVALID_PARAMS);
1643
1644         hci_dev_lock(hdev);
1645
1646         if (cp->val)
1647                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1648         else
1649                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1650
1651         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1652         if (err < 0)
1653                 goto unlock;
1654
1655         if (changed) {
1656                 /* In limited privacy mode the change of bondable mode
1657                  * may affect the local advertising address.
1658                  */
1659                 if (hdev_is_powered(hdev) &&
1660                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1661                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1662                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1663                         queue_work(hdev->req_workqueue,
1664                                    &hdev->discoverable_update);
1665
1666                 err = new_settings(hdev, sk);
1667         }
1668
1669 unlock:
1670         hci_dev_unlock(hdev);
1671         return err;
1672 }
1673
1674 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1675                              u16 len)
1676 {
1677         struct mgmt_mode *cp = data;
1678         struct mgmt_pending_cmd *cmd;
1679         u8 val, status;
1680         int err;
1681
1682         bt_dev_dbg(hdev, "sock %p", sk);
1683
1684         status = mgmt_bredr_support(hdev);
1685         if (status)
1686                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1687                                        status);
1688
1689         if (cp->val != 0x00 && cp->val != 0x01)
1690                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1691                                        MGMT_STATUS_INVALID_PARAMS);
1692
1693         hci_dev_lock(hdev);
1694
1695         if (!hdev_is_powered(hdev)) {
1696                 bool changed = false;
1697
1698                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1699                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1700                         changed = true;
1701                 }
1702
1703                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1704                 if (err < 0)
1705                         goto failed;
1706
1707                 if (changed)
1708                         err = new_settings(hdev, sk);
1709
1710                 goto failed;
1711         }
1712
1713         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1714                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1715                                       MGMT_STATUS_BUSY);
1716                 goto failed;
1717         }
1718
1719         val = !!cp->val;
1720
1721         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1722                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1723                 goto failed;
1724         }
1725
1726         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1727         if (!cmd) {
1728                 err = -ENOMEM;
1729                 goto failed;
1730         }
1731
1732         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1733         if (err < 0) {
1734                 mgmt_pending_remove(cmd);
1735                 goto failed;
1736         }
1737
1738 failed:
1739         hci_dev_unlock(hdev);
1740         return err;
1741 }
1742
1743 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1744 {
1745         struct mgmt_mode *cp = data;
1746         struct mgmt_pending_cmd *cmd;
1747         u8 status;
1748         int err;
1749
1750         bt_dev_dbg(hdev, "sock %p", sk);
1751
1752         status = mgmt_bredr_support(hdev);
1753         if (status)
1754                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1755
1756         if (!lmp_ssp_capable(hdev))
1757                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1758                                        MGMT_STATUS_NOT_SUPPORTED);
1759
1760         if (cp->val != 0x00 && cp->val != 0x01)
1761                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1762                                        MGMT_STATUS_INVALID_PARAMS);
1763
1764         hci_dev_lock(hdev);
1765
1766         if (!hdev_is_powered(hdev)) {
1767                 bool changed;
1768
1769                 if (cp->val) {
1770                         changed = !hci_dev_test_and_set_flag(hdev,
1771                                                              HCI_SSP_ENABLED);
1772                 } else {
1773                         changed = hci_dev_test_and_clear_flag(hdev,
1774                                                               HCI_SSP_ENABLED);
1775                         if (!changed)
1776                                 changed = hci_dev_test_and_clear_flag(hdev,
1777                                                                       HCI_HS_ENABLED);
1778                         else
1779                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1780                 }
1781
1782                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1783                 if (err < 0)
1784                         goto failed;
1785
1786                 if (changed)
1787                         err = new_settings(hdev, sk);
1788
1789                 goto failed;
1790         }
1791
1792         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1793                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1794                                       MGMT_STATUS_BUSY);
1795                 goto failed;
1796         }
1797
1798         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1799                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1800                 goto failed;
1801         }
1802
1803         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1804         if (!cmd) {
1805                 err = -ENOMEM;
1806                 goto failed;
1807         }
1808
1809         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1810                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1811                              sizeof(cp->val), &cp->val);
1812
1813         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1814         if (err < 0) {
1815                 mgmt_pending_remove(cmd);
1816                 goto failed;
1817         }
1818
1819 failed:
1820         hci_dev_unlock(hdev);
1821         return err;
1822 }
1823
1824 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1825 {
1826         struct mgmt_mode *cp = data;
1827         bool changed;
1828         u8 status;
1829         int err;
1830
1831         bt_dev_dbg(hdev, "sock %p", sk);
1832
1833         if (!IS_ENABLED(CONFIG_BT_HS))
1834                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1835                                        MGMT_STATUS_NOT_SUPPORTED);
1836
1837         status = mgmt_bredr_support(hdev);
1838         if (status)
1839                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1840
1841         if (!lmp_ssp_capable(hdev))
1842                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1843                                        MGMT_STATUS_NOT_SUPPORTED);
1844
1845         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1846                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1847                                        MGMT_STATUS_REJECTED);
1848
1849         if (cp->val != 0x00 && cp->val != 0x01)
1850                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1851                                        MGMT_STATUS_INVALID_PARAMS);
1852
1853         hci_dev_lock(hdev);
1854
1855         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1856                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1857                                       MGMT_STATUS_BUSY);
1858                 goto unlock;
1859         }
1860
1861         if (cp->val) {
1862                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1863         } else {
1864                 if (hdev_is_powered(hdev)) {
1865                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1866                                               MGMT_STATUS_REJECTED);
1867                         goto unlock;
1868                 }
1869
1870                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1871         }
1872
1873         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1874         if (err < 0)
1875                 goto unlock;
1876
1877         if (changed)
1878                 err = new_settings(hdev, sk);
1879
1880 unlock:
1881         hci_dev_unlock(hdev);
1882         return err;
1883 }
1884
1885 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1886 {
1887         struct cmd_lookup match = { NULL, hdev };
1888
1889         hci_dev_lock(hdev);
1890
1891         if (status) {
1892                 u8 mgmt_err = mgmt_status(status);
1893
1894                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1895                                      &mgmt_err);
1896                 goto unlock;
1897         }
1898
1899         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1900
1901         new_settings(hdev, match.sk);
1902
1903         if (match.sk)
1904                 sock_put(match.sk);
1905
1906         /* Make sure the controller has a good default for
1907          * advertising data. Restrict the update to when LE
1908          * has actually been enabled. During power on, the
1909          * update in powered_update_hci will take care of it.
1910          */
1911         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1912                 struct hci_request req;
1913                 hci_req_init(&req, hdev);
1914                 if (ext_adv_capable(hdev)) {
1915                         int err;
1916
1917                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1918                         if (!err)
1919                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1920                 } else {
1921                         __hci_req_update_adv_data(&req, 0x00);
1922                         __hci_req_update_scan_rsp_data(&req, 0x00);
1923                 }
1924                 hci_req_run(&req, NULL);
1925                 hci_update_background_scan(hdev);
1926         }
1927
1928 unlock:
1929         hci_dev_unlock(hdev);
1930 }
1931
1932 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1933 {
1934         struct mgmt_mode *cp = data;
1935         struct hci_cp_write_le_host_supported hci_cp;
1936         struct mgmt_pending_cmd *cmd;
1937         struct hci_request req;
1938         int err;
1939         u8 val, enabled;
1940
1941         bt_dev_dbg(hdev, "sock %p", sk);
1942
1943         if (!lmp_le_capable(hdev))
1944                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1945                                        MGMT_STATUS_NOT_SUPPORTED);
1946
1947         if (cp->val != 0x00 && cp->val != 0x01)
1948                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1949                                        MGMT_STATUS_INVALID_PARAMS);
1950
1951         /* Bluetooth single mode LE only controllers or dual-mode
1952          * controllers configured as LE only devices, do not allow
1953          * switching LE off. These have either LE enabled explicitly
1954          * or BR/EDR has been previously switched off.
1955          *
1956          * When trying to enable an already enabled LE, then gracefully
1957          * send a positive response. Trying to disable it however will
1958          * result into rejection.
1959          */
1960         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1961                 if (cp->val == 0x01)
1962                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1963
1964                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1965                                        MGMT_STATUS_REJECTED);
1966         }
1967
1968         hci_dev_lock(hdev);
1969
1970         val = !!cp->val;
1971         enabled = lmp_host_le_capable(hdev);
1972
1973         if (!val)
1974                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1975
1976         if (!hdev_is_powered(hdev) || val == enabled) {
1977                 bool changed = false;
1978
1979                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1980                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1981                         changed = true;
1982                 }
1983
1984                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1985                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1986                         changed = true;
1987                 }
1988
1989                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1990                 if (err < 0)
1991                         goto unlock;
1992
1993                 if (changed)
1994                         err = new_settings(hdev, sk);
1995
1996                 goto unlock;
1997         }
1998
1999         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2000             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2001                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2002                                       MGMT_STATUS_BUSY);
2003                 goto unlock;
2004         }
2005
2006         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2007         if (!cmd) {
2008                 err = -ENOMEM;
2009                 goto unlock;
2010         }
2011
2012         hci_req_init(&req, hdev);
2013
2014         memset(&hci_cp, 0, sizeof(hci_cp));
2015
2016         if (val) {
2017                 hci_cp.le = val;
2018                 hci_cp.simul = 0x00;
2019         } else {
2020                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2021                         __hci_req_disable_advertising(&req);
2022
2023                 if (ext_adv_capable(hdev))
2024                         __hci_req_clear_ext_adv_sets(&req);
2025         }
2026
2027         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2028                     &hci_cp);
2029
2030         err = hci_req_run(&req, le_enable_complete);
2031         if (err < 0)
2032                 mgmt_pending_remove(cmd);
2033
2034 unlock:
2035         hci_dev_unlock(hdev);
2036         return err;
2037 }
2038
2039 /* This is a helper function to test for pending mgmt commands that can
2040  * cause CoD or EIR HCI commands. We can only allow one such pending
2041  * mgmt command at a time since otherwise we cannot easily track what
2042  * the current values are, will be, and based on that calculate if a new
2043  * HCI command needs to be sent and if yes with what value.
2044  */
2045 static bool pending_eir_or_class(struct hci_dev *hdev)
2046 {
2047         struct mgmt_pending_cmd *cmd;
2048
2049         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2050                 switch (cmd->opcode) {
2051                 case MGMT_OP_ADD_UUID:
2052                 case MGMT_OP_REMOVE_UUID:
2053                 case MGMT_OP_SET_DEV_CLASS:
2054                 case MGMT_OP_SET_POWERED:
2055                         return true;
2056                 }
2057         }
2058
2059         return false;
2060 }
2061
2062 static const u8 bluetooth_base_uuid[] = {
2063                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2064                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2065 };
2066
2067 static u8 get_uuid_size(const u8 *uuid)
2068 {
2069         u32 val;
2070
2071         if (memcmp(uuid, bluetooth_base_uuid, 12))
2072                 return 128;
2073
2074         val = get_unaligned_le32(&uuid[12]);
2075         if (val > 0xffff)
2076                 return 32;
2077
2078         return 16;
2079 }
2080
2081 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2082 {
2083         struct mgmt_pending_cmd *cmd;
2084
2085         hci_dev_lock(hdev);
2086
2087         cmd = pending_find(mgmt_op, hdev);
2088         if (!cmd)
2089                 goto unlock;
2090
2091         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2092                           mgmt_status(status), hdev->dev_class, 3);
2093
2094         mgmt_pending_remove(cmd);
2095
2096 unlock:
2097         hci_dev_unlock(hdev);
2098 }
2099
2100 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2101 {
2102         bt_dev_dbg(hdev, "status 0x%02x", status);
2103
2104         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2105 }
2106
2107 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2108 {
2109         struct mgmt_cp_add_uuid *cp = data;
2110         struct mgmt_pending_cmd *cmd;
2111         struct hci_request req;
2112         struct bt_uuid *uuid;
2113         int err;
2114
2115         bt_dev_dbg(hdev, "sock %p", sk);
2116
2117         hci_dev_lock(hdev);
2118
2119         if (pending_eir_or_class(hdev)) {
2120                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2121                                       MGMT_STATUS_BUSY);
2122                 goto failed;
2123         }
2124
2125         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2126         if (!uuid) {
2127                 err = -ENOMEM;
2128                 goto failed;
2129         }
2130
2131         memcpy(uuid->uuid, cp->uuid, 16);
2132         uuid->svc_hint = cp->svc_hint;
2133         uuid->size = get_uuid_size(cp->uuid);
2134
2135         list_add_tail(&uuid->list, &hdev->uuids);
2136
2137         hci_req_init(&req, hdev);
2138
2139         __hci_req_update_class(&req);
2140         __hci_req_update_eir(&req);
2141
2142         err = hci_req_run(&req, add_uuid_complete);
2143         if (err < 0) {
2144                 if (err != -ENODATA)
2145                         goto failed;
2146
2147                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2148                                         hdev->dev_class, 3);
2149                 goto failed;
2150         }
2151
2152         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2153         if (!cmd) {
2154                 err = -ENOMEM;
2155                 goto failed;
2156         }
2157
2158         err = 0;
2159
2160 failed:
2161         hci_dev_unlock(hdev);
2162         return err;
2163 }
2164
2165 static bool enable_service_cache(struct hci_dev *hdev)
2166 {
2167         if (!hdev_is_powered(hdev))
2168                 return false;
2169
2170         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2171                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2172                                    CACHE_TIMEOUT);
2173                 return true;
2174         }
2175
2176         return false;
2177 }
2178
2179 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2180 {
2181         bt_dev_dbg(hdev, "status 0x%02x", status);
2182
2183         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2184 }
2185
2186 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2187                        u16 len)
2188 {
2189         struct mgmt_cp_remove_uuid *cp = data;
2190         struct mgmt_pending_cmd *cmd;
2191         struct bt_uuid *match, *tmp;
2192         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2193         struct hci_request req;
2194         int err, found;
2195
2196         bt_dev_dbg(hdev, "sock %p", sk);
2197
2198         hci_dev_lock(hdev);
2199
2200         if (pending_eir_or_class(hdev)) {
2201                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2202                                       MGMT_STATUS_BUSY);
2203                 goto unlock;
2204         }
2205
2206         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2207                 hci_uuids_clear(hdev);
2208
2209                 if (enable_service_cache(hdev)) {
2210                         err = mgmt_cmd_complete(sk, hdev->id,
2211                                                 MGMT_OP_REMOVE_UUID,
2212                                                 0, hdev->dev_class, 3);
2213                         goto unlock;
2214                 }
2215
2216                 goto update_class;
2217         }
2218
2219         found = 0;
2220
2221         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2222                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2223                         continue;
2224
2225                 list_del(&match->list);
2226                 kfree(match);
2227                 found++;
2228         }
2229
2230         if (found == 0) {
2231                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2232                                       MGMT_STATUS_INVALID_PARAMS);
2233                 goto unlock;
2234         }
2235
2236 update_class:
2237         hci_req_init(&req, hdev);
2238
2239         __hci_req_update_class(&req);
2240         __hci_req_update_eir(&req);
2241
2242         err = hci_req_run(&req, remove_uuid_complete);
2243         if (err < 0) {
2244                 if (err != -ENODATA)
2245                         goto unlock;
2246
2247                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2248                                         hdev->dev_class, 3);
2249                 goto unlock;
2250         }
2251
2252         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2253         if (!cmd) {
2254                 err = -ENOMEM;
2255                 goto unlock;
2256         }
2257
2258         err = 0;
2259
2260 unlock:
2261         hci_dev_unlock(hdev);
2262         return err;
2263 }
2264
2265 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2266 {
2267         bt_dev_dbg(hdev, "status 0x%02x", status);
2268
2269         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2270 }
2271
2272 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2273                          u16 len)
2274 {
2275         struct mgmt_cp_set_dev_class *cp = data;
2276         struct mgmt_pending_cmd *cmd;
2277         struct hci_request req;
2278         int err;
2279
2280         bt_dev_dbg(hdev, "sock %p", sk);
2281
2282         if (!lmp_bredr_capable(hdev))
2283                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2284                                        MGMT_STATUS_NOT_SUPPORTED);
2285
2286         hci_dev_lock(hdev);
2287
2288         if (pending_eir_or_class(hdev)) {
2289                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2290                                       MGMT_STATUS_BUSY);
2291                 goto unlock;
2292         }
2293
2294         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2295                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2296                                       MGMT_STATUS_INVALID_PARAMS);
2297                 goto unlock;
2298         }
2299
2300         hdev->major_class = cp->major;
2301         hdev->minor_class = cp->minor;
2302
2303         if (!hdev_is_powered(hdev)) {
2304                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2305                                         hdev->dev_class, 3);
2306                 goto unlock;
2307         }
2308
2309         hci_req_init(&req, hdev);
2310
2311         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2312                 hci_dev_unlock(hdev);
2313                 cancel_delayed_work_sync(&hdev->service_cache);
2314                 hci_dev_lock(hdev);
2315                 __hci_req_update_eir(&req);
2316         }
2317
2318         __hci_req_update_class(&req);
2319
2320         err = hci_req_run(&req, set_class_complete);
2321         if (err < 0) {
2322                 if (err != -ENODATA)
2323                         goto unlock;
2324
2325                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2326                                         hdev->dev_class, 3);
2327                 goto unlock;
2328         }
2329
2330         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2331         if (!cmd) {
2332                 err = -ENOMEM;
2333                 goto unlock;
2334         }
2335
2336         err = 0;
2337
2338 unlock:
2339         hci_dev_unlock(hdev);
2340         return err;
2341 }
2342
2343 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2344                           u16 len)
2345 {
2346         struct mgmt_cp_load_link_keys *cp = data;
2347         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2348                                    sizeof(struct mgmt_link_key_info));
2349         u16 key_count, expected_len;
2350         bool changed;
2351         int i;
2352
2353         bt_dev_dbg(hdev, "sock %p", sk);
2354
2355         if (!lmp_bredr_capable(hdev))
2356                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2357                                        MGMT_STATUS_NOT_SUPPORTED);
2358
2359         key_count = __le16_to_cpu(cp->key_count);
2360         if (key_count > max_key_count) {
2361                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2362                            key_count);
2363                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2364                                        MGMT_STATUS_INVALID_PARAMS);
2365         }
2366
2367         expected_len = struct_size(cp, keys, key_count);
2368         if (expected_len != len) {
2369                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2370                            expected_len, len);
2371                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2372                                        MGMT_STATUS_INVALID_PARAMS);
2373         }
2374
2375         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2376                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2377                                        MGMT_STATUS_INVALID_PARAMS);
2378
2379         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2380                    key_count);
2381
2382         for (i = 0; i < key_count; i++) {
2383                 struct mgmt_link_key_info *key = &cp->keys[i];
2384
2385                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2386                         return mgmt_cmd_status(sk, hdev->id,
2387                                                MGMT_OP_LOAD_LINK_KEYS,
2388                                                MGMT_STATUS_INVALID_PARAMS);
2389         }
2390
2391         hci_dev_lock(hdev);
2392
2393         hci_link_keys_clear(hdev);
2394
2395         if (cp->debug_keys)
2396                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2397         else
2398                 changed = hci_dev_test_and_clear_flag(hdev,
2399                                                       HCI_KEEP_DEBUG_KEYS);
2400
2401         if (changed)
2402                 new_settings(hdev, NULL);
2403
2404         for (i = 0; i < key_count; i++) {
2405                 struct mgmt_link_key_info *key = &cp->keys[i];
2406
2407                 if (hci_is_blocked_key(hdev,
2408                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2409                                        key->val)) {
2410                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2411                                     &key->addr.bdaddr);
2412                         continue;
2413                 }
2414
2415                 /* Always ignore debug keys and require a new pairing if
2416                  * the user wants to use them.
2417                  */
2418                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2419                         continue;
2420
2421                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2422                                  key->type, key->pin_len, NULL);
2423         }
2424
2425         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2426
2427         hci_dev_unlock(hdev);
2428
2429         return 0;
2430 }
2431
2432 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2433                            u8 addr_type, struct sock *skip_sk)
2434 {
2435         struct mgmt_ev_device_unpaired ev;
2436
2437         bacpy(&ev.addr.bdaddr, bdaddr);
2438         ev.addr.type = addr_type;
2439
2440         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2441                           skip_sk);
2442 }
2443
2444 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2445                          u16 len)
2446 {
2447         struct mgmt_cp_unpair_device *cp = data;
2448         struct mgmt_rp_unpair_device rp;
2449         struct hci_conn_params *params;
2450         struct mgmt_pending_cmd *cmd;
2451         struct hci_conn *conn;
2452         u8 addr_type;
2453         int err;
2454
2455         memset(&rp, 0, sizeof(rp));
2456         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2457         rp.addr.type = cp->addr.type;
2458
2459         if (!bdaddr_type_is_valid(cp->addr.type))
2460                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2461                                          MGMT_STATUS_INVALID_PARAMS,
2462                                          &rp, sizeof(rp));
2463
2464         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2465                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466                                          MGMT_STATUS_INVALID_PARAMS,
2467                                          &rp, sizeof(rp));
2468
2469         hci_dev_lock(hdev);
2470
2471         if (!hdev_is_powered(hdev)) {
2472                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2473                                         MGMT_STATUS_NOT_POWERED, &rp,
2474                                         sizeof(rp));
2475                 goto unlock;
2476         }
2477
2478         if (cp->addr.type == BDADDR_BREDR) {
2479                 /* If disconnection is requested, then look up the
2480                  * connection. If the remote device is connected, it
2481                  * will be later used to terminate the link.
2482                  *
2483                  * Setting it to NULL explicitly will cause no
2484                  * termination of the link.
2485                  */
2486                 if (cp->disconnect)
2487                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2488                                                        &cp->addr.bdaddr);
2489                 else
2490                         conn = NULL;
2491
2492                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2493                 if (err < 0) {
2494                         err = mgmt_cmd_complete(sk, hdev->id,
2495                                                 MGMT_OP_UNPAIR_DEVICE,
2496                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2497                                                 sizeof(rp));
2498                         goto unlock;
2499                 }
2500
2501                 goto done;
2502         }
2503
2504         /* LE address type */
2505         addr_type = le_addr_type(cp->addr.type);
2506
2507         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2508         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2509         if (err < 0) {
2510                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2511                                         MGMT_STATUS_NOT_PAIRED, &rp,
2512                                         sizeof(rp));
2513                 goto unlock;
2514         }
2515
2516         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2517         if (!conn) {
2518                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2519                 goto done;
2520         }
2521
2522
2523         /* Defer clearing up the connection parameters until closing to
2524          * give a chance of keeping them if a repairing happens.
2525          */
2526         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2527
2528         /* Disable auto-connection parameters if present */
2529         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2530         if (params) {
2531                 if (params->explicit_connect)
2532                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2533                 else
2534                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2535         }
2536
2537         /* If disconnection is not requested, then clear the connection
2538          * variable so that the link is not terminated.
2539          */
2540         if (!cp->disconnect)
2541                 conn = NULL;
2542
2543 done:
2544         /* If the connection variable is set, then termination of the
2545          * link is requested.
2546          */
2547         if (!conn) {
2548                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2549                                         &rp, sizeof(rp));
2550                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2551                 goto unlock;
2552         }
2553
2554         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2555                                sizeof(*cp));
2556         if (!cmd) {
2557                 err = -ENOMEM;
2558                 goto unlock;
2559         }
2560
2561         cmd->cmd_complete = addr_cmd_complete;
2562
2563         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2564         if (err < 0)
2565                 mgmt_pending_remove(cmd);
2566
2567 unlock:
2568         hci_dev_unlock(hdev);
2569         return err;
2570 }
2571
2572 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2573                       u16 len)
2574 {
2575         struct mgmt_cp_disconnect *cp = data;
2576         struct mgmt_rp_disconnect rp;
2577         struct mgmt_pending_cmd *cmd;
2578         struct hci_conn *conn;
2579         int err;
2580
2581         bt_dev_dbg(hdev, "sock %p", sk);
2582
2583         memset(&rp, 0, sizeof(rp));
2584         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2585         rp.addr.type = cp->addr.type;
2586
2587         if (!bdaddr_type_is_valid(cp->addr.type))
2588                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2589                                          MGMT_STATUS_INVALID_PARAMS,
2590                                          &rp, sizeof(rp));
2591
2592         hci_dev_lock(hdev);
2593
2594         if (!test_bit(HCI_UP, &hdev->flags)) {
2595                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2596                                         MGMT_STATUS_NOT_POWERED, &rp,
2597                                         sizeof(rp));
2598                 goto failed;
2599         }
2600
2601         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2602                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2603                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2604                 goto failed;
2605         }
2606
2607         if (cp->addr.type == BDADDR_BREDR)
2608                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2609                                                &cp->addr.bdaddr);
2610         else
2611                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2612                                                le_addr_type(cp->addr.type));
2613
2614         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2615                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2616                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2617                                         sizeof(rp));
2618                 goto failed;
2619         }
2620
2621         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2622         if (!cmd) {
2623                 err = -ENOMEM;
2624                 goto failed;
2625         }
2626
2627         cmd->cmd_complete = generic_cmd_complete;
2628
2629         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2630         if (err < 0)
2631                 mgmt_pending_remove(cmd);
2632
2633 failed:
2634         hci_dev_unlock(hdev);
2635         return err;
2636 }
2637
2638 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2639 {
2640         switch (link_type) {
2641         case LE_LINK:
2642                 switch (addr_type) {
2643                 case ADDR_LE_DEV_PUBLIC:
2644                         return BDADDR_LE_PUBLIC;
2645
2646                 default:
2647                         /* Fallback to LE Random address type */
2648                         return BDADDR_LE_RANDOM;
2649                 }
2650
2651         default:
2652                 /* Fallback to BR/EDR type */
2653                 return BDADDR_BREDR;
2654         }
2655 }
2656
2657 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2658                            u16 data_len)
2659 {
2660         struct mgmt_rp_get_connections *rp;
2661         struct hci_conn *c;
2662         int err;
2663         u16 i;
2664
2665         bt_dev_dbg(hdev, "sock %p", sk);
2666
2667         hci_dev_lock(hdev);
2668
2669         if (!hdev_is_powered(hdev)) {
2670                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2671                                       MGMT_STATUS_NOT_POWERED);
2672                 goto unlock;
2673         }
2674
2675         i = 0;
2676         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2677                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2678                         i++;
2679         }
2680
2681         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2682         if (!rp) {
2683                 err = -ENOMEM;
2684                 goto unlock;
2685         }
2686
2687         i = 0;
2688         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2689                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2690                         continue;
2691                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2692                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2693                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2694                         continue;
2695                 i++;
2696         }
2697
2698         rp->conn_count = cpu_to_le16(i);
2699
2700         /* Recalculate length in case of filtered SCO connections, etc */
2701         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2702                                 struct_size(rp, addr, i));
2703
2704         kfree(rp);
2705
2706 unlock:
2707         hci_dev_unlock(hdev);
2708         return err;
2709 }
2710
2711 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2712                                    struct mgmt_cp_pin_code_neg_reply *cp)
2713 {
2714         struct mgmt_pending_cmd *cmd;
2715         int err;
2716
2717         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2718                                sizeof(*cp));
2719         if (!cmd)
2720                 return -ENOMEM;
2721
2722         cmd->cmd_complete = addr_cmd_complete;
2723
2724         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2725                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2726         if (err < 0)
2727                 mgmt_pending_remove(cmd);
2728
2729         return err;
2730 }
2731
2732 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2733                           u16 len)
2734 {
2735         struct hci_conn *conn;
2736         struct mgmt_cp_pin_code_reply *cp = data;
2737         struct hci_cp_pin_code_reply reply;
2738         struct mgmt_pending_cmd *cmd;
2739         int err;
2740
2741         bt_dev_dbg(hdev, "sock %p", sk);
2742
2743         hci_dev_lock(hdev);
2744
2745         if (!hdev_is_powered(hdev)) {
2746                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2747                                       MGMT_STATUS_NOT_POWERED);
2748                 goto failed;
2749         }
2750
2751         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2752         if (!conn) {
2753                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2754                                       MGMT_STATUS_NOT_CONNECTED);
2755                 goto failed;
2756         }
2757
2758         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2759                 struct mgmt_cp_pin_code_neg_reply ncp;
2760
2761                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2762
2763                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2764
2765                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2766                 if (err >= 0)
2767                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2768                                               MGMT_STATUS_INVALID_PARAMS);
2769
2770                 goto failed;
2771         }
2772
2773         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2774         if (!cmd) {
2775                 err = -ENOMEM;
2776                 goto failed;
2777         }
2778
2779         cmd->cmd_complete = addr_cmd_complete;
2780
2781         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2782         reply.pin_len = cp->pin_len;
2783         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2784
2785         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2786         if (err < 0)
2787                 mgmt_pending_remove(cmd);
2788
2789 failed:
2790         hci_dev_unlock(hdev);
2791         return err;
2792 }
2793
2794 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2795                              u16 len)
2796 {
2797         struct mgmt_cp_set_io_capability *cp = data;
2798
2799         bt_dev_dbg(hdev, "sock %p", sk);
2800
2801         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2802                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2803                                        MGMT_STATUS_INVALID_PARAMS);
2804
2805         hci_dev_lock(hdev);
2806
2807         hdev->io_capability = cp->io_capability;
2808
2809         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2810
2811         hci_dev_unlock(hdev);
2812
2813         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2814                                  NULL, 0);
2815 }
2816
2817 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2818 {
2819         struct hci_dev *hdev = conn->hdev;
2820         struct mgmt_pending_cmd *cmd;
2821
2822         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2823                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2824                         continue;
2825
2826                 if (cmd->user_data != conn)
2827                         continue;
2828
2829                 return cmd;
2830         }
2831
2832         return NULL;
2833 }
2834
2835 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2836 {
2837         struct mgmt_rp_pair_device rp;
2838         struct hci_conn *conn = cmd->user_data;
2839         int err;
2840
2841         bacpy(&rp.addr.bdaddr, &conn->dst);
2842         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2843
2844         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2845                                 status, &rp, sizeof(rp));
2846
2847         /* So we don't get further callbacks for this connection */
2848         conn->connect_cfm_cb = NULL;
2849         conn->security_cfm_cb = NULL;
2850         conn->disconn_cfm_cb = NULL;
2851
2852         hci_conn_drop(conn);
2853
2854         /* The device is paired so there is no need to remove
2855          * its connection parameters anymore.
2856          */
2857         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2858
2859         hci_conn_put(conn);
2860
2861         return err;
2862 }
2863
2864 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2865 {
2866         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2867         struct mgmt_pending_cmd *cmd;
2868
2869         cmd = find_pairing(conn);
2870         if (cmd) {
2871                 cmd->cmd_complete(cmd, status);
2872                 mgmt_pending_remove(cmd);
2873         }
2874 }
2875
2876 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2877 {
2878         struct mgmt_pending_cmd *cmd;
2879
2880         BT_DBG("status %u", status);
2881
2882         cmd = find_pairing(conn);
2883         if (!cmd) {
2884                 BT_DBG("Unable to find a pending command");
2885                 return;
2886         }
2887
2888         cmd->cmd_complete(cmd, mgmt_status(status));
2889         mgmt_pending_remove(cmd);
2890 }
2891
2892 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2893 {
2894         struct mgmt_pending_cmd *cmd;
2895
2896         BT_DBG("status %u", status);
2897
2898         if (!status)
2899                 return;
2900
2901         cmd = find_pairing(conn);
2902         if (!cmd) {
2903                 BT_DBG("Unable to find a pending command");
2904                 return;
2905         }
2906
2907         cmd->cmd_complete(cmd, mgmt_status(status));
2908         mgmt_pending_remove(cmd);
2909 }
2910
2911 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2912                        u16 len)
2913 {
2914         struct mgmt_cp_pair_device *cp = data;
2915         struct mgmt_rp_pair_device rp;
2916         struct mgmt_pending_cmd *cmd;
2917         u8 sec_level, auth_type;
2918         struct hci_conn *conn;
2919         int err;
2920
2921         bt_dev_dbg(hdev, "sock %p", sk);
2922
2923         memset(&rp, 0, sizeof(rp));
2924         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2925         rp.addr.type = cp->addr.type;
2926
2927         if (!bdaddr_type_is_valid(cp->addr.type))
2928                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2929                                          MGMT_STATUS_INVALID_PARAMS,
2930                                          &rp, sizeof(rp));
2931
2932         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2933                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2934                                          MGMT_STATUS_INVALID_PARAMS,
2935                                          &rp, sizeof(rp));
2936
2937         hci_dev_lock(hdev);
2938
2939         if (!hdev_is_powered(hdev)) {
2940                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2941                                         MGMT_STATUS_NOT_POWERED, &rp,
2942                                         sizeof(rp));
2943                 goto unlock;
2944         }
2945
2946         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2947                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2948                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2949                                         sizeof(rp));
2950                 goto unlock;
2951         }
2952
2953         sec_level = BT_SECURITY_MEDIUM;
2954         auth_type = HCI_AT_DEDICATED_BONDING;
2955
2956         if (cp->addr.type == BDADDR_BREDR) {
2957                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2958                                        auth_type, CONN_REASON_PAIR_DEVICE);
2959         } else {
2960                 u8 addr_type = le_addr_type(cp->addr.type);
2961                 struct hci_conn_params *p;
2962
2963                 /* When pairing a new device, it is expected to remember
2964                  * this device for future connections. Adding the connection
2965                  * parameter information ahead of time allows tracking
2966                  * of the peripheral preferred values and will speed up any
2967                  * further connection establishment.
2968                  *
2969                  * If connection parameters already exist, then they
2970                  * will be kept and this function does nothing.
2971                  */
2972                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2973
2974                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2975                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2976
2977                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2978                                            sec_level, HCI_LE_CONN_TIMEOUT,
2979                                            CONN_REASON_PAIR_DEVICE);
2980         }
2981
2982         if (IS_ERR(conn)) {
2983                 int status;
2984
2985                 if (PTR_ERR(conn) == -EBUSY)
2986                         status = MGMT_STATUS_BUSY;
2987                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2988                         status = MGMT_STATUS_NOT_SUPPORTED;
2989                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2990                         status = MGMT_STATUS_REJECTED;
2991                 else
2992                         status = MGMT_STATUS_CONNECT_FAILED;
2993
2994                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2995                                         status, &rp, sizeof(rp));
2996                 goto unlock;
2997         }
2998
2999         if (conn->connect_cfm_cb) {
3000                 hci_conn_drop(conn);
3001                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3002                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3003                 goto unlock;
3004         }
3005
3006         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3007         if (!cmd) {
3008                 err = -ENOMEM;
3009                 hci_conn_drop(conn);
3010                 goto unlock;
3011         }
3012
3013         cmd->cmd_complete = pairing_complete;
3014
3015         /* For LE, just connecting isn't a proof that the pairing finished */
3016         if (cp->addr.type == BDADDR_BREDR) {
3017                 conn->connect_cfm_cb = pairing_complete_cb;
3018                 conn->security_cfm_cb = pairing_complete_cb;
3019                 conn->disconn_cfm_cb = pairing_complete_cb;
3020         } else {
3021                 conn->connect_cfm_cb = le_pairing_complete_cb;
3022                 conn->security_cfm_cb = le_pairing_complete_cb;
3023                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3024         }
3025
3026         conn->io_capability = cp->io_cap;
3027         cmd->user_data = hci_conn_get(conn);
3028
3029         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3030             hci_conn_security(conn, sec_level, auth_type, true)) {
3031                 cmd->cmd_complete(cmd, 0);
3032                 mgmt_pending_remove(cmd);
3033         }
3034
3035         err = 0;
3036
3037 unlock:
3038         hci_dev_unlock(hdev);
3039         return err;
3040 }
3041
3042 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3043                               u16 len)
3044 {
3045         struct mgmt_addr_info *addr = data;
3046         struct mgmt_pending_cmd *cmd;
3047         struct hci_conn *conn;
3048         int err;
3049
3050         bt_dev_dbg(hdev, "sock %p", sk);
3051
3052         hci_dev_lock(hdev);
3053
3054         if (!hdev_is_powered(hdev)) {
3055                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3056                                       MGMT_STATUS_NOT_POWERED);
3057                 goto unlock;
3058         }
3059
3060         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3061         if (!cmd) {
3062                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3063                                       MGMT_STATUS_INVALID_PARAMS);
3064                 goto unlock;
3065         }
3066
3067         conn = cmd->user_data;
3068
3069         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3070                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3071                                       MGMT_STATUS_INVALID_PARAMS);
3072                 goto unlock;
3073         }
3074
3075         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3076         mgmt_pending_remove(cmd);
3077
3078         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3079                                 addr, sizeof(*addr));
3080
3081         /* Since user doesn't want to proceed with the connection, abort any
3082          * ongoing pairing and then terminate the link if it was created
3083          * because of the pair device action.
3084          */
3085         if (addr->type == BDADDR_BREDR)
3086                 hci_remove_link_key(hdev, &addr->bdaddr);
3087         else
3088                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3089                                               le_addr_type(addr->type));
3090
3091         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3092                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3093
3094 unlock:
3095         hci_dev_unlock(hdev);
3096         return err;
3097 }
3098
3099 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3100                              struct mgmt_addr_info *addr, u16 mgmt_op,
3101                              u16 hci_op, __le32 passkey)
3102 {
3103         struct mgmt_pending_cmd *cmd;
3104         struct hci_conn *conn;
3105         int err;
3106
3107         hci_dev_lock(hdev);
3108
3109         if (!hdev_is_powered(hdev)) {
3110                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3111                                         MGMT_STATUS_NOT_POWERED, addr,
3112                                         sizeof(*addr));
3113                 goto done;
3114         }
3115
3116         if (addr->type == BDADDR_BREDR)
3117                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3118         else
3119                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3120                                                le_addr_type(addr->type));
3121
3122         if (!conn) {
3123                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3124                                         MGMT_STATUS_NOT_CONNECTED, addr,
3125                                         sizeof(*addr));
3126                 goto done;
3127         }
3128
3129         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3130                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3131                 if (!err)
3132                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3133                                                 MGMT_STATUS_SUCCESS, addr,
3134                                                 sizeof(*addr));
3135                 else
3136                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3137                                                 MGMT_STATUS_FAILED, addr,
3138                                                 sizeof(*addr));
3139
3140                 goto done;
3141         }
3142
3143         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3144         if (!cmd) {
3145                 err = -ENOMEM;
3146                 goto done;
3147         }
3148
3149         cmd->cmd_complete = addr_cmd_complete;
3150
3151         /* Continue with pairing via HCI */
3152         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3153                 struct hci_cp_user_passkey_reply cp;
3154
3155                 bacpy(&cp.bdaddr, &addr->bdaddr);
3156                 cp.passkey = passkey;
3157                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3158         } else
3159                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3160                                    &addr->bdaddr);
3161
3162         if (err < 0)
3163                 mgmt_pending_remove(cmd);
3164
3165 done:
3166         hci_dev_unlock(hdev);
3167         return err;
3168 }
3169
3170 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3171                               void *data, u16 len)
3172 {
3173         struct mgmt_cp_pin_code_neg_reply *cp = data;
3174
3175         bt_dev_dbg(hdev, "sock %p", sk);
3176
3177         return user_pairing_resp(sk, hdev, &cp->addr,
3178                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3179                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3180 }
3181
3182 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3183                               u16 len)
3184 {
3185         struct mgmt_cp_user_confirm_reply *cp = data;
3186
3187         bt_dev_dbg(hdev, "sock %p", sk);
3188
3189         if (len != sizeof(*cp))
3190                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3191                                        MGMT_STATUS_INVALID_PARAMS);
3192
3193         return user_pairing_resp(sk, hdev, &cp->addr,
3194                                  MGMT_OP_USER_CONFIRM_REPLY,
3195                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3196 }
3197
3198 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3199                                   void *data, u16 len)
3200 {
3201         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3202
3203         bt_dev_dbg(hdev, "sock %p", sk);
3204
3205         return user_pairing_resp(sk, hdev, &cp->addr,
3206                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3207                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3208 }
3209
3210 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3211                               u16 len)
3212 {
3213         struct mgmt_cp_user_passkey_reply *cp = data;
3214
3215         bt_dev_dbg(hdev, "sock %p", sk);
3216
3217         return user_pairing_resp(sk, hdev, &cp->addr,
3218                                  MGMT_OP_USER_PASSKEY_REPLY,
3219                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3220 }
3221
3222 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3223                                   void *data, u16 len)
3224 {
3225         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3226
3227         bt_dev_dbg(hdev, "sock %p", sk);
3228
3229         return user_pairing_resp(sk, hdev, &cp->addr,
3230                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3231                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3232 }
3233
3234 static void adv_expire(struct hci_dev *hdev, u32 flags)
3235 {
3236         struct adv_info *adv_instance;
3237         struct hci_request req;
3238         int err;
3239
3240         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3241         if (!adv_instance)
3242                 return;
3243
3244         /* stop if current instance doesn't need to be changed */
3245         if (!(adv_instance->flags & flags))
3246                 return;
3247
3248         cancel_adv_timeout(hdev);
3249
3250         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3251         if (!adv_instance)
3252                 return;
3253
3254         hci_req_init(&req, hdev);
3255         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3256                                               true);
3257         if (err)
3258                 return;
3259
3260         hci_req_run(&req, NULL);
3261 }
3262
3263 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3264 {
3265         struct mgmt_cp_set_local_name *cp;
3266         struct mgmt_pending_cmd *cmd;
3267
3268         bt_dev_dbg(hdev, "status 0x%02x", status);
3269
3270         hci_dev_lock(hdev);
3271
3272         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3273         if (!cmd)
3274                 goto unlock;
3275
3276         cp = cmd->param;
3277
3278         if (status) {
3279                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3280                                 mgmt_status(status));
3281         } else {
3282                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3283                                   cp, sizeof(*cp));
3284
3285                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3286                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3287         }
3288
3289         mgmt_pending_remove(cmd);
3290
3291 unlock:
3292         hci_dev_unlock(hdev);
3293 }
3294
3295 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3296                           u16 len)
3297 {
3298         struct mgmt_cp_set_local_name *cp = data;
3299         struct mgmt_pending_cmd *cmd;
3300         struct hci_request req;
3301         int err;
3302
3303         bt_dev_dbg(hdev, "sock %p", sk);
3304
3305         hci_dev_lock(hdev);
3306
3307         /* If the old values are the same as the new ones just return a
3308          * direct command complete event.
3309          */
3310         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3311             !memcmp(hdev->short_name, cp->short_name,
3312                     sizeof(hdev->short_name))) {
3313                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3314                                         data, len);
3315                 goto failed;
3316         }
3317
3318         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3319
3320         if (!hdev_is_powered(hdev)) {
3321                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3322
3323                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3324                                         data, len);
3325                 if (err < 0)
3326                         goto failed;
3327
3328                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3329                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3330                 ext_info_changed(hdev, sk);
3331
3332                 goto failed;
3333         }
3334
3335         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3336         if (!cmd) {
3337                 err = -ENOMEM;
3338                 goto failed;
3339         }
3340
3341         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3342
3343         hci_req_init(&req, hdev);
3344
3345         if (lmp_bredr_capable(hdev)) {
3346                 __hci_req_update_name(&req);
3347                 __hci_req_update_eir(&req);
3348         }
3349
3350         /* The name is stored in the scan response data and so
3351          * no need to update the advertising data here.
3352          */
3353         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3354                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3355
3356         err = hci_req_run(&req, set_name_complete);
3357         if (err < 0)
3358                 mgmt_pending_remove(cmd);
3359
3360 failed:
3361         hci_dev_unlock(hdev);
3362         return err;
3363 }
3364
3365 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3366                           u16 len)
3367 {
3368         struct mgmt_cp_set_appearance *cp = data;
3369         u16 appearance;
3370         int err;
3371
3372         bt_dev_dbg(hdev, "sock %p", sk);
3373
3374         if (!lmp_le_capable(hdev))
3375                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3376                                        MGMT_STATUS_NOT_SUPPORTED);
3377
3378         appearance = le16_to_cpu(cp->appearance);
3379
3380         hci_dev_lock(hdev);
3381
3382         if (hdev->appearance != appearance) {
3383                 hdev->appearance = appearance;
3384
3385                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3386                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3387
3388                 ext_info_changed(hdev, sk);
3389         }
3390
3391         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3392                                 0);
3393
3394         hci_dev_unlock(hdev);
3395
3396         return err;
3397 }
3398
3399 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3400                                  void *data, u16 len)
3401 {
3402         struct mgmt_rp_get_phy_configuration rp;
3403
3404         bt_dev_dbg(hdev, "sock %p", sk);
3405
3406         hci_dev_lock(hdev);
3407
3408         memset(&rp, 0, sizeof(rp));
3409
3410         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3411         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3412         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3413
3414         hci_dev_unlock(hdev);
3415
3416         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3417                                  &rp, sizeof(rp));
3418 }
3419
3420 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3421 {
3422         struct mgmt_ev_phy_configuration_changed ev;
3423
3424         memset(&ev, 0, sizeof(ev));
3425
3426         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3427
3428         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3429                           sizeof(ev), skip);
3430 }
3431
3432 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3433                                      u16 opcode, struct sk_buff *skb)
3434 {
3435         struct mgmt_pending_cmd *cmd;
3436
3437         bt_dev_dbg(hdev, "status 0x%02x", status);
3438
3439         hci_dev_lock(hdev);
3440
3441         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3442         if (!cmd)
3443                 goto unlock;
3444
3445         if (status) {
3446                 mgmt_cmd_status(cmd->sk, hdev->id,
3447                                 MGMT_OP_SET_PHY_CONFIGURATION,
3448                                 mgmt_status(status));
3449         } else {
3450                 mgmt_cmd_complete(cmd->sk, hdev->id,
3451                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3452                                   NULL, 0);
3453
3454                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3455         }
3456
3457         mgmt_pending_remove(cmd);
3458
3459 unlock:
3460         hci_dev_unlock(hdev);
3461 }
3462
3463 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3464                                  void *data, u16 len)
3465 {
3466         struct mgmt_cp_set_phy_configuration *cp = data;
3467         struct hci_cp_le_set_default_phy cp_phy;
3468         struct mgmt_pending_cmd *cmd;
3469         struct hci_request req;
3470         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3471         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3472         bool changed = false;
3473         int err;
3474
3475         bt_dev_dbg(hdev, "sock %p", sk);
3476
3477         configurable_phys = get_configurable_phys(hdev);
3478         supported_phys = get_supported_phys(hdev);
3479         selected_phys = __le32_to_cpu(cp->selected_phys);
3480
3481         if (selected_phys & ~supported_phys)
3482                 return mgmt_cmd_status(sk, hdev->id,
3483                                        MGMT_OP_SET_PHY_CONFIGURATION,
3484                                        MGMT_STATUS_INVALID_PARAMS);
3485
3486         unconfigure_phys = supported_phys & ~configurable_phys;
3487
3488         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3489                 return mgmt_cmd_status(sk, hdev->id,
3490                                        MGMT_OP_SET_PHY_CONFIGURATION,
3491                                        MGMT_STATUS_INVALID_PARAMS);
3492
3493         if (selected_phys == get_selected_phys(hdev))
3494                 return mgmt_cmd_complete(sk, hdev->id,
3495                                          MGMT_OP_SET_PHY_CONFIGURATION,
3496                                          0, NULL, 0);
3497
3498         hci_dev_lock(hdev);
3499
3500         if (!hdev_is_powered(hdev)) {
3501                 err = mgmt_cmd_status(sk, hdev->id,
3502                                       MGMT_OP_SET_PHY_CONFIGURATION,
3503                                       MGMT_STATUS_REJECTED);
3504                 goto unlock;
3505         }
3506
3507         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3508                 err = mgmt_cmd_status(sk, hdev->id,
3509                                       MGMT_OP_SET_PHY_CONFIGURATION,
3510                                       MGMT_STATUS_BUSY);
3511                 goto unlock;
3512         }
3513
3514         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3515                 pkt_type |= (HCI_DH3 | HCI_DM3);
3516         else
3517                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3518
3519         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3520                 pkt_type |= (HCI_DH5 | HCI_DM5);
3521         else
3522                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3523
3524         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3525                 pkt_type &= ~HCI_2DH1;
3526         else
3527                 pkt_type |= HCI_2DH1;
3528
3529         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3530                 pkt_type &= ~HCI_2DH3;
3531         else
3532                 pkt_type |= HCI_2DH3;
3533
3534         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3535                 pkt_type &= ~HCI_2DH5;
3536         else
3537                 pkt_type |= HCI_2DH5;
3538
3539         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3540                 pkt_type &= ~HCI_3DH1;
3541         else
3542                 pkt_type |= HCI_3DH1;
3543
3544         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3545                 pkt_type &= ~HCI_3DH3;
3546         else
3547                 pkt_type |= HCI_3DH3;
3548
3549         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3550                 pkt_type &= ~HCI_3DH5;
3551         else
3552                 pkt_type |= HCI_3DH5;
3553
3554         if (pkt_type != hdev->pkt_type) {
3555                 hdev->pkt_type = pkt_type;
3556                 changed = true;
3557         }
3558
3559         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3560             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3561                 if (changed)
3562                         mgmt_phy_configuration_changed(hdev, sk);
3563
3564                 err = mgmt_cmd_complete(sk, hdev->id,
3565                                         MGMT_OP_SET_PHY_CONFIGURATION,
3566                                         0, NULL, 0);
3567
3568                 goto unlock;
3569         }
3570
3571         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3572                                len);
3573         if (!cmd) {
3574                 err = -ENOMEM;
3575                 goto unlock;
3576         }
3577
3578         hci_req_init(&req, hdev);
3579
3580         memset(&cp_phy, 0, sizeof(cp_phy));
3581
3582         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3583                 cp_phy.all_phys |= 0x01;
3584
3585         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3586                 cp_phy.all_phys |= 0x02;
3587
3588         if (selected_phys & MGMT_PHY_LE_1M_TX)
3589                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3590
3591         if (selected_phys & MGMT_PHY_LE_2M_TX)
3592                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3593
3594         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3595                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3596
3597         if (selected_phys & MGMT_PHY_LE_1M_RX)
3598                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3599
3600         if (selected_phys & MGMT_PHY_LE_2M_RX)
3601                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3602
3603         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3604                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3605
3606         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3607
3608         err = hci_req_run_skb(&req, set_default_phy_complete);
3609         if (err < 0)
3610                 mgmt_pending_remove(cmd);
3611
3612 unlock:
3613         hci_dev_unlock(hdev);
3614
3615         return err;
3616 }
3617
3618 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3619                             u16 len)
3620 {
3621         int err = MGMT_STATUS_SUCCESS;
3622         struct mgmt_cp_set_blocked_keys *keys = data;
3623         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3624                                    sizeof(struct mgmt_blocked_key_info));
3625         u16 key_count, expected_len;
3626         int i;
3627
3628         bt_dev_dbg(hdev, "sock %p", sk);
3629
3630         key_count = __le16_to_cpu(keys->key_count);
3631         if (key_count > max_key_count) {
3632                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3633                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3634                                        MGMT_STATUS_INVALID_PARAMS);
3635         }
3636
3637         expected_len = struct_size(keys, keys, key_count);
3638         if (expected_len != len) {
3639                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3640                            expected_len, len);
3641                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3642                                        MGMT_STATUS_INVALID_PARAMS);
3643         }
3644
3645         hci_dev_lock(hdev);
3646
3647         hci_blocked_keys_clear(hdev);
3648
3649         for (i = 0; i < keys->key_count; ++i) {
3650                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3651
3652                 if (!b) {
3653                         err = MGMT_STATUS_NO_RESOURCES;
3654                         break;
3655                 }
3656
3657                 b->type = keys->keys[i].type;
3658                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3659                 list_add_rcu(&b->list, &hdev->blocked_keys);
3660         }
3661         hci_dev_unlock(hdev);
3662
3663         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3664                                 err, NULL, 0);
3665 }
3666
3667 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3668                                void *data, u16 len)
3669 {
3670         struct mgmt_mode *cp = data;
3671         int err;
3672         bool changed = false;
3673
3674         bt_dev_dbg(hdev, "sock %p", sk);
3675
3676         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3677                 return mgmt_cmd_status(sk, hdev->id,
3678                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3679                                        MGMT_STATUS_NOT_SUPPORTED);
3680
3681         if (cp->val != 0x00 && cp->val != 0x01)
3682                 return mgmt_cmd_status(sk, hdev->id,
3683                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3684                                        MGMT_STATUS_INVALID_PARAMS);
3685
3686         hci_dev_lock(hdev);
3687
3688         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3689                 err = mgmt_cmd_status(sk, hdev->id,
3690                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3691                                       MGMT_STATUS_BUSY);
3692                 goto unlock;
3693         }
3694
3695         if (hdev_is_powered(hdev) &&
3696             !!cp->val != hci_dev_test_flag(hdev,
3697                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3698                 err = mgmt_cmd_status(sk, hdev->id,
3699                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3700                                       MGMT_STATUS_REJECTED);
3701                 goto unlock;
3702         }
3703
3704         if (cp->val)
3705                 changed = !hci_dev_test_and_set_flag(hdev,
3706                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3707         else
3708                 changed = hci_dev_test_and_clear_flag(hdev,
3709                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3710
3711         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3712         if (err < 0)
3713                 goto unlock;
3714
3715         if (changed)
3716                 err = new_settings(hdev, sk);
3717
3718 unlock:
3719         hci_dev_unlock(hdev);
3720         return err;
3721 }
3722
3723 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3724                                void *data, u16 data_len)
3725 {
3726         char buf[20];
3727         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3728         u16 cap_len = 0;
3729         u8 flags = 0;
3730         u8 tx_power_range[2];
3731
3732         bt_dev_dbg(hdev, "sock %p", sk);
3733
3734         memset(&buf, 0, sizeof(buf));
3735
3736         hci_dev_lock(hdev);
3737
3738         /* When the Read Simple Pairing Options command is supported, then
3739          * the remote public key validation is supported.
3740          *
3741          * Alternatively, when Microsoft extensions are available, they can
3742          * indicate support for public key validation as well.
3743          */
3744         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3745                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3746
3747         flags |= 0x02;          /* Remote public key validation (LE) */
3748
3749         /* When the Read Encryption Key Size command is supported, then the
3750          * encryption key size is enforced.
3751          */
3752         if (hdev->commands[20] & 0x10)
3753                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3754
3755         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3756
3757         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3758                                   &flags, 1);
3759
3760         /* When the Read Simple Pairing Options command is supported, then
3761          * also max encryption key size information is provided.
3762          */
3763         if (hdev->commands[41] & 0x08)
3764                 cap_len = eir_append_le16(rp->cap, cap_len,
3765                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3766                                           hdev->max_enc_key_size);
3767
3768         cap_len = eir_append_le16(rp->cap, cap_len,
3769                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3770                                   SMP_MAX_ENC_KEY_SIZE);
3771
3772         /* Append the min/max LE tx power parameters if we were able to fetch
3773          * it from the controller
3774          */
3775         if (hdev->commands[38] & 0x80) {
3776                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3777                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3778                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3779                                           tx_power_range, 2);
3780         }
3781
3782         rp->cap_len = cpu_to_le16(cap_len);
3783
3784         hci_dev_unlock(hdev);
3785
3786         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3787                                  rp, sizeof(*rp) + cap_len);
3788 }
3789
3790 #ifdef CONFIG_BT_FEATURE_DEBUG
3791 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3792 static const u8 debug_uuid[16] = {
3793         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3794         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3795 };
3796 #endif
3797
3798 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3799 static const u8 simult_central_periph_uuid[16] = {
3800         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3801         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3802 };
3803
3804 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3805 static const u8 rpa_resolution_uuid[16] = {
3806         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3807         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3808 };
3809
3810 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3811                                   void *data, u16 data_len)
3812 {
3813         char buf[62];   /* Enough space for 3 features */
3814         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3815         u16 idx = 0;
3816         u32 flags;
3817
3818         bt_dev_dbg(hdev, "sock %p", sk);
3819
3820         memset(&buf, 0, sizeof(buf));
3821
3822 #ifdef CONFIG_BT_FEATURE_DEBUG
3823         if (!hdev) {
3824                 flags = bt_dbg_get() ? BIT(0) : 0;
3825
3826                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3827                 rp->features[idx].flags = cpu_to_le32(flags);
3828                 idx++;
3829         }
3830 #endif
3831
3832         if (hdev) {
3833                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3834                     (hdev->le_states[4] & 0x08) &&      /* Central */
3835                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3836                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3837                         flags = BIT(0);
3838                 else
3839                         flags = 0;
3840
3841                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3842                 rp->features[idx].flags = cpu_to_le32(flags);
3843                 idx++;
3844         }
3845
3846         if (hdev && use_ll_privacy(hdev)) {
3847                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3848                         flags = BIT(0) | BIT(1);
3849                 else
3850                         flags = BIT(1);
3851
3852                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3853                 rp->features[idx].flags = cpu_to_le32(flags);
3854                 idx++;
3855         }
3856
3857         rp->feature_count = cpu_to_le16(idx);
3858
3859         /* After reading the experimental features information, enable
3860          * the events to update client on any future change.
3861          */
3862         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3863
3864         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3865                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3866                                  0, rp, sizeof(*rp) + (20 * idx));
3867 }
3868
3869 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3870                                           struct sock *skip)
3871 {
3872         struct mgmt_ev_exp_feature_changed ev;
3873
3874         memset(&ev, 0, sizeof(ev));
3875         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3876         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3877
3878         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3879                                   &ev, sizeof(ev),
3880                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3881
3882 }
3883
3884 #ifdef CONFIG_BT_FEATURE_DEBUG
3885 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3886 {
3887         struct mgmt_ev_exp_feature_changed ev;
3888
3889         memset(&ev, 0, sizeof(ev));
3890         memcpy(ev.uuid, debug_uuid, 16);
3891         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3892
3893         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3894                                   &ev, sizeof(ev),
3895                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3896 }
3897 #endif
3898
3899 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
3900                            void *data, u16 data_len)
3901 {
3902         struct mgmt_cp_set_exp_feature *cp = data;
3903         struct mgmt_rp_set_exp_feature rp;
3904
3905         bt_dev_dbg(hdev, "sock %p", sk);
3906
3907         if (!memcmp(cp->uuid, ZERO_KEY, 16)) {
3908                 memset(rp.uuid, 0, 16);
3909                 rp.flags = cpu_to_le32(0);
3910
3911 #ifdef CONFIG_BT_FEATURE_DEBUG
3912                 if (!hdev) {
3913                         bool changed = bt_dbg_get();
3914
3915                         bt_dbg_set(false);
3916
3917                         if (changed)
3918                                 exp_debug_feature_changed(false, sk);
3919                 }
3920 #endif
3921
3922                 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3923                         bool changed = hci_dev_test_flag(hdev,
3924                                                          HCI_ENABLE_LL_PRIVACY);
3925
3926                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3927
3928                         if (changed)
3929                                 exp_ll_privacy_feature_changed(false, hdev, sk);
3930                 }
3931
3932                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3933
3934                 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3935                                          MGMT_OP_SET_EXP_FEATURE, 0,
3936                                          &rp, sizeof(rp));
3937         }
3938
3939 #ifdef CONFIG_BT_FEATURE_DEBUG
3940         if (!memcmp(cp->uuid, debug_uuid, 16)) {
3941                 bool val, changed;
3942                 int err;
3943
3944                 /* Command requires to use the non-controller index */
3945                 if (hdev)
3946                         return mgmt_cmd_status(sk, hdev->id,
3947                                                MGMT_OP_SET_EXP_FEATURE,
3948                                                MGMT_STATUS_INVALID_INDEX);
3949
3950                 /* Parameters are limited to a single octet */
3951                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3952                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3953                                                MGMT_OP_SET_EXP_FEATURE,
3954                                                MGMT_STATUS_INVALID_PARAMS);
3955
3956                 /* Only boolean on/off is supported */
3957                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3958                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3959                                                MGMT_OP_SET_EXP_FEATURE,
3960                                                MGMT_STATUS_INVALID_PARAMS);
3961
3962                 val = !!cp->param[0];
3963                 changed = val ? !bt_dbg_get() : bt_dbg_get();
3964                 bt_dbg_set(val);
3965
3966                 memcpy(rp.uuid, debug_uuid, 16);
3967                 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3968
3969                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3970
3971                 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3972                                         MGMT_OP_SET_EXP_FEATURE, 0,
3973                                         &rp, sizeof(rp));
3974
3975                 if (changed)
3976                         exp_debug_feature_changed(val, sk);
3977
3978                 return err;
3979         }
3980 #endif
3981
3982         if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) {
3983                 bool val, changed;
3984                 int err;
3985                 u32 flags;
3986
3987                 /* Command requires to use the controller index */
3988                 if (!hdev)
3989                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3990                                                MGMT_OP_SET_EXP_FEATURE,
3991                                                MGMT_STATUS_INVALID_INDEX);
3992
3993                 /* Changes can only be made when controller is powered down */
3994                 if (hdev_is_powered(hdev))
3995                         return mgmt_cmd_status(sk, hdev->id,
3996                                                MGMT_OP_SET_EXP_FEATURE,
3997                                                MGMT_STATUS_REJECTED);
3998
3999                 /* Parameters are limited to a single octet */
4000                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4001                         return mgmt_cmd_status(sk, hdev->id,
4002                                                MGMT_OP_SET_EXP_FEATURE,
4003                                                MGMT_STATUS_INVALID_PARAMS);
4004
4005                 /* Only boolean on/off is supported */
4006                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4007                         return mgmt_cmd_status(sk, hdev->id,
4008                                                MGMT_OP_SET_EXP_FEATURE,
4009                                                MGMT_STATUS_INVALID_PARAMS);
4010
4011                 val = !!cp->param[0];
4012
4013                 if (val) {
4014                         changed = !hci_dev_test_flag(hdev,
4015                                                      HCI_ENABLE_LL_PRIVACY);
4016                         hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4017                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4018
4019                         /* Enable LL privacy + supported settings changed */
4020                         flags = BIT(0) | BIT(1);
4021                 } else {
4022                         changed = hci_dev_test_flag(hdev,
4023                                                     HCI_ENABLE_LL_PRIVACY);
4024                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4025
4026                         /* Disable LL privacy + supported settings changed */
4027                         flags = BIT(1);
4028                 }
4029
4030                 memcpy(rp.uuid, rpa_resolution_uuid, 16);
4031                 rp.flags = cpu_to_le32(flags);
4032
4033                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4034
4035                 err = mgmt_cmd_complete(sk, hdev->id,
4036                                         MGMT_OP_SET_EXP_FEATURE, 0,
4037                                         &rp, sizeof(rp));
4038
4039                 if (changed)
4040                         exp_ll_privacy_feature_changed(val, hdev, sk);
4041
4042                 return err;
4043         }
4044
4045         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4046                                MGMT_OP_SET_EXP_FEATURE,
4047                                MGMT_STATUS_NOT_SUPPORTED);
4048 }
4049
4050 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4051
4052 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4053                             u16 data_len)
4054 {
4055         struct mgmt_cp_get_device_flags *cp = data;
4056         struct mgmt_rp_get_device_flags rp;
4057         struct bdaddr_list_with_flags *br_params;
4058         struct hci_conn_params *params;
4059         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4060         u32 current_flags = 0;
4061         u8 status = MGMT_STATUS_INVALID_PARAMS;
4062
4063         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4064                    &cp->addr.bdaddr, cp->addr.type);
4065
4066         hci_dev_lock(hdev);
4067
4068         memset(&rp, 0, sizeof(rp));
4069
4070         if (cp->addr.type == BDADDR_BREDR) {
4071                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4072                                                               &cp->addr.bdaddr,
4073                                                               cp->addr.type);
4074                 if (!br_params)
4075                         goto done;
4076
4077                 current_flags = br_params->current_flags;
4078         } else {
4079                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4080                                                 le_addr_type(cp->addr.type));
4081
4082                 if (!params)
4083                         goto done;
4084
4085                 current_flags = params->current_flags;
4086         }
4087
4088         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4089         rp.addr.type = cp->addr.type;
4090         rp.supported_flags = cpu_to_le32(supported_flags);
4091         rp.current_flags = cpu_to_le32(current_flags);
4092
4093         status = MGMT_STATUS_SUCCESS;
4094
4095 done:
4096         hci_dev_unlock(hdev);
4097
4098         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4099                                 &rp, sizeof(rp));
4100 }
4101
4102 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4103                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4104                                  u32 supported_flags, u32 current_flags)
4105 {
4106         struct mgmt_ev_device_flags_changed ev;
4107
4108         bacpy(&ev.addr.bdaddr, bdaddr);
4109         ev.addr.type = bdaddr_type;
4110         ev.supported_flags = cpu_to_le32(supported_flags);
4111         ev.current_flags = cpu_to_le32(current_flags);
4112
4113         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4114 }
4115
4116 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4117                             u16 len)
4118 {
4119         struct mgmt_cp_set_device_flags *cp = data;
4120         struct bdaddr_list_with_flags *br_params;
4121         struct hci_conn_params *params;
4122         u8 status = MGMT_STATUS_INVALID_PARAMS;
4123         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4124         u32 current_flags = __le32_to_cpu(cp->current_flags);
4125
4126         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4127                    &cp->addr.bdaddr, cp->addr.type,
4128                    __le32_to_cpu(current_flags));
4129
4130         if ((supported_flags | current_flags) != supported_flags) {
4131                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4132                             current_flags, supported_flags);
4133                 goto done;
4134         }
4135
4136         hci_dev_lock(hdev);
4137
4138         if (cp->addr.type == BDADDR_BREDR) {
4139                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4140                                                               &cp->addr.bdaddr,
4141                                                               cp->addr.type);
4142
4143                 if (br_params) {
4144                         br_params->current_flags = current_flags;
4145                         status = MGMT_STATUS_SUCCESS;
4146                 } else {
4147                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4148                                     &cp->addr.bdaddr, cp->addr.type);
4149                 }
4150         } else {
4151                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4152                                                 le_addr_type(cp->addr.type));
4153                 if (params) {
4154                         params->current_flags = current_flags;
4155                         status = MGMT_STATUS_SUCCESS;
4156                 } else {
4157                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4158                                     &cp->addr.bdaddr,
4159                                     le_addr_type(cp->addr.type));
4160                 }
4161         }
4162
4163 done:
4164         hci_dev_unlock(hdev);
4165
4166         if (status == MGMT_STATUS_SUCCESS)
4167                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4168                                      supported_flags, current_flags);
4169
4170         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4171                                  &cp->addr, sizeof(cp->addr));
4172 }
4173
4174 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4175                                    u16 handle)
4176 {
4177         struct mgmt_ev_adv_monitor_added ev;
4178
4179         ev.monitor_handle = cpu_to_le16(handle);
4180
4181         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4182 }
4183
4184 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4185 {
4186         struct mgmt_ev_adv_monitor_removed ev;
4187         struct mgmt_pending_cmd *cmd;
4188         struct sock *sk_skip = NULL;
4189         struct mgmt_cp_remove_adv_monitor *cp;
4190
4191         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4192         if (cmd) {
4193                 cp = cmd->param;
4194
4195                 if (cp->monitor_handle)
4196                         sk_skip = cmd->sk;
4197         }
4198
4199         ev.monitor_handle = cpu_to_le16(handle);
4200
4201         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4202 }
4203
4204 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4205                                  void *data, u16 len)
4206 {
4207         struct adv_monitor *monitor = NULL;
4208         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4209         int handle, err;
4210         size_t rp_size = 0;
4211         __u32 supported = 0;
4212         __u32 enabled = 0;
4213         __u16 num_handles = 0;
4214         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4215
4216         BT_DBG("request for %s", hdev->name);
4217
4218         hci_dev_lock(hdev);
4219
4220         if (msft_monitor_supported(hdev))
4221                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4222
4223         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4224                 handles[num_handles++] = monitor->handle;
4225
4226         hci_dev_unlock(hdev);
4227
4228         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4229         rp = kmalloc(rp_size, GFP_KERNEL);
4230         if (!rp)
4231                 return -ENOMEM;
4232
4233         /* All supported features are currently enabled */
4234         enabled = supported;
4235
4236         rp->supported_features = cpu_to_le32(supported);
4237         rp->enabled_features = cpu_to_le32(enabled);
4238         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4239         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4240         rp->num_handles = cpu_to_le16(num_handles);
4241         if (num_handles)
4242                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4243
4244         err = mgmt_cmd_complete(sk, hdev->id,
4245                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4246                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4247
4248         kfree(rp);
4249
4250         return err;
4251 }
4252
4253 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4254 {
4255         struct mgmt_rp_add_adv_patterns_monitor rp;
4256         struct mgmt_pending_cmd *cmd;
4257         struct adv_monitor *monitor;
4258         int err = 0;
4259
4260         hci_dev_lock(hdev);
4261
4262         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4263         if (!cmd) {
4264                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4265                 if (!cmd)
4266                         goto done;
4267         }
4268
4269         monitor = cmd->user_data;
4270         rp.monitor_handle = cpu_to_le16(monitor->handle);
4271
4272         if (!status) {
4273                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4274                 hdev->adv_monitors_cnt++;
4275                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4276                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4277                 hci_update_background_scan(hdev);
4278         }
4279
4280         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4281                                 mgmt_status(status), &rp, sizeof(rp));
4282         mgmt_pending_remove(cmd);
4283
4284 done:
4285         hci_dev_unlock(hdev);
4286         bt_dev_dbg(hdev, "add monitor %d complete, status %u",
4287                    rp.monitor_handle, status);
4288
4289         return err;
4290 }
4291
4292 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4293                                       struct adv_monitor *m, u8 status,
4294                                       void *data, u16 len, u16 op)
4295 {
4296         struct mgmt_rp_add_adv_patterns_monitor rp;
4297         struct mgmt_pending_cmd *cmd;
4298         int err;
4299         bool pending;
4300
4301         hci_dev_lock(hdev);
4302
4303         if (status)
4304                 goto unlock;
4305
4306         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4307             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4308             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4309             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4310                 status = MGMT_STATUS_BUSY;
4311                 goto unlock;
4312         }
4313
4314         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4315         if (!cmd) {
4316                 status = MGMT_STATUS_NO_RESOURCES;
4317                 goto unlock;
4318         }
4319
4320         cmd->user_data = m;
4321         pending = hci_add_adv_monitor(hdev, m, &err);
4322         if (err) {
4323                 if (err == -ENOSPC || err == -ENOMEM)
4324                         status = MGMT_STATUS_NO_RESOURCES;
4325                 else if (err == -EINVAL)
4326                         status = MGMT_STATUS_INVALID_PARAMS;
4327                 else
4328                         status = MGMT_STATUS_FAILED;
4329
4330                 mgmt_pending_remove(cmd);
4331                 goto unlock;
4332         }
4333
4334         if (!pending) {
4335                 mgmt_pending_remove(cmd);
4336                 rp.monitor_handle = cpu_to_le16(m->handle);
4337                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4338                 m->state = ADV_MONITOR_STATE_REGISTERED;
4339                 hdev->adv_monitors_cnt++;
4340
4341                 hci_dev_unlock(hdev);
4342                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4343                                          &rp, sizeof(rp));
4344         }
4345
4346         hci_dev_unlock(hdev);
4347
4348         return 0;
4349
4350 unlock:
4351         hci_free_adv_monitor(hdev, m);
4352         hci_dev_unlock(hdev);
4353         return mgmt_cmd_status(sk, hdev->id, op, status);
4354 }
4355
4356 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4357                                    struct mgmt_adv_rssi_thresholds *rssi)
4358 {
4359         if (rssi) {
4360                 m->rssi.low_threshold = rssi->low_threshold;
4361                 m->rssi.low_threshold_timeout =
4362                     __le16_to_cpu(rssi->low_threshold_timeout);
4363                 m->rssi.high_threshold = rssi->high_threshold;
4364                 m->rssi.high_threshold_timeout =
4365                     __le16_to_cpu(rssi->high_threshold_timeout);
4366                 m->rssi.sampling_period = rssi->sampling_period;
4367         } else {
4368                 /* Default values. These numbers are the least constricting
4369                  * parameters for MSFT API to work, so it behaves as if there
4370                  * are no rssi parameter to consider. May need to be changed
4371                  * if other API are to be supported.
4372                  */
4373                 m->rssi.low_threshold = -127;
4374                 m->rssi.low_threshold_timeout = 60;
4375                 m->rssi.high_threshold = -127;
4376                 m->rssi.high_threshold_timeout = 0;
4377                 m->rssi.sampling_period = 0;
4378         }
4379 }
4380
4381 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4382                                     struct mgmt_adv_pattern *patterns)
4383 {
4384         u8 offset = 0, length = 0;
4385         struct adv_pattern *p = NULL;
4386         int i;
4387
4388         for (i = 0; i < pattern_count; i++) {
4389                 offset = patterns[i].offset;
4390                 length = patterns[i].length;
4391                 if (offset >= HCI_MAX_AD_LENGTH ||
4392                     length > HCI_MAX_AD_LENGTH ||
4393                     (offset + length) > HCI_MAX_AD_LENGTH)
4394                         return MGMT_STATUS_INVALID_PARAMS;
4395
4396                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4397                 if (!p)
4398                         return MGMT_STATUS_NO_RESOURCES;
4399
4400                 p->ad_type = patterns[i].ad_type;
4401                 p->offset = patterns[i].offset;
4402                 p->length = patterns[i].length;
4403                 memcpy(p->value, patterns[i].value, p->length);
4404
4405                 INIT_LIST_HEAD(&p->list);
4406                 list_add(&p->list, &m->patterns);
4407         }
4408
4409         return MGMT_STATUS_SUCCESS;
4410 }
4411
4412 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4413                                     void *data, u16 len)
4414 {
4415         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4416         struct adv_monitor *m = NULL;
4417         u8 status = MGMT_STATUS_SUCCESS;
4418         size_t expected_size = sizeof(*cp);
4419
4420         BT_DBG("request for %s", hdev->name);
4421
4422         if (len <= sizeof(*cp)) {
4423                 status = MGMT_STATUS_INVALID_PARAMS;
4424                 goto done;
4425         }
4426
4427         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4428         if (len != expected_size) {
4429                 status = MGMT_STATUS_INVALID_PARAMS;
4430                 goto done;
4431         }
4432
4433         m = kzalloc(sizeof(*m), GFP_KERNEL);
4434         if (!m) {
4435                 status = MGMT_STATUS_NO_RESOURCES;
4436                 goto done;
4437         }
4438
4439         INIT_LIST_HEAD(&m->patterns);
4440
4441         parse_adv_monitor_rssi(m, NULL);
4442         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4443
4444 done:
4445         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4446                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4447 }
4448
4449 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4450                                          void *data, u16 len)
4451 {
4452         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4453         struct adv_monitor *m = NULL;
4454         u8 status = MGMT_STATUS_SUCCESS;
4455         size_t expected_size = sizeof(*cp);
4456
4457         BT_DBG("request for %s", hdev->name);
4458
4459         if (len <= sizeof(*cp)) {
4460                 status = MGMT_STATUS_INVALID_PARAMS;
4461                 goto done;
4462         }
4463
4464         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4465         if (len != expected_size) {
4466                 status = MGMT_STATUS_INVALID_PARAMS;
4467                 goto done;
4468         }
4469
4470         m = kzalloc(sizeof(*m), GFP_KERNEL);
4471         if (!m) {
4472                 status = MGMT_STATUS_NO_RESOURCES;
4473                 goto done;
4474         }
4475
4476         INIT_LIST_HEAD(&m->patterns);
4477
4478         parse_adv_monitor_rssi(m, &cp->rssi);
4479         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4480
4481 done:
4482         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4483                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4484 }
4485
4486 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4487 {
4488         struct mgmt_rp_remove_adv_monitor rp;
4489         struct mgmt_cp_remove_adv_monitor *cp;
4490         struct mgmt_pending_cmd *cmd;
4491         int err = 0;
4492
4493         hci_dev_lock(hdev);
4494
4495         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4496         if (!cmd)
4497                 goto done;
4498
4499         cp = cmd->param;
4500         rp.monitor_handle = cp->monitor_handle;
4501
4502         if (!status)
4503                 hci_update_background_scan(hdev);
4504
4505         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4506                                 mgmt_status(status), &rp, sizeof(rp));
4507         mgmt_pending_remove(cmd);
4508
4509 done:
4510         hci_dev_unlock(hdev);
4511         bt_dev_dbg(hdev, "remove monitor %d complete, status %u",
4512                    rp.monitor_handle, status);
4513
4514         return err;
4515 }
4516
4517 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4518                               void *data, u16 len)
4519 {
4520         struct mgmt_cp_remove_adv_monitor *cp = data;
4521         struct mgmt_rp_remove_adv_monitor rp;
4522         struct mgmt_pending_cmd *cmd;
4523         u16 handle = __le16_to_cpu(cp->monitor_handle);
4524         int err, status;
4525         bool pending;
4526
4527         BT_DBG("request for %s", hdev->name);
4528         rp.monitor_handle = cp->monitor_handle;
4529
4530         hci_dev_lock(hdev);
4531
4532         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4533             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4534             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4535             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4536                 status = MGMT_STATUS_BUSY;
4537                 goto unlock;
4538         }
4539
4540         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4541         if (!cmd) {
4542                 status = MGMT_STATUS_NO_RESOURCES;
4543                 goto unlock;
4544         }
4545
4546         if (handle)
4547                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4548         else
4549                 pending = hci_remove_all_adv_monitor(hdev, &err);
4550
4551         if (err) {
4552                 mgmt_pending_remove(cmd);
4553
4554                 if (err == -ENOENT)
4555                         status = MGMT_STATUS_INVALID_INDEX;
4556                 else
4557                         status = MGMT_STATUS_FAILED;
4558
4559                 goto unlock;
4560         }
4561
4562         /* monitor can be removed without forwarding request to controller */
4563         if (!pending) {
4564                 mgmt_pending_remove(cmd);
4565                 hci_dev_unlock(hdev);
4566
4567                 return mgmt_cmd_complete(sk, hdev->id,
4568                                          MGMT_OP_REMOVE_ADV_MONITOR,
4569                                          MGMT_STATUS_SUCCESS,
4570                                          &rp, sizeof(rp));
4571         }
4572
4573         hci_dev_unlock(hdev);
4574         return 0;
4575
4576 unlock:
4577         hci_dev_unlock(hdev);
4578         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4579                                status);
4580 }
4581
4582 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4583                                          u16 opcode, struct sk_buff *skb)
4584 {
4585         struct mgmt_rp_read_local_oob_data mgmt_rp;
4586         size_t rp_size = sizeof(mgmt_rp);
4587         struct mgmt_pending_cmd *cmd;
4588
4589         bt_dev_dbg(hdev, "status %u", status);
4590
4591         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4592         if (!cmd)
4593                 return;
4594
4595         if (status || !skb) {
4596                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4597                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4598                 goto remove;
4599         }
4600
4601         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4602
4603         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4604                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4605
4606                 if (skb->len < sizeof(*rp)) {
4607                         mgmt_cmd_status(cmd->sk, hdev->id,
4608                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4609                                         MGMT_STATUS_FAILED);
4610                         goto remove;
4611                 }
4612
4613                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4614                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4615
4616                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4617         } else {
4618                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4619
4620                 if (skb->len < sizeof(*rp)) {
4621                         mgmt_cmd_status(cmd->sk, hdev->id,
4622                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4623                                         MGMT_STATUS_FAILED);
4624                         goto remove;
4625                 }
4626
4627                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4628                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4629
4630                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4631                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4632         }
4633
4634         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4635                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4636
4637 remove:
4638         mgmt_pending_remove(cmd);
4639 }
4640
4641 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4642                                void *data, u16 data_len)
4643 {
4644         struct mgmt_pending_cmd *cmd;
4645         struct hci_request req;
4646         int err;
4647
4648         bt_dev_dbg(hdev, "sock %p", sk);
4649
4650         hci_dev_lock(hdev);
4651
4652         if (!hdev_is_powered(hdev)) {
4653                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4654                                       MGMT_STATUS_NOT_POWERED);
4655                 goto unlock;
4656         }
4657
4658         if (!lmp_ssp_capable(hdev)) {
4659                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4660                                       MGMT_STATUS_NOT_SUPPORTED);
4661                 goto unlock;
4662         }
4663
4664         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4665                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4666                                       MGMT_STATUS_BUSY);
4667                 goto unlock;
4668         }
4669
4670         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4671         if (!cmd) {
4672                 err = -ENOMEM;
4673                 goto unlock;
4674         }
4675
4676         hci_req_init(&req, hdev);
4677
4678         if (bredr_sc_enabled(hdev))
4679                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4680         else
4681                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4682
4683         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4684         if (err < 0)
4685                 mgmt_pending_remove(cmd);
4686
4687 unlock:
4688         hci_dev_unlock(hdev);
4689         return err;
4690 }
4691
4692 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4693                                void *data, u16 len)
4694 {
4695         struct mgmt_addr_info *addr = data;
4696         int err;
4697
4698         bt_dev_dbg(hdev, "sock %p", sk);
4699
4700         if (!bdaddr_type_is_valid(addr->type))
4701                 return mgmt_cmd_complete(sk, hdev->id,
4702                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4703                                          MGMT_STATUS_INVALID_PARAMS,
4704                                          addr, sizeof(*addr));
4705
4706         hci_dev_lock(hdev);
4707
4708         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4709                 struct mgmt_cp_add_remote_oob_data *cp = data;
4710                 u8 status;
4711
4712                 if (cp->addr.type != BDADDR_BREDR) {
4713                         err = mgmt_cmd_complete(sk, hdev->id,
4714                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4715                                                 MGMT_STATUS_INVALID_PARAMS,
4716                                                 &cp->addr, sizeof(cp->addr));
4717                         goto unlock;
4718                 }
4719
4720                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4721                                               cp->addr.type, cp->hash,
4722                                               cp->rand, NULL, NULL);
4723                 if (err < 0)
4724                         status = MGMT_STATUS_FAILED;
4725                 else
4726                         status = MGMT_STATUS_SUCCESS;
4727
4728                 err = mgmt_cmd_complete(sk, hdev->id,
4729                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4730                                         &cp->addr, sizeof(cp->addr));
4731         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4732                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4733                 u8 *rand192, *hash192, *rand256, *hash256;
4734                 u8 status;
4735
4736                 if (bdaddr_type_is_le(cp->addr.type)) {
4737                         /* Enforce zero-valued 192-bit parameters as
4738                          * long as legacy SMP OOB isn't implemented.
4739                          */
4740                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4741                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4742                                 err = mgmt_cmd_complete(sk, hdev->id,
4743                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4744                                                         MGMT_STATUS_INVALID_PARAMS,
4745                                                         addr, sizeof(*addr));
4746                                 goto unlock;
4747                         }
4748
4749                         rand192 = NULL;
4750                         hash192 = NULL;
4751                 } else {
4752                         /* In case one of the P-192 values is set to zero,
4753                          * then just disable OOB data for P-192.
4754                          */
4755                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4756                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4757                                 rand192 = NULL;
4758                                 hash192 = NULL;
4759                         } else {
4760                                 rand192 = cp->rand192;
4761                                 hash192 = cp->hash192;
4762                         }
4763                 }
4764
4765                 /* In case one of the P-256 values is set to zero, then just
4766                  * disable OOB data for P-256.
4767                  */
4768                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4769                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4770                         rand256 = NULL;
4771                         hash256 = NULL;
4772                 } else {
4773                         rand256 = cp->rand256;
4774                         hash256 = cp->hash256;
4775                 }
4776
4777                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4778                                               cp->addr.type, hash192, rand192,
4779                                               hash256, rand256);
4780                 if (err < 0)
4781                         status = MGMT_STATUS_FAILED;
4782                 else
4783                         status = MGMT_STATUS_SUCCESS;
4784
4785                 err = mgmt_cmd_complete(sk, hdev->id,
4786                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4787                                         status, &cp->addr, sizeof(cp->addr));
4788         } else {
4789                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4790                            len);
4791                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4792                                       MGMT_STATUS_INVALID_PARAMS);
4793         }
4794
4795 unlock:
4796         hci_dev_unlock(hdev);
4797         return err;
4798 }
4799
4800 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4801                                   void *data, u16 len)
4802 {
4803         struct mgmt_cp_remove_remote_oob_data *cp = data;
4804         u8 status;
4805         int err;
4806
4807         bt_dev_dbg(hdev, "sock %p", sk);
4808
4809         if (cp->addr.type != BDADDR_BREDR)
4810                 return mgmt_cmd_complete(sk, hdev->id,
4811                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4812                                          MGMT_STATUS_INVALID_PARAMS,
4813                                          &cp->addr, sizeof(cp->addr));
4814
4815         hci_dev_lock(hdev);
4816
4817         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4818                 hci_remote_oob_data_clear(hdev);
4819                 status = MGMT_STATUS_SUCCESS;
4820                 goto done;
4821         }
4822
4823         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4824         if (err < 0)
4825                 status = MGMT_STATUS_INVALID_PARAMS;
4826         else
4827                 status = MGMT_STATUS_SUCCESS;
4828
4829 done:
4830         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4831                                 status, &cp->addr, sizeof(cp->addr));
4832
4833         hci_dev_unlock(hdev);
4834         return err;
4835 }
4836
4837 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4838 {
4839         struct mgmt_pending_cmd *cmd;
4840
4841         bt_dev_dbg(hdev, "status %u", status);
4842
4843         hci_dev_lock(hdev);
4844
4845         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4846         if (!cmd)
4847                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4848
4849         if (!cmd)
4850                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4851
4852         if (cmd) {
4853                 cmd->cmd_complete(cmd, mgmt_status(status));
4854                 mgmt_pending_remove(cmd);
4855         }
4856
4857         hci_dev_unlock(hdev);
4858
4859         /* Handle suspend notifier */
4860         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4861                                hdev->suspend_tasks)) {
4862                 bt_dev_dbg(hdev, "Unpaused discovery");
4863                 wake_up(&hdev->suspend_wait_q);
4864         }
4865 }
4866
4867 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4868                                     uint8_t *mgmt_status)
4869 {
4870         switch (type) {
4871         case DISCOV_TYPE_LE:
4872                 *mgmt_status = mgmt_le_support(hdev);
4873                 if (*mgmt_status)
4874                         return false;
4875                 break;
4876         case DISCOV_TYPE_INTERLEAVED:
4877                 *mgmt_status = mgmt_le_support(hdev);
4878                 if (*mgmt_status)
4879                         return false;
4880                 fallthrough;
4881         case DISCOV_TYPE_BREDR:
4882                 *mgmt_status = mgmt_bredr_support(hdev);
4883                 if (*mgmt_status)
4884                         return false;
4885                 break;
4886         default:
4887                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4888                 return false;
4889         }
4890
4891         return true;
4892 }
4893
4894 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4895                                     u16 op, void *data, u16 len)
4896 {
4897         struct mgmt_cp_start_discovery *cp = data;
4898         struct mgmt_pending_cmd *cmd;
4899         u8 status;
4900         int err;
4901
4902         bt_dev_dbg(hdev, "sock %p", sk);
4903
4904         hci_dev_lock(hdev);
4905
4906         if (!hdev_is_powered(hdev)) {
4907                 err = mgmt_cmd_complete(sk, hdev->id, op,
4908                                         MGMT_STATUS_NOT_POWERED,
4909                                         &cp->type, sizeof(cp->type));
4910                 goto failed;
4911         }
4912
4913         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4914             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4915                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4916                                         &cp->type, sizeof(cp->type));
4917                 goto failed;
4918         }
4919
4920         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4921                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4922                                         &cp->type, sizeof(cp->type));
4923                 goto failed;
4924         }
4925
4926         /* Can't start discovery when it is paused */
4927         if (hdev->discovery_paused) {
4928                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4929                                         &cp->type, sizeof(cp->type));
4930                 goto failed;
4931         }
4932
4933         /* Clear the discovery filter first to free any previously
4934          * allocated memory for the UUID list.
4935          */
4936         hci_discovery_filter_clear(hdev);
4937
4938         hdev->discovery.type = cp->type;
4939         hdev->discovery.report_invalid_rssi = false;
4940         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4941                 hdev->discovery.limited = true;
4942         else
4943                 hdev->discovery.limited = false;
4944
4945         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4946         if (!cmd) {
4947                 err = -ENOMEM;
4948                 goto failed;
4949         }
4950
4951         cmd->cmd_complete = generic_cmd_complete;
4952
4953         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4954         queue_work(hdev->req_workqueue, &hdev->discov_update);
4955         err = 0;
4956
4957 failed:
4958         hci_dev_unlock(hdev);
4959         return err;
4960 }
4961
4962 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4963                            void *data, u16 len)
4964 {
4965         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4966                                         data, len);
4967 }
4968
4969 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
4970                                    void *data, u16 len)
4971 {
4972         return start_discovery_internal(sk, hdev,
4973                                         MGMT_OP_START_LIMITED_DISCOVERY,
4974                                         data, len);
4975 }
4976
4977 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4978                                           u8 status)
4979 {
4980         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4981                                  cmd->param, 1);
4982 }
4983
4984 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4985                                    void *data, u16 len)
4986 {
4987         struct mgmt_cp_start_service_discovery *cp = data;
4988         struct mgmt_pending_cmd *cmd;
4989         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4990         u16 uuid_count, expected_len;
4991         u8 status;
4992         int err;
4993
4994         bt_dev_dbg(hdev, "sock %p", sk);
4995
4996         hci_dev_lock(hdev);
4997
4998         if (!hdev_is_powered(hdev)) {
4999                 err = mgmt_cmd_complete(sk, hdev->id,
5000                                         MGMT_OP_START_SERVICE_DISCOVERY,
5001                                         MGMT_STATUS_NOT_POWERED,
5002                                         &cp->type, sizeof(cp->type));
5003                 goto failed;
5004         }
5005
5006         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5007             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5008                 err = mgmt_cmd_complete(sk, hdev->id,
5009                                         MGMT_OP_START_SERVICE_DISCOVERY,
5010                                         MGMT_STATUS_BUSY, &cp->type,
5011                                         sizeof(cp->type));
5012                 goto failed;
5013         }
5014
5015         if (hdev->discovery_paused) {
5016                 err = mgmt_cmd_complete(sk, hdev->id,
5017                                         MGMT_OP_START_SERVICE_DISCOVERY,
5018                                         MGMT_STATUS_BUSY, &cp->type,
5019                                         sizeof(cp->type));
5020                 goto failed;
5021         }
5022
5023         uuid_count = __le16_to_cpu(cp->uuid_count);
5024         if (uuid_count > max_uuid_count) {
5025                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5026                            uuid_count);
5027                 err = mgmt_cmd_complete(sk, hdev->id,
5028                                         MGMT_OP_START_SERVICE_DISCOVERY,
5029                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5030                                         sizeof(cp->type));
5031                 goto failed;
5032         }
5033
5034         expected_len = sizeof(*cp) + uuid_count * 16;
5035         if (expected_len != len) {
5036                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5037                            expected_len, len);
5038                 err = mgmt_cmd_complete(sk, hdev->id,
5039                                         MGMT_OP_START_SERVICE_DISCOVERY,
5040                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5041                                         sizeof(cp->type));
5042                 goto failed;
5043         }
5044
5045         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5046                 err = mgmt_cmd_complete(sk, hdev->id,
5047                                         MGMT_OP_START_SERVICE_DISCOVERY,
5048                                         status, &cp->type, sizeof(cp->type));
5049                 goto failed;
5050         }
5051
5052         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5053                                hdev, data, len);
5054         if (!cmd) {
5055                 err = -ENOMEM;
5056                 goto failed;
5057         }
5058
5059         cmd->cmd_complete = service_discovery_cmd_complete;
5060
5061         /* Clear the discovery filter first to free any previously
5062          * allocated memory for the UUID list.
5063          */
5064         hci_discovery_filter_clear(hdev);
5065
5066         hdev->discovery.result_filtering = true;
5067         hdev->discovery.type = cp->type;
5068         hdev->discovery.rssi = cp->rssi;
5069         hdev->discovery.uuid_count = uuid_count;
5070
5071         if (uuid_count > 0) {
5072                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5073                                                 GFP_KERNEL);
5074                 if (!hdev->discovery.uuids) {
5075                         err = mgmt_cmd_complete(sk, hdev->id,
5076                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5077                                                 MGMT_STATUS_FAILED,
5078                                                 &cp->type, sizeof(cp->type));
5079                         mgmt_pending_remove(cmd);
5080                         goto failed;
5081                 }
5082         }
5083
5084         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5085         queue_work(hdev->req_workqueue, &hdev->discov_update);
5086         err = 0;
5087
5088 failed:
5089         hci_dev_unlock(hdev);
5090         return err;
5091 }
5092
5093 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5094 {
5095         struct mgmt_pending_cmd *cmd;
5096
5097         bt_dev_dbg(hdev, "status %u", status);
5098
5099         hci_dev_lock(hdev);
5100
5101         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5102         if (cmd) {
5103                 cmd->cmd_complete(cmd, mgmt_status(status));
5104                 mgmt_pending_remove(cmd);
5105         }
5106
5107         hci_dev_unlock(hdev);
5108
5109         /* Handle suspend notifier */
5110         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5111                 bt_dev_dbg(hdev, "Paused discovery");
5112                 wake_up(&hdev->suspend_wait_q);
5113         }
5114 }
5115
5116 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5117                           u16 len)
5118 {
5119         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5120         struct mgmt_pending_cmd *cmd;
5121         int err;
5122
5123         bt_dev_dbg(hdev, "sock %p", sk);
5124
5125         hci_dev_lock(hdev);
5126
5127         if (!hci_discovery_active(hdev)) {
5128                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5129                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5130                                         sizeof(mgmt_cp->type));
5131                 goto unlock;
5132         }
5133
5134         if (hdev->discovery.type != mgmt_cp->type) {
5135                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5136                                         MGMT_STATUS_INVALID_PARAMS,
5137                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5138                 goto unlock;
5139         }
5140
5141         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5142         if (!cmd) {
5143                 err = -ENOMEM;
5144                 goto unlock;
5145         }
5146
5147         cmd->cmd_complete = generic_cmd_complete;
5148
5149         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5150         queue_work(hdev->req_workqueue, &hdev->discov_update);
5151         err = 0;
5152
5153 unlock:
5154         hci_dev_unlock(hdev);
5155         return err;
5156 }
5157
5158 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5159                         u16 len)
5160 {
5161         struct mgmt_cp_confirm_name *cp = data;
5162         struct inquiry_entry *e;
5163         int err;
5164
5165         bt_dev_dbg(hdev, "sock %p", sk);
5166
5167         hci_dev_lock(hdev);
5168
5169         if (!hci_discovery_active(hdev)) {
5170                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5171                                         MGMT_STATUS_FAILED, &cp->addr,
5172                                         sizeof(cp->addr));
5173                 goto failed;
5174         }
5175
5176         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5177         if (!e) {
5178                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5179                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5180                                         sizeof(cp->addr));
5181                 goto failed;
5182         }
5183
5184         if (cp->name_known) {
5185                 e->name_state = NAME_KNOWN;
5186                 list_del(&e->list);
5187         } else {
5188                 e->name_state = NAME_NEEDED;
5189                 hci_inquiry_cache_update_resolve(hdev, e);
5190         }
5191
5192         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5193                                 &cp->addr, sizeof(cp->addr));
5194
5195 failed:
5196         hci_dev_unlock(hdev);
5197         return err;
5198 }
5199
5200 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5201                         u16 len)
5202 {
5203         struct mgmt_cp_block_device *cp = data;
5204         u8 status;
5205         int err;
5206
5207         bt_dev_dbg(hdev, "sock %p", sk);
5208
5209         if (!bdaddr_type_is_valid(cp->addr.type))
5210                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5211                                          MGMT_STATUS_INVALID_PARAMS,
5212                                          &cp->addr, sizeof(cp->addr));
5213
5214         hci_dev_lock(hdev);
5215
5216         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
5217                                   cp->addr.type);
5218         if (err < 0) {
5219                 status = MGMT_STATUS_FAILED;
5220                 goto done;
5221         }
5222
5223         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5224                    sk);
5225         status = MGMT_STATUS_SUCCESS;
5226
5227 done:
5228         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5229                                 &cp->addr, sizeof(cp->addr));
5230
5231         hci_dev_unlock(hdev);
5232
5233         return err;
5234 }
5235
5236 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5237                           u16 len)
5238 {
5239         struct mgmt_cp_unblock_device *cp = data;
5240         u8 status;
5241         int err;
5242
5243         bt_dev_dbg(hdev, "sock %p", sk);
5244
5245         if (!bdaddr_type_is_valid(cp->addr.type))
5246                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5247                                          MGMT_STATUS_INVALID_PARAMS,
5248                                          &cp->addr, sizeof(cp->addr));
5249
5250         hci_dev_lock(hdev);
5251
5252         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5253                                   cp->addr.type);
5254         if (err < 0) {
5255                 status = MGMT_STATUS_INVALID_PARAMS;
5256                 goto done;
5257         }
5258
5259         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5260                    sk);
5261         status = MGMT_STATUS_SUCCESS;
5262
5263 done:
5264         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5265                                 &cp->addr, sizeof(cp->addr));
5266
5267         hci_dev_unlock(hdev);
5268
5269         return err;
5270 }
5271
5272 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5273                          u16 len)
5274 {
5275         struct mgmt_cp_set_device_id *cp = data;
5276         struct hci_request req;
5277         int err;
5278         __u16 source;
5279
5280         bt_dev_dbg(hdev, "sock %p", sk);
5281
5282         source = __le16_to_cpu(cp->source);
5283
5284         if (source > 0x0002)
5285                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5286                                        MGMT_STATUS_INVALID_PARAMS);
5287
5288         hci_dev_lock(hdev);
5289
5290         hdev->devid_source = source;
5291         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5292         hdev->devid_product = __le16_to_cpu(cp->product);
5293         hdev->devid_version = __le16_to_cpu(cp->version);
5294
5295         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5296                                 NULL, 0);
5297
5298         hci_req_init(&req, hdev);
5299         __hci_req_update_eir(&req);
5300         hci_req_run(&req, NULL);
5301
5302         hci_dev_unlock(hdev);
5303
5304         return err;
5305 }
5306
5307 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5308                                         u16 opcode)
5309 {
5310         bt_dev_dbg(hdev, "status %u", status);
5311 }
5312
5313 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5314                                      u16 opcode)
5315 {
5316         struct cmd_lookup match = { NULL, hdev };
5317         struct hci_request req;
5318         u8 instance;
5319         struct adv_info *adv_instance;
5320         int err;
5321
5322         hci_dev_lock(hdev);
5323
5324         if (status) {
5325                 u8 mgmt_err = mgmt_status(status);
5326
5327                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5328                                      cmd_status_rsp, &mgmt_err);
5329                 goto unlock;
5330         }
5331
5332         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5333                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5334         else
5335                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5336
5337         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5338                              &match);
5339
5340         new_settings(hdev, match.sk);
5341
5342         if (match.sk)
5343                 sock_put(match.sk);
5344
5345         /* Handle suspend notifier */
5346         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5347                                hdev->suspend_tasks)) {
5348                 bt_dev_dbg(hdev, "Paused advertising");
5349                 wake_up(&hdev->suspend_wait_q);
5350         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5351                                       hdev->suspend_tasks)) {
5352                 bt_dev_dbg(hdev, "Unpaused advertising");
5353                 wake_up(&hdev->suspend_wait_q);
5354         }
5355
5356         /* If "Set Advertising" was just disabled and instance advertising was
5357          * set up earlier, then re-enable multi-instance advertising.
5358          */
5359         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5360             list_empty(&hdev->adv_instances))
5361                 goto unlock;
5362
5363         instance = hdev->cur_adv_instance;
5364         if (!instance) {
5365                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5366                                                         struct adv_info, list);
5367                 if (!adv_instance)
5368                         goto unlock;
5369
5370                 instance = adv_instance->instance;
5371         }
5372
5373         hci_req_init(&req, hdev);
5374
5375         err = __hci_req_schedule_adv_instance(&req, instance, true);
5376
5377         if (!err)
5378                 err = hci_req_run(&req, enable_advertising_instance);
5379
5380         if (err)
5381                 bt_dev_err(hdev, "failed to re-configure advertising");
5382
5383 unlock:
5384         hci_dev_unlock(hdev);
5385 }
5386
5387 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5388                            u16 len)
5389 {
5390         struct mgmt_mode *cp = data;
5391         struct mgmt_pending_cmd *cmd;
5392         struct hci_request req;
5393         u8 val, status;
5394         int err;
5395
5396         bt_dev_dbg(hdev, "sock %p", sk);
5397
5398         status = mgmt_le_support(hdev);
5399         if (status)
5400                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5401                                        status);
5402
5403         /* Enabling the experimental LL Privay support disables support for
5404          * advertising.
5405          */
5406         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5407                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5408                                        MGMT_STATUS_NOT_SUPPORTED);
5409
5410         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5411                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5412                                        MGMT_STATUS_INVALID_PARAMS);
5413
5414         if (hdev->advertising_paused)
5415                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5416                                        MGMT_STATUS_BUSY);
5417
5418         hci_dev_lock(hdev);
5419
5420         val = !!cp->val;
5421
5422         /* The following conditions are ones which mean that we should
5423          * not do any HCI communication but directly send a mgmt
5424          * response to user space (after toggling the flag if
5425          * necessary).
5426          */
5427         if (!hdev_is_powered(hdev) ||
5428             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5429              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5430             hci_conn_num(hdev, LE_LINK) > 0 ||
5431             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5432              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5433                 bool changed;
5434
5435                 if (cp->val) {
5436                         hdev->cur_adv_instance = 0x00;
5437                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5438                         if (cp->val == 0x02)
5439                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5440                         else
5441                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5442                 } else {
5443                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5444                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5445                 }
5446
5447                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5448                 if (err < 0)
5449                         goto unlock;
5450
5451                 if (changed)
5452                         err = new_settings(hdev, sk);
5453
5454                 goto unlock;
5455         }
5456
5457         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5458             pending_find(MGMT_OP_SET_LE, hdev)) {
5459                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5460                                       MGMT_STATUS_BUSY);
5461                 goto unlock;
5462         }
5463
5464         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5465         if (!cmd) {
5466                 err = -ENOMEM;
5467                 goto unlock;
5468         }
5469
5470         hci_req_init(&req, hdev);
5471
5472         if (cp->val == 0x02)
5473                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5474         else
5475                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5476
5477         cancel_adv_timeout(hdev);
5478
5479         if (val) {
5480                 /* Switch to instance "0" for the Set Advertising setting.
5481                  * We cannot use update_[adv|scan_rsp]_data() here as the
5482                  * HCI_ADVERTISING flag is not yet set.
5483                  */
5484                 hdev->cur_adv_instance = 0x00;
5485
5486                 if (ext_adv_capable(hdev)) {
5487                         __hci_req_start_ext_adv(&req, 0x00);
5488                 } else {
5489                         __hci_req_update_adv_data(&req, 0x00);
5490                         __hci_req_update_scan_rsp_data(&req, 0x00);
5491                         __hci_req_enable_advertising(&req);
5492                 }
5493         } else {
5494                 __hci_req_disable_advertising(&req);
5495         }
5496
5497         err = hci_req_run(&req, set_advertising_complete);
5498         if (err < 0)
5499                 mgmt_pending_remove(cmd);
5500
5501 unlock:
5502         hci_dev_unlock(hdev);
5503         return err;
5504 }
5505
5506 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5507                               void *data, u16 len)
5508 {
5509         struct mgmt_cp_set_static_address *cp = data;
5510         int err;
5511
5512         bt_dev_dbg(hdev, "sock %p", sk);
5513
5514         if (!lmp_le_capable(hdev))
5515                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5516                                        MGMT_STATUS_NOT_SUPPORTED);
5517
5518         if (hdev_is_powered(hdev))
5519                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5520                                        MGMT_STATUS_REJECTED);
5521
5522         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5523                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5524                         return mgmt_cmd_status(sk, hdev->id,
5525                                                MGMT_OP_SET_STATIC_ADDRESS,
5526                                                MGMT_STATUS_INVALID_PARAMS);
5527
5528                 /* Two most significant bits shall be set */
5529                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5530                         return mgmt_cmd_status(sk, hdev->id,
5531                                                MGMT_OP_SET_STATIC_ADDRESS,
5532                                                MGMT_STATUS_INVALID_PARAMS);
5533         }
5534
5535         hci_dev_lock(hdev);
5536
5537         bacpy(&hdev->static_addr, &cp->bdaddr);
5538
5539         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5540         if (err < 0)
5541                 goto unlock;
5542
5543         err = new_settings(hdev, sk);
5544
5545 unlock:
5546         hci_dev_unlock(hdev);
5547         return err;
5548 }
5549
5550 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5551                            void *data, u16 len)
5552 {
5553         struct mgmt_cp_set_scan_params *cp = data;
5554         __u16 interval, window;
5555         int err;
5556
5557         bt_dev_dbg(hdev, "sock %p", sk);
5558
5559         if (!lmp_le_capable(hdev))
5560                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5561                                        MGMT_STATUS_NOT_SUPPORTED);
5562
5563         interval = __le16_to_cpu(cp->interval);
5564
5565         if (interval < 0x0004 || interval > 0x4000)
5566                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5567                                        MGMT_STATUS_INVALID_PARAMS);
5568
5569         window = __le16_to_cpu(cp->window);
5570
5571         if (window < 0x0004 || window > 0x4000)
5572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5573                                        MGMT_STATUS_INVALID_PARAMS);
5574
5575         if (window > interval)
5576                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5577                                        MGMT_STATUS_INVALID_PARAMS);
5578
5579         hci_dev_lock(hdev);
5580
5581         hdev->le_scan_interval = interval;
5582         hdev->le_scan_window = window;
5583
5584         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5585                                 NULL, 0);
5586
5587         /* If background scan is running, restart it so new parameters are
5588          * loaded.
5589          */
5590         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5591             hdev->discovery.state == DISCOVERY_STOPPED) {
5592                 struct hci_request req;
5593
5594                 hci_req_init(&req, hdev);
5595
5596                 hci_req_add_le_scan_disable(&req, false);
5597                 hci_req_add_le_passive_scan(&req);
5598
5599                 hci_req_run(&req, NULL);
5600         }
5601
5602         hci_dev_unlock(hdev);
5603
5604         return err;
5605 }
5606
5607 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5608                                       u16 opcode)
5609 {
5610         struct mgmt_pending_cmd *cmd;
5611
5612         bt_dev_dbg(hdev, "status 0x%02x", status);
5613
5614         hci_dev_lock(hdev);
5615
5616         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5617         if (!cmd)
5618                 goto unlock;
5619
5620         if (status) {
5621                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5622                                 mgmt_status(status));
5623         } else {
5624                 struct mgmt_mode *cp = cmd->param;
5625
5626                 if (cp->val)
5627                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5628                 else
5629                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5630
5631                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5632                 new_settings(hdev, cmd->sk);
5633         }
5634
5635         mgmt_pending_remove(cmd);
5636
5637 unlock:
5638         hci_dev_unlock(hdev);
5639 }
5640
5641 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5642                                 void *data, u16 len)
5643 {
5644         struct mgmt_mode *cp = data;
5645         struct mgmt_pending_cmd *cmd;
5646         struct hci_request req;
5647         int err;
5648
5649         bt_dev_dbg(hdev, "sock %p", sk);
5650
5651         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5652             hdev->hci_ver < BLUETOOTH_VER_1_2)
5653                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5654                                        MGMT_STATUS_NOT_SUPPORTED);
5655
5656         if (cp->val != 0x00 && cp->val != 0x01)
5657                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5658                                        MGMT_STATUS_INVALID_PARAMS);
5659
5660         hci_dev_lock(hdev);
5661
5662         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5663                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5664                                       MGMT_STATUS_BUSY);
5665                 goto unlock;
5666         }
5667
5668         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5669                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5670                                         hdev);
5671                 goto unlock;
5672         }
5673
5674         if (!hdev_is_powered(hdev)) {
5675                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5676                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5677                                         hdev);
5678                 new_settings(hdev, sk);
5679                 goto unlock;
5680         }
5681
5682         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5683                                data, len);
5684         if (!cmd) {
5685                 err = -ENOMEM;
5686                 goto unlock;
5687         }
5688
5689         hci_req_init(&req, hdev);
5690
5691         __hci_req_write_fast_connectable(&req, cp->val);
5692
5693         err = hci_req_run(&req, fast_connectable_complete);
5694         if (err < 0) {
5695                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5696                                       MGMT_STATUS_FAILED);
5697                 mgmt_pending_remove(cmd);
5698         }
5699
5700 unlock:
5701         hci_dev_unlock(hdev);
5702
5703         return err;
5704 }
5705
5706 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5707 {
5708         struct mgmt_pending_cmd *cmd;
5709
5710         bt_dev_dbg(hdev, "status 0x%02x", status);
5711
5712         hci_dev_lock(hdev);
5713
5714         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5715         if (!cmd)
5716                 goto unlock;
5717
5718         if (status) {
5719                 u8 mgmt_err = mgmt_status(status);
5720
5721                 /* We need to restore the flag if related HCI commands
5722                  * failed.
5723                  */
5724                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5725
5726                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5727         } else {
5728                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5729                 new_settings(hdev, cmd->sk);
5730         }
5731
5732         mgmt_pending_remove(cmd);
5733
5734 unlock:
5735         hci_dev_unlock(hdev);
5736 }
5737
5738 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5739 {
5740         struct mgmt_mode *cp = data;
5741         struct mgmt_pending_cmd *cmd;
5742         struct hci_request req;
5743         int err;
5744
5745         bt_dev_dbg(hdev, "sock %p", sk);
5746
5747         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5749                                        MGMT_STATUS_NOT_SUPPORTED);
5750
5751         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5752                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5753                                        MGMT_STATUS_REJECTED);
5754
5755         if (cp->val != 0x00 && cp->val != 0x01)
5756                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5757                                        MGMT_STATUS_INVALID_PARAMS);
5758
5759         hci_dev_lock(hdev);
5760
5761         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5762                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5763                 goto unlock;
5764         }
5765
5766         if (!hdev_is_powered(hdev)) {
5767                 if (!cp->val) {
5768                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5769                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5770                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5771                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5772                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5773                 }
5774
5775                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5776
5777                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5778                 if (err < 0)
5779                         goto unlock;
5780
5781                 err = new_settings(hdev, sk);
5782                 goto unlock;
5783         }
5784
5785         /* Reject disabling when powered on */
5786         if (!cp->val) {
5787                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5788                                       MGMT_STATUS_REJECTED);
5789                 goto unlock;
5790         } else {
5791                 /* When configuring a dual-mode controller to operate
5792                  * with LE only and using a static address, then switching
5793                  * BR/EDR back on is not allowed.
5794                  *
5795                  * Dual-mode controllers shall operate with the public
5796                  * address as its identity address for BR/EDR and LE. So
5797                  * reject the attempt to create an invalid configuration.
5798                  *
5799                  * The same restrictions applies when secure connections
5800                  * has been enabled. For BR/EDR this is a controller feature
5801                  * while for LE it is a host stack feature. This means that
5802                  * switching BR/EDR back on when secure connections has been
5803                  * enabled is not a supported transaction.
5804                  */
5805                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5806                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5807                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5808                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5809                                               MGMT_STATUS_REJECTED);
5810                         goto unlock;
5811                 }
5812         }
5813
5814         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5815                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5816                                       MGMT_STATUS_BUSY);
5817                 goto unlock;
5818         }
5819
5820         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5821         if (!cmd) {
5822                 err = -ENOMEM;
5823                 goto unlock;
5824         }
5825
5826         /* We need to flip the bit already here so that
5827          * hci_req_update_adv_data generates the correct flags.
5828          */
5829         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5830
5831         hci_req_init(&req, hdev);
5832
5833         __hci_req_write_fast_connectable(&req, false);
5834         __hci_req_update_scan(&req);
5835
5836         /* Since only the advertising data flags will change, there
5837          * is no need to update the scan response data.
5838          */
5839         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5840
5841         err = hci_req_run(&req, set_bredr_complete);
5842         if (err < 0)
5843                 mgmt_pending_remove(cmd);
5844
5845 unlock:
5846         hci_dev_unlock(hdev);
5847         return err;
5848 }
5849
5850 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5851 {
5852         struct mgmt_pending_cmd *cmd;
5853         struct mgmt_mode *cp;
5854
5855         bt_dev_dbg(hdev, "status %u", status);
5856
5857         hci_dev_lock(hdev);
5858
5859         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5860         if (!cmd)
5861                 goto unlock;
5862
5863         if (status) {
5864                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5865                                 mgmt_status(status));
5866                 goto remove;
5867         }
5868
5869         cp = cmd->param;
5870
5871         switch (cp->val) {
5872         case 0x00:
5873                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5874                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5875                 break;
5876         case 0x01:
5877                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5878                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5879                 break;
5880         case 0x02:
5881                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5882                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5883                 break;
5884         }
5885
5886         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5887         new_settings(hdev, cmd->sk);
5888
5889 remove:
5890         mgmt_pending_remove(cmd);
5891 unlock:
5892         hci_dev_unlock(hdev);
5893 }
5894
5895 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5896                            void *data, u16 len)
5897 {
5898         struct mgmt_mode *cp = data;
5899         struct mgmt_pending_cmd *cmd;
5900         struct hci_request req;
5901         u8 val;
5902         int err;
5903
5904         bt_dev_dbg(hdev, "sock %p", sk);
5905
5906         if (!lmp_sc_capable(hdev) &&
5907             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5908                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5909                                        MGMT_STATUS_NOT_SUPPORTED);
5910
5911         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5912             lmp_sc_capable(hdev) &&
5913             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5914                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5915                                        MGMT_STATUS_REJECTED);
5916
5917         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5918                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5919                                   MGMT_STATUS_INVALID_PARAMS);
5920
5921         hci_dev_lock(hdev);
5922
5923         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5924             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5925                 bool changed;
5926
5927                 if (cp->val) {
5928                         changed = !hci_dev_test_and_set_flag(hdev,
5929                                                              HCI_SC_ENABLED);
5930                         if (cp->val == 0x02)
5931                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5932                         else
5933                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5934                 } else {
5935                         changed = hci_dev_test_and_clear_flag(hdev,
5936                                                               HCI_SC_ENABLED);
5937                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5938                 }
5939
5940                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5941                 if (err < 0)
5942                         goto failed;
5943
5944                 if (changed)
5945                         err = new_settings(hdev, sk);
5946
5947                 goto failed;
5948         }
5949
5950         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5951                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5952                                       MGMT_STATUS_BUSY);
5953                 goto failed;
5954         }
5955
5956         val = !!cp->val;
5957
5958         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5959             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5960                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5961                 goto failed;
5962         }
5963
5964         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5965         if (!cmd) {
5966                 err = -ENOMEM;
5967                 goto failed;
5968         }
5969
5970         hci_req_init(&req, hdev);
5971         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5972         err = hci_req_run(&req, sc_enable_complete);
5973         if (err < 0) {
5974                 mgmt_pending_remove(cmd);
5975                 goto failed;
5976         }
5977
5978 failed:
5979         hci_dev_unlock(hdev);
5980         return err;
5981 }
5982
5983 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5984                           void *data, u16 len)
5985 {
5986         struct mgmt_mode *cp = data;
5987         bool changed, use_changed;
5988         int err;
5989
5990         bt_dev_dbg(hdev, "sock %p", sk);
5991
5992         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5993                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5994                                        MGMT_STATUS_INVALID_PARAMS);
5995
5996         hci_dev_lock(hdev);
5997
5998         if (cp->val)
5999                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6000         else
6001                 changed = hci_dev_test_and_clear_flag(hdev,
6002                                                       HCI_KEEP_DEBUG_KEYS);
6003
6004         if (cp->val == 0x02)
6005                 use_changed = !hci_dev_test_and_set_flag(hdev,
6006                                                          HCI_USE_DEBUG_KEYS);
6007         else
6008                 use_changed = hci_dev_test_and_clear_flag(hdev,
6009                                                           HCI_USE_DEBUG_KEYS);
6010
6011         if (hdev_is_powered(hdev) && use_changed &&
6012             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6013                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6014                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6015                              sizeof(mode), &mode);
6016         }
6017
6018         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6019         if (err < 0)
6020                 goto unlock;
6021
6022         if (changed)
6023                 err = new_settings(hdev, sk);
6024
6025 unlock:
6026         hci_dev_unlock(hdev);
6027         return err;
6028 }
6029
6030 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6031                        u16 len)
6032 {
6033         struct mgmt_cp_set_privacy *cp = cp_data;
6034         bool changed;
6035         int err;
6036
6037         bt_dev_dbg(hdev, "sock %p", sk);
6038
6039         if (!lmp_le_capable(hdev))
6040                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6041                                        MGMT_STATUS_NOT_SUPPORTED);
6042
6043         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6044                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6045                                        MGMT_STATUS_INVALID_PARAMS);
6046
6047 #ifndef TIZEN_BT
6048         /* commenting out since set privacy command is always rejected
6049          * if this condition is enabled.
6050          */
6051         if (hdev_is_powered(hdev))
6052                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6053                                        MGMT_STATUS_REJECTED);
6054 #endif
6055
6056         hci_dev_lock(hdev);
6057
6058         /* If user space supports this command it is also expected to
6059          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6060          */
6061         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6062
6063         if (cp->privacy) {
6064                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6065                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6066                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6067                 hci_adv_instances_set_rpa_expired(hdev, true);
6068                 if (cp->privacy == 0x02)
6069                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6070                 else
6071                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6072         } else {
6073                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6074                 memset(hdev->irk, 0, sizeof(hdev->irk));
6075                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6076                 hci_adv_instances_set_rpa_expired(hdev, false);
6077                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6078         }
6079
6080         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6081         if (err < 0)
6082                 goto unlock;
6083
6084         if (changed)
6085                 err = new_settings(hdev, sk);
6086
6087 unlock:
6088         hci_dev_unlock(hdev);
6089         return err;
6090 }
6091
6092 static bool irk_is_valid(struct mgmt_irk_info *irk)
6093 {
6094         switch (irk->addr.type) {
6095         case BDADDR_LE_PUBLIC:
6096                 return true;
6097
6098         case BDADDR_LE_RANDOM:
6099                 /* Two most significant bits shall be set */
6100                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6101                         return false;
6102                 return true;
6103         }
6104
6105         return false;
6106 }
6107
6108 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6109                      u16 len)
6110 {
6111         struct mgmt_cp_load_irks *cp = cp_data;
6112         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6113                                    sizeof(struct mgmt_irk_info));
6114         u16 irk_count, expected_len;
6115         int i, err;
6116
6117         bt_dev_dbg(hdev, "sock %p", sk);
6118
6119         if (!lmp_le_capable(hdev))
6120                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6121                                        MGMT_STATUS_NOT_SUPPORTED);
6122
6123         irk_count = __le16_to_cpu(cp->irk_count);
6124         if (irk_count > max_irk_count) {
6125                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6126                            irk_count);
6127                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6128                                        MGMT_STATUS_INVALID_PARAMS);
6129         }
6130
6131         expected_len = struct_size(cp, irks, irk_count);
6132         if (expected_len != len) {
6133                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6134                            expected_len, len);
6135                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6136                                        MGMT_STATUS_INVALID_PARAMS);
6137         }
6138
6139         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6140
6141         for (i = 0; i < irk_count; i++) {
6142                 struct mgmt_irk_info *key = &cp->irks[i];
6143
6144                 if (!irk_is_valid(key))
6145                         return mgmt_cmd_status(sk, hdev->id,
6146                                                MGMT_OP_LOAD_IRKS,
6147                                                MGMT_STATUS_INVALID_PARAMS);
6148         }
6149
6150         hci_dev_lock(hdev);
6151
6152         hci_smp_irks_clear(hdev);
6153
6154         for (i = 0; i < irk_count; i++) {
6155                 struct mgmt_irk_info *irk = &cp->irks[i];
6156
6157                 if (hci_is_blocked_key(hdev,
6158                                        HCI_BLOCKED_KEY_TYPE_IRK,
6159                                        irk->val)) {
6160                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6161                                     &irk->addr.bdaddr);
6162                         continue;
6163                 }
6164
6165                 hci_add_irk(hdev, &irk->addr.bdaddr,
6166                             le_addr_type(irk->addr.type), irk->val,
6167                             BDADDR_ANY);
6168         }
6169
6170         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6171
6172         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6173
6174         hci_dev_unlock(hdev);
6175
6176         return err;
6177 }
6178
6179 #ifdef TIZEN_BT
6180 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
6181                         void *data, u16 len)
6182 {
6183         struct mgmt_cp_set_advertising_params *cp = data;
6184         __u16 min_interval;
6185         __u16 max_interval;
6186         int err;
6187
6188         BT_DBG("%s", hdev->name);
6189
6190         if (!lmp_le_capable(hdev))
6191                 return mgmt_cmd_status(sk, hdev->id,
6192                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6193                                 MGMT_STATUS_NOT_SUPPORTED);
6194
6195         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6196                 return mgmt_cmd_status(sk, hdev->id,
6197                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6198                                 MGMT_STATUS_BUSY);
6199
6200         min_interval = __le16_to_cpu(cp->interval_min);
6201         max_interval = __le16_to_cpu(cp->interval_max);
6202
6203         if (min_interval > max_interval ||
6204             min_interval < 0x0020 || max_interval > 0x4000)
6205                 return mgmt_cmd_status(sk, hdev->id,
6206                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6207                                 MGMT_STATUS_INVALID_PARAMS);
6208
6209         hci_dev_lock(hdev);
6210
6211         hdev->le_adv_min_interval = min_interval;
6212         hdev->le_adv_max_interval = max_interval;
6213         hdev->adv_filter_policy = cp->filter_policy;
6214         hdev->adv_type = cp->type;
6215
6216         err = mgmt_cmd_complete(sk, hdev->id,
6217                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
6218
6219         hci_dev_unlock(hdev);
6220
6221         return err;
6222 }
6223
6224 static void set_advertising_data_complete(struct hci_dev *hdev,
6225                         u8 status, u16 opcode)
6226 {
6227         struct mgmt_cp_set_advertising_data *cp;
6228         struct mgmt_pending_cmd *cmd;
6229
6230         BT_DBG("status 0x%02x", status);
6231
6232         hci_dev_lock(hdev);
6233
6234         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
6235         if (!cmd)
6236                 goto unlock;
6237
6238         cp = cmd->param;
6239
6240         if (status)
6241                 mgmt_cmd_status(cmd->sk, hdev->id,
6242                                 MGMT_OP_SET_ADVERTISING_DATA,
6243                                 mgmt_status(status));
6244         else
6245                 mgmt_cmd_complete(cmd->sk, hdev->id,
6246                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
6247                                 cp, sizeof(*cp));
6248
6249         mgmt_pending_remove(cmd);
6250
6251 unlock:
6252         hci_dev_unlock(hdev);
6253 }
6254
6255 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
6256                         void *data, u16 len)
6257 {
6258         struct mgmt_pending_cmd *cmd;
6259         struct hci_request req;
6260         struct mgmt_cp_set_advertising_data *cp = data;
6261         struct hci_cp_le_set_adv_data adv;
6262         int err;
6263
6264         BT_DBG("%s", hdev->name);
6265
6266         if (!lmp_le_capable(hdev)) {
6267                 return mgmt_cmd_status(sk, hdev->id,
6268                                 MGMT_OP_SET_ADVERTISING_DATA,
6269                                 MGMT_STATUS_NOT_SUPPORTED);
6270         }
6271
6272         hci_dev_lock(hdev);
6273
6274         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
6275                 err = mgmt_cmd_status(sk, hdev->id,
6276                                 MGMT_OP_SET_ADVERTISING_DATA,
6277                                 MGMT_STATUS_BUSY);
6278                 goto unlocked;
6279         }
6280
6281         if (len > HCI_MAX_AD_LENGTH) {
6282                 err = mgmt_cmd_status(sk, hdev->id,
6283                                 MGMT_OP_SET_ADVERTISING_DATA,
6284                                 MGMT_STATUS_INVALID_PARAMS);
6285                 goto unlocked;
6286         }
6287
6288         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
6289                                hdev, data, len);
6290         if (!cmd) {
6291                 err = -ENOMEM;
6292                 goto unlocked;
6293         }
6294
6295         hci_req_init(&req, hdev);
6296
6297         memset(&adv, 0, sizeof(adv));
6298         memcpy(adv.data, cp->data, len);
6299         adv.length = len;
6300
6301         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
6302
6303         err = hci_req_run(&req, set_advertising_data_complete);
6304         if (err < 0)
6305                 mgmt_pending_remove(cmd);
6306
6307 unlocked:
6308         hci_dev_unlock(hdev);
6309
6310         return err;
6311 }
6312
6313 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
6314                         u16 opcode)
6315 {
6316         struct mgmt_cp_set_scan_rsp_data *cp;
6317         struct mgmt_pending_cmd *cmd;
6318
6319         BT_DBG("status 0x%02x", status);
6320
6321         hci_dev_lock(hdev);
6322
6323         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
6324         if (!cmd)
6325                 goto unlock;
6326
6327         cp = cmd->param;
6328
6329         if (status)
6330                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6331                                 mgmt_status(status));
6332         else
6333                 mgmt_cmd_complete(cmd->sk, hdev->id,
6334                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
6335                                 cp, sizeof(*cp));
6336
6337         mgmt_pending_remove(cmd);
6338
6339 unlock:
6340         hci_dev_unlock(hdev);
6341 }
6342
6343 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
6344                         u16 len)
6345 {
6346         struct mgmt_pending_cmd *cmd;
6347         struct hci_request req;
6348         struct mgmt_cp_set_scan_rsp_data *cp = data;
6349         struct hci_cp_le_set_scan_rsp_data rsp;
6350         int err;
6351
6352         BT_DBG("%s", hdev->name);
6353
6354         if (!lmp_le_capable(hdev))
6355                 return mgmt_cmd_status(sk, hdev->id,
6356                                 MGMT_OP_SET_SCAN_RSP_DATA,
6357                                 MGMT_STATUS_NOT_SUPPORTED);
6358
6359         hci_dev_lock(hdev);
6360
6361         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
6362                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6363                                 MGMT_STATUS_BUSY);
6364                 goto unlocked;
6365         }
6366
6367         if (len > HCI_MAX_AD_LENGTH) {
6368                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6369                                 MGMT_STATUS_INVALID_PARAMS);
6370                 goto unlocked;
6371         }
6372
6373         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
6374         if (!cmd) {
6375                 err = -ENOMEM;
6376                 goto unlocked;
6377         }
6378
6379         hci_req_init(&req, hdev);
6380
6381         memset(&rsp, 0, sizeof(rsp));
6382         memcpy(rsp.data, cp->data, len);
6383         rsp.length = len;
6384
6385         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
6386
6387         err = hci_req_run(&req, set_scan_rsp_data_complete);
6388         if (err < 0)
6389                 mgmt_pending_remove(cmd);
6390
6391 unlocked:
6392         hci_dev_unlock(hdev);
6393
6394         return err;
6395 }
6396
6397 /* Adv White List feature */
6398 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6399 {
6400         struct mgmt_cp_add_dev_white_list *cp;
6401         struct mgmt_pending_cmd *cmd;
6402
6403         BT_DBG("status 0x%02x", status);
6404
6405         hci_dev_lock(hdev);
6406
6407         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
6408         if (!cmd)
6409                 goto unlock;
6410
6411         cp = cmd->param;
6412
6413         if (status)
6414                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6415                            mgmt_status(status));
6416         else
6417                 mgmt_cmd_complete(cmd->sk, hdev->id,
6418                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
6419
6420         mgmt_pending_remove(cmd);
6421
6422 unlock:
6423         hci_dev_unlock(hdev);
6424 }
6425
6426 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
6427                            void *data, u16 len)
6428 {
6429         struct mgmt_pending_cmd *cmd;
6430         struct mgmt_cp_add_dev_white_list *cp = data;
6431         struct hci_request req;
6432         int err;
6433
6434         BT_DBG("%s", hdev->name);
6435
6436         if (!lmp_le_capable(hdev))
6437                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6438                                   MGMT_STATUS_NOT_SUPPORTED);
6439
6440         if (!hdev_is_powered(hdev))
6441                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6442                                   MGMT_STATUS_REJECTED);
6443
6444         hci_dev_lock(hdev);
6445
6446         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
6447                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6448                                 MGMT_STATUS_BUSY);
6449                 goto unlocked;
6450         }
6451
6452         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
6453         if (!cmd) {
6454                 err = -ENOMEM;
6455                 goto unlocked;
6456         }
6457
6458         hci_req_init(&req, hdev);
6459
6460         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
6461
6462         err = hci_req_run(&req, add_white_list_complete);
6463         if (err < 0) {
6464                 mgmt_pending_remove(cmd);
6465                 goto unlocked;
6466         }
6467
6468 unlocked:
6469         hci_dev_unlock(hdev);
6470
6471         return err;
6472 }
6473
6474 static void remove_from_white_list_complete(struct hci_dev *hdev,
6475                         u8 status, u16 opcode)
6476 {
6477         struct mgmt_cp_remove_dev_from_white_list *cp;
6478         struct mgmt_pending_cmd *cmd;
6479
6480         BT_DBG("status 0x%02x", status);
6481
6482         hci_dev_lock(hdev);
6483
6484         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
6485         if (!cmd)
6486                 goto unlock;
6487
6488         cp = cmd->param;
6489
6490         if (status)
6491                 mgmt_cmd_status(cmd->sk, hdev->id,
6492                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6493                         mgmt_status(status));
6494         else
6495                 mgmt_cmd_complete(cmd->sk, hdev->id,
6496                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
6497                         cp, sizeof(*cp));
6498
6499         mgmt_pending_remove(cmd);
6500
6501 unlock:
6502         hci_dev_unlock(hdev);
6503 }
6504
6505 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
6506                            void *data, u16 len)
6507 {
6508         struct mgmt_pending_cmd *cmd;
6509         struct mgmt_cp_remove_dev_from_white_list *cp = data;
6510         struct hci_request req;
6511         int err;
6512
6513         BT_DBG("%s", hdev->name);
6514
6515         if (!lmp_le_capable(hdev))
6516                 return mgmt_cmd_status(sk, hdev->id,
6517                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6518                                 MGMT_STATUS_NOT_SUPPORTED);
6519
6520         if (!hdev_is_powered(hdev))
6521                 return mgmt_cmd_status(sk, hdev->id,
6522                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6523                                 MGMT_STATUS_REJECTED);
6524
6525         hci_dev_lock(hdev);
6526
6527         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
6528                 err = mgmt_cmd_status(sk, hdev->id,
6529                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6530                                 MGMT_STATUS_BUSY);
6531                 goto unlocked;
6532         }
6533
6534         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6535                                 hdev, data, len);
6536         if (!cmd) {
6537                 err = -ENOMEM;
6538                 goto unlocked;
6539         }
6540
6541         hci_req_init(&req, hdev);
6542
6543         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
6544
6545         err = hci_req_run(&req, remove_from_white_list_complete);
6546         if (err < 0) {
6547                 mgmt_pending_remove(cmd);
6548                 goto unlocked;
6549         }
6550
6551 unlocked:
6552         hci_dev_unlock(hdev);
6553
6554         return err;
6555 }
6556
6557 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
6558                         u16 opcode)
6559 {
6560         struct mgmt_pending_cmd *cmd;
6561
6562         BT_DBG("status 0x%02x", status);
6563
6564         hci_dev_lock(hdev);
6565
6566         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
6567         if (!cmd)
6568                 goto unlock;
6569
6570         if (status)
6571                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6572                            mgmt_status(status));
6573         else
6574                 mgmt_cmd_complete(cmd->sk, hdev->id,
6575                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6576                                 0, NULL, 0);
6577
6578         mgmt_pending_remove(cmd);
6579
6580 unlock:
6581         hci_dev_unlock(hdev);
6582 }
6583
6584 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
6585                            void *data, u16 len)
6586 {
6587         struct mgmt_pending_cmd *cmd;
6588         struct hci_request req;
6589         int err;
6590
6591         BT_DBG("%s", hdev->name);
6592
6593         if (!lmp_le_capable(hdev))
6594                 return mgmt_cmd_status(sk, hdev->id,
6595                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6596                                 MGMT_STATUS_NOT_SUPPORTED);
6597
6598         if (!hdev_is_powered(hdev))
6599                 return mgmt_cmd_status(sk, hdev->id,
6600                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6601                                 MGMT_STATUS_REJECTED);
6602
6603         hci_dev_lock(hdev);
6604
6605         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
6606                 err = mgmt_cmd_status(sk, hdev->id,
6607                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6608                                 MGMT_STATUS_BUSY);
6609                 goto unlocked;
6610         }
6611
6612         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6613                                 hdev, NULL, 0);
6614         if (!cmd) {
6615                 err = -ENOMEM;
6616                 goto unlocked;
6617         }
6618
6619         hci_req_init(&req, hdev);
6620
6621         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
6622
6623         err = hci_req_run(&req, clear_white_list_complete);
6624         if (err < 0) {
6625                 mgmt_pending_remove(cmd);
6626                 goto unlocked;
6627         }
6628
6629 unlocked:
6630         hci_dev_unlock(hdev);
6631
6632         return err;
6633 }
6634
6635 static void set_rssi_threshold_complete(struct hci_dev *hdev,
6636                         u8 status, u16 opcode)
6637 {
6638         struct mgmt_pending_cmd *cmd;
6639
6640         BT_DBG("status 0x%02x", status);
6641
6642         hci_dev_lock(hdev);
6643
6644         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6645         if (!cmd)
6646                 goto unlock;
6647
6648         if (status)
6649                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6650                                 mgmt_status(status));
6651         else
6652                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6653                                 NULL, 0);
6654
6655         mgmt_pending_remove(cmd);
6656
6657 unlock:
6658         hci_dev_unlock(hdev);
6659 }
6660
6661 static void set_rssi_disable_complete(struct hci_dev *hdev,
6662                         u8 status, u16 opcode)
6663 {
6664         struct mgmt_pending_cmd *cmd;
6665
6666         BT_DBG("status 0x%02x", status);
6667
6668         hci_dev_lock(hdev);
6669
6670         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6671         if (!cmd)
6672                 goto unlock;
6673
6674         if (status)
6675                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6676                                 mgmt_status(status));
6677         else
6678                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6679                                 0, NULL, 0);
6680
6681         mgmt_pending_remove(cmd);
6682
6683 unlock:
6684         hci_dev_unlock(hdev);
6685 }
6686
6687 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6688                 void *data, u16 len)
6689 {
6690         int err = 0;
6691         struct hci_cp_set_rssi_threshold th = { 0, };
6692         struct mgmt_cp_set_enable_rssi *cp = data;
6693         struct hci_conn *conn;
6694         struct mgmt_pending_cmd *cmd;
6695         struct hci_request req;
6696         __u8 dest_type;
6697
6698         hci_dev_lock(hdev);
6699
6700         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6701         if (!cmd) {
6702                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6703                                 MGMT_STATUS_FAILED);
6704                 goto unlocked;
6705         }
6706
6707         if (!lmp_le_capable(hdev)) {
6708                 mgmt_pending_remove(cmd);
6709                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6710                                 MGMT_STATUS_NOT_SUPPORTED);
6711                 goto unlocked;
6712         }
6713
6714         if (!hdev_is_powered(hdev)) {
6715                 BT_DBG("%s", hdev->name);
6716                 mgmt_pending_remove(cmd);
6717                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6718                                 MGMT_STATUS_NOT_POWERED);
6719                 goto unlocked;
6720         }
6721
6722         if (cp->link_type == 0x01)
6723                 dest_type = LE_LINK;
6724         else
6725                 dest_type = ACL_LINK;
6726
6727         /* Get LE/ACL link handle info */
6728         conn = hci_conn_hash_lookup_ba(hdev,
6729                         dest_type, &cp->bdaddr);
6730
6731         if (!conn) {
6732                 err = mgmt_cmd_complete(sk, hdev->id,
6733                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6734                 mgmt_pending_remove(cmd);
6735                 goto unlocked;
6736         }
6737
6738         hci_req_init(&req, hdev);
6739
6740         th.hci_le_ext_opcode = 0x0B;
6741         th.mode = 0x01;
6742         th.conn_handle = conn->handle;
6743         th.alert_mask = 0x07;
6744         th.low_th = cp->low_th;
6745         th.in_range_th = cp->in_range_th;
6746         th.high_th = cp->high_th;
6747
6748         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6749         err = hci_req_run(&req, set_rssi_threshold_complete);
6750
6751         if (err < 0) {
6752                 mgmt_pending_remove(cmd);
6753                 BT_ERR("Error in requesting hci_req_run");
6754                 goto unlocked;
6755         }
6756
6757 unlocked:
6758         hci_dev_unlock(hdev);
6759         return err;
6760 }
6761
6762 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6763                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6764 {
6765         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6766         struct mgmt_cp_set_enable_rssi *cp = data;
6767         struct mgmt_pending_cmd *cmd;
6768
6769         if (!cp || !rp)
6770                 goto remove_cmd;
6771
6772         mgmt_rp.status = rp->status;
6773         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6774         mgmt_rp.bt_address = cp->bdaddr;
6775         mgmt_rp.link_type = cp->link_type;
6776
6777         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6778                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6779                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6780
6781         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6782                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6783
6784         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6785         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6786                         &mgmt_rp.bt_address, true);
6787
6788 remove_cmd:
6789         hci_dev_lock(hdev);
6790         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6791         if (cmd)
6792                 mgmt_pending_remove(cmd);
6793
6794         hci_dev_unlock(hdev);
6795 }
6796
6797 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6798                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6799 {
6800         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6801         struct mgmt_cp_disable_rssi *cp = data;
6802         struct mgmt_pending_cmd *cmd;
6803
6804         if (!cp || !rp)
6805                 goto remove_cmd;
6806
6807         mgmt_rp.status = rp->status;
6808         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6809         mgmt_rp.bt_address = cp->bdaddr;
6810         mgmt_rp.link_type = cp->link_type;
6811
6812         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6813                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6814                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6815
6816         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6817                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6818
6819         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6820                         &mgmt_rp.bt_address, false);
6821
6822 remove_cmd:
6823         hci_dev_lock(hdev);
6824         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6825         if (cmd)
6826                 mgmt_pending_remove(cmd);
6827
6828         hci_dev_unlock(hdev);
6829 }
6830
6831 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6832                 void *data, u16 len)
6833 {
6834         struct mgmt_pending_cmd *cmd;
6835         struct hci_request req;
6836         struct hci_cp_set_enable_rssi cp_en = { 0, };
6837         int err;
6838
6839         BT_DBG("Set Disable RSSI.");
6840
6841         cp_en.hci_le_ext_opcode = 0x01;
6842         cp_en.le_enable_cs_Features = 0x00;
6843         cp_en.data[0] = 0x00;
6844         cp_en.data[1] = 0x00;
6845         cp_en.data[2] = 0x00;
6846
6847         hci_dev_lock(hdev);
6848
6849         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6850         if (!cmd) {
6851                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6852                                 MGMT_STATUS_FAILED);
6853                 goto unlocked;
6854         }
6855
6856         if (!lmp_le_capable(hdev)) {
6857                 mgmt_pending_remove(cmd);
6858                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6859                                 MGMT_STATUS_NOT_SUPPORTED);
6860                 goto unlocked;
6861         }
6862
6863         if (!hdev_is_powered(hdev)) {
6864                 BT_DBG("%s", hdev->name);
6865                 mgmt_pending_remove(cmd);
6866                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6867                                 MGMT_STATUS_NOT_POWERED);
6868                 goto unlocked;
6869         }
6870
6871         hci_req_init(&req, hdev);
6872
6873         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6874                         sizeof(struct hci_cp_set_enable_rssi),
6875                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6876                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6877
6878         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6879         err = hci_req_run(&req, set_rssi_disable_complete);
6880
6881         if (err < 0) {
6882                 mgmt_pending_remove(cmd);
6883                 BT_ERR("Error in requesting hci_req_run");
6884                 goto unlocked;
6885         }
6886
6887 unlocked:
6888         hci_dev_unlock(hdev);
6889         return err;
6890 }
6891
6892 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6893 {
6894         struct hci_cc_rsp_enable_rssi *rp = response;
6895         struct mgmt_pending_cmd *cmd_enable = NULL;
6896         struct mgmt_pending_cmd *cmd_disable = NULL;
6897         struct mgmt_cp_set_enable_rssi *cp_en;
6898         struct mgmt_cp_disable_rssi *cp_dis;
6899
6900         hci_dev_lock(hdev);
6901         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6902         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6903         hci_dev_unlock(hdev);
6904
6905         if (cmd_enable)
6906                 BT_DBG("Enable Request");
6907
6908         if (cmd_disable)
6909                 BT_DBG("Disable Request");
6910
6911         if (cmd_enable) {
6912                 cp_en = cmd_enable->param;
6913
6914                 if (status != 0x00)
6915                         return;
6916
6917                 switch (rp->le_ext_opcode) {
6918                 case 0x01:
6919                         BT_DBG("RSSI enabled.. Setting Threshold...");
6920                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6921                                         cp_en, sizeof(*cp_en));
6922                         break;
6923
6924                 case 0x0B:
6925                         BT_DBG("Sending RSSI enable success");
6926                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6927                                         cp_en, rp, rp->status);
6928                         break;
6929                 }
6930
6931         } else if (cmd_disable) {
6932                 cp_dis = cmd_disable->param;
6933
6934                 if (status != 0x00)
6935                         return;
6936
6937                 switch (rp->le_ext_opcode) {
6938                 case 0x01:
6939                         BT_DBG("Sending RSSI disable success");
6940                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6941                                         cp_dis, rp, rp->status);
6942                         break;
6943
6944                 case 0x0B:
6945                         /*
6946                          * Only unset RSSI Threshold values for the Link if
6947                          * RSSI is monitored for other BREDR or LE Links
6948                          */
6949                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6950                                 BT_DBG("Unset Threshold. Other links being monitored");
6951                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6952                                                 cp_dis, rp, rp->status);
6953                         } else {
6954                                 BT_DBG("Unset Threshold. Disabling...");
6955                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6956                                                 cp_dis, sizeof(*cp_dis));
6957                         }
6958                         break;
6959                 }
6960         }
6961 }
6962
6963 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
6964                 u16 opcode)
6965 {
6966         struct mgmt_pending_cmd *cmd;
6967
6968         BT_DBG("status 0x%02x", status);
6969
6970         hci_dev_lock(hdev);
6971
6972         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6973         if (!cmd)
6974                 goto unlock;
6975
6976         if (status)
6977                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6978                                 mgmt_status(status));
6979         else
6980                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6981                                 NULL, 0);
6982
6983         mgmt_pending_remove(cmd);
6984
6985 unlock:
6986         hci_dev_unlock(hdev);
6987 }
6988
6989 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
6990                 void *data, u16 len)
6991 {
6992         struct mgmt_pending_cmd *cmd;
6993         struct hci_request req;
6994         struct mgmt_cp_set_enable_rssi *cp = data;
6995         struct hci_cp_set_enable_rssi cp_en = { 0, };
6996         int err;
6997
6998         BT_DBG("Set Enable RSSI.");
6999
7000         cp_en.hci_le_ext_opcode = 0x01;
7001         cp_en.le_enable_cs_Features = 0x04;
7002         cp_en.data[0] = 0x00;
7003         cp_en.data[1] = 0x00;
7004         cp_en.data[2] = 0x00;
7005
7006         hci_dev_lock(hdev);
7007
7008         if (!lmp_le_capable(hdev)) {
7009                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7010                                 MGMT_STATUS_NOT_SUPPORTED);
7011                 goto unlocked;
7012         }
7013
7014         if (!hdev_is_powered(hdev)) {
7015                 BT_DBG("%s", hdev->name);
7016                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7017                                 MGMT_STATUS_NOT_POWERED);
7018                 goto unlocked;
7019         }
7020
7021         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
7022                 BT_DBG("%s", hdev->name);
7023                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7024                                 MGMT_STATUS_BUSY);
7025                 goto unlocked;
7026         }
7027
7028         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
7029                         sizeof(*cp));
7030         if (!cmd) {
7031                 BT_DBG("%s", hdev->name);
7032                 err = -ENOMEM;
7033                 goto unlocked;
7034         }
7035
7036         /* If RSSI is already enabled directly set Threshold values */
7037         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
7038                 hci_dev_unlock(hdev);
7039                 BT_DBG("RSSI Enabled. Directly set Threshold");
7040                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
7041                 return err;
7042         }
7043
7044         hci_req_init(&req, hdev);
7045
7046         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7047                         sizeof(struct hci_cp_set_enable_rssi),
7048                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7049                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7050
7051         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7052         err = hci_req_run(&req, set_rssi_enable_complete);
7053
7054         if (err < 0) {
7055                 mgmt_pending_remove(cmd);
7056                 BT_ERR("Error in requesting hci_req_run");
7057                 goto unlocked;
7058         }
7059
7060 unlocked:
7061         hci_dev_unlock(hdev);
7062
7063         return err;
7064 }
7065
7066 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7067 {
7068         struct mgmt_pending_cmd *cmd;
7069
7070         BT_DBG("status 0x%02x", status);
7071
7072         hci_dev_lock(hdev);
7073
7074         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
7075         if (!cmd)
7076                 goto unlock;
7077
7078         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7079                         MGMT_STATUS_SUCCESS, &status, 1);
7080
7081         mgmt_pending_remove(cmd);
7082
7083 unlock:
7084         hci_dev_unlock(hdev);
7085 }
7086
7087 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
7088                         u16 len)
7089 {
7090         struct mgmt_pending_cmd *cmd;
7091         struct hci_request req;
7092         struct mgmt_cp_get_raw_rssi *cp = data;
7093         struct hci_cp_get_raw_rssi hci_cp;
7094
7095         struct hci_conn *conn;
7096         int err;
7097         __u8 dest_type;
7098
7099         BT_DBG("Get Raw RSSI.");
7100
7101         hci_dev_lock(hdev);
7102
7103         if (!lmp_le_capable(hdev)) {
7104                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7105                                 MGMT_STATUS_NOT_SUPPORTED);
7106                 goto unlocked;
7107         }
7108
7109         if (cp->link_type == 0x01)
7110                 dest_type = LE_LINK;
7111         else
7112                 dest_type = ACL_LINK;
7113
7114         /* Get LE/BREDR link handle info */
7115         conn = hci_conn_hash_lookup_ba(hdev,
7116                         dest_type, &cp->bt_address);
7117         if (!conn) {
7118                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7119                                                    MGMT_STATUS_NOT_CONNECTED);
7120                 goto unlocked;
7121         }
7122         hci_cp.conn_handle = conn->handle;
7123
7124         if (!hdev_is_powered(hdev)) {
7125                 BT_DBG("%s", hdev->name);
7126                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7127                                 MGMT_STATUS_NOT_POWERED);
7128                 goto unlocked;
7129         }
7130
7131         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
7132                 BT_DBG("%s", hdev->name);
7133                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7134                                 MGMT_STATUS_BUSY);
7135                 goto unlocked;
7136         }
7137
7138         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
7139         if (!cmd) {
7140                 BT_DBG("%s", hdev->name);
7141                 err = -ENOMEM;
7142                 goto unlocked;
7143         }
7144
7145         hci_req_init(&req, hdev);
7146
7147         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
7148         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
7149         err = hci_req_run(&req, get_raw_rssi_complete);
7150
7151         if (err < 0) {
7152                 mgmt_pending_remove(cmd);
7153                 BT_ERR("Error in requesting hci_req_run");
7154         }
7155
7156 unlocked:
7157         hci_dev_unlock(hdev);
7158
7159         return err;
7160 }
7161
7162 void mgmt_raw_rssi_response(struct hci_dev *hdev,
7163                 struct hci_cc_rp_get_raw_rssi *rp, int success)
7164 {
7165         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
7166         struct hci_conn *conn;
7167
7168         mgmt_rp.status = rp->status;
7169         mgmt_rp.rssi_dbm = rp->rssi_dbm;
7170
7171         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
7172         if (!conn)
7173                 return;
7174
7175         bacpy(&mgmt_rp.bt_address, &conn->dst);
7176         if (conn->type == LE_LINK)
7177                 mgmt_rp.link_type = 0x01;
7178         else
7179                 mgmt_rp.link_type = 0x00;
7180
7181         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
7182                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
7183 }
7184
7185 static void set_disable_threshold_complete(struct hci_dev *hdev,
7186                         u8 status, u16 opcode)
7187 {
7188         struct mgmt_pending_cmd *cmd;
7189
7190         BT_DBG("status 0x%02x", status);
7191
7192         hci_dev_lock(hdev);
7193
7194         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7195         if (!cmd)
7196                 goto unlock;
7197
7198         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7199                         MGMT_STATUS_SUCCESS, &status, 1);
7200
7201         mgmt_pending_remove(cmd);
7202
7203 unlock:
7204         hci_dev_unlock(hdev);
7205 }
7206
7207 /** Removes monitoring for a link*/
7208 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
7209                 void *data, u16 len)
7210 {
7211         int err = 0;
7212         struct hci_cp_set_rssi_threshold th = { 0, };
7213         struct mgmt_cp_disable_rssi *cp = data;
7214         struct hci_conn *conn;
7215         struct mgmt_pending_cmd *cmd;
7216         struct hci_request req;
7217         __u8 dest_type;
7218
7219         BT_DBG("Set Disable RSSI.");
7220
7221         hci_dev_lock(hdev);
7222
7223         if (!lmp_le_capable(hdev)) {
7224                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7225                                 MGMT_STATUS_NOT_SUPPORTED);
7226                 goto unlocked;
7227         }
7228
7229         /* Get LE/ACL link handle info*/
7230         if (cp->link_type == 0x01)
7231                 dest_type = LE_LINK;
7232         else
7233                 dest_type = ACL_LINK;
7234
7235         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
7236         if (!conn) {
7237                 err = mgmt_cmd_complete(sk, hdev->id,
7238                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
7239                 goto unlocked;
7240         }
7241
7242         th.hci_le_ext_opcode = 0x0B;
7243         th.mode = 0x01;
7244         th.conn_handle = conn->handle;
7245         th.alert_mask = 0x00;
7246         th.low_th = 0x00;
7247         th.in_range_th = 0x00;
7248         th.high_th = 0x00;
7249
7250         if (!hdev_is_powered(hdev)) {
7251                 BT_DBG("%s", hdev->name);
7252                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7253                                 0, data, len);
7254                 goto unlocked;
7255         }
7256
7257         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
7258                 BT_DBG("%s", hdev->name);
7259                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7260                                 MGMT_STATUS_BUSY);
7261                 goto unlocked;
7262         }
7263
7264         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
7265                         sizeof(*cp));
7266         if (!cmd) {
7267                 BT_DBG("%s", hdev->name);
7268                 err = -ENOMEM;
7269                 goto unlocked;
7270         }
7271
7272         hci_req_init(&req, hdev);
7273
7274         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7275         err = hci_req_run(&req, set_disable_threshold_complete);
7276         if (err < 0) {
7277                 mgmt_pending_remove(cmd);
7278                 BT_ERR("Error in requesting hci_req_run");
7279                 goto unlocked;
7280         }
7281
7282 unlocked:
7283         hci_dev_unlock(hdev);
7284
7285         return err;
7286 }
7287
7288 void mgmt_rssi_alert_evt(struct hci_dev *hdev, u16 conn_handle,
7289                 s8 alert_type, s8 rssi_dbm)
7290 {
7291         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
7292         struct hci_conn *conn;
7293
7294         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
7295                         conn_handle, alert_type, rssi_dbm);
7296
7297         conn = hci_conn_hash_lookup_handle(hdev, conn_handle);
7298
7299         if (!conn) {
7300                 BT_ERR("RSSI alert Error: Device not found for handle");
7301                 return;
7302         }
7303         bacpy(&mgmt_ev.bdaddr, &conn->dst);
7304
7305         if (conn->type == LE_LINK)
7306                 mgmt_ev.link_type = 0x01;
7307         else
7308                 mgmt_ev.link_type = 0x00;
7309
7310         mgmt_ev.alert_type = alert_type;
7311         mgmt_ev.rssi_dbm = rssi_dbm;
7312
7313         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
7314                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
7315                         NULL);
7316 }
7317
7318 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
7319 {
7320         struct mgmt_pending_cmd *cmd;
7321         u8 type;
7322         int err;
7323
7324         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7325
7326         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7327         if (!cmd)
7328                 return -ENOENT;
7329
7330         type = hdev->le_discovery.type;
7331
7332         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7333                                 mgmt_status(status), &type, sizeof(type));
7334         mgmt_pending_remove(cmd);
7335
7336         return err;
7337 }
7338
7339 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
7340                 u16 opcode)
7341 {
7342         unsigned long timeout = 0;
7343
7344         BT_DBG("status %d", status);
7345
7346         if (status) {
7347                 hci_dev_lock(hdev);
7348                 mgmt_start_le_discovery_failed(hdev, status);
7349                 hci_dev_unlock(hdev);
7350                 return;
7351         }
7352
7353         hci_dev_lock(hdev);
7354         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
7355         hci_dev_unlock(hdev);
7356
7357         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
7358                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
7359
7360         if (!timeout)
7361                 return;
7362
7363         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
7364 }
7365
7366 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
7367                 void *data, u16 len)
7368 {
7369         struct mgmt_cp_start_le_discovery *cp = data;
7370         struct mgmt_pending_cmd *cmd;
7371         struct hci_cp_le_set_scan_param param_cp;
7372         struct hci_cp_le_set_scan_enable enable_cp;
7373         struct hci_request req;
7374         u8 status, own_addr_type;
7375         int err;
7376
7377         BT_DBG("%s", hdev->name);
7378
7379         hci_dev_lock(hdev);
7380
7381         if (!hdev_is_powered(hdev)) {
7382                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7383                                 MGMT_STATUS_NOT_POWERED);
7384                 goto unlock;
7385         }
7386
7387         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
7388                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7389                                 MGMT_STATUS_BUSY);
7390                 goto unlock;
7391         }
7392
7393         if (cp->type != DISCOV_TYPE_LE) {
7394                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7395                                 MGMT_STATUS_INVALID_PARAMS);
7396                 goto unlock;
7397         }
7398
7399         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
7400         if (!cmd) {
7401                 err = -ENOMEM;
7402                 goto unlock;
7403         }
7404
7405         hdev->le_discovery.type = cp->type;
7406
7407         hci_req_init(&req, hdev);
7408
7409         status = mgmt_le_support(hdev);
7410         if (status) {
7411                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7412                                 status);
7413                 mgmt_pending_remove(cmd);
7414                 goto unlock;
7415         }
7416
7417         /* If controller is scanning, it means the background scanning
7418          * is running. Thus, we should temporarily stop it in order to
7419          * set the discovery scanning parameters.
7420          */
7421         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
7422                 hci_req_add_le_scan_disable(&req, false);
7423
7424         memset(&param_cp, 0, sizeof(param_cp));
7425
7426         /* All active scans will be done with either a resolvable
7427          * private address (when privacy feature has been enabled)
7428          * or unresolvable private address.
7429          */
7430         err = hci_update_random_address(&req, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
7431         if (err < 0) {
7432                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7433                                 MGMT_STATUS_FAILED);
7434                 mgmt_pending_remove(cmd);
7435                 goto unlock;
7436         }
7437
7438         param_cp.type = hdev->le_scan_type;
7439         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
7440         param_cp.window = cpu_to_le16(hdev->le_scan_window);
7441         param_cp.own_address_type = own_addr_type;
7442         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
7443                     &param_cp);
7444
7445         memset(&enable_cp, 0, sizeof(enable_cp));
7446         enable_cp.enable = LE_SCAN_ENABLE;
7447         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
7448
7449         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
7450                     &enable_cp);
7451
7452         err = hci_req_run(&req, start_le_discovery_complete);
7453         if (err < 0)
7454                 mgmt_pending_remove(cmd);
7455         else
7456                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
7457
7458 unlock:
7459         hci_dev_unlock(hdev);
7460         return err;
7461 }
7462
7463 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
7464 {
7465         struct mgmt_pending_cmd *cmd;
7466         int err;
7467
7468         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7469         if (!cmd)
7470                 return -ENOENT;
7471
7472         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7473                                 mgmt_status(status), &hdev->le_discovery.type,
7474                                 sizeof(hdev->le_discovery.type));
7475         mgmt_pending_remove(cmd);
7476
7477         return err;
7478 }
7479
7480 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
7481                 u16 opcode)
7482 {
7483         BT_DBG("status %d", status);
7484
7485         hci_dev_lock(hdev);
7486
7487         if (status) {
7488                 mgmt_stop_le_discovery_failed(hdev, status);
7489                 goto unlock;
7490         }
7491
7492         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7493
7494 unlock:
7495         hci_dev_unlock(hdev);
7496 }
7497
7498 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
7499                 void *data, u16 len)
7500 {
7501         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
7502         struct mgmt_pending_cmd *cmd;
7503         struct hci_request req;
7504         int err;
7505
7506         BT_DBG("%s", hdev->name);
7507
7508         hci_dev_lock(hdev);
7509
7510         if (!hci_le_discovery_active(hdev)) {
7511                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7512                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
7513                                         sizeof(mgmt_cp->type));
7514                 goto unlock;
7515         }
7516
7517         if (hdev->le_discovery.type != mgmt_cp->type) {
7518                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7519                                         MGMT_STATUS_INVALID_PARAMS,
7520                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
7521                 goto unlock;
7522         }
7523
7524         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
7525         if (!cmd) {
7526                 err = -ENOMEM;
7527                 goto unlock;
7528         }
7529
7530         hci_req_init(&req, hdev);
7531
7532         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
7533                 BT_DBG("unknown le discovery state %u",
7534                                         hdev->le_discovery.state);
7535
7536                 mgmt_pending_remove(cmd);
7537                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7538                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
7539                                         sizeof(mgmt_cp->type));
7540                 goto unlock;
7541         }
7542
7543         cancel_delayed_work(&hdev->le_scan_disable);
7544         hci_req_add_le_scan_disable(&req, false);
7545
7546         err = hci_req_run(&req, stop_le_discovery_complete);
7547         if (err < 0)
7548                 mgmt_pending_remove(cmd);
7549         else
7550                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
7551
7552 unlock:
7553         hci_dev_unlock(hdev);
7554         return err;
7555 }
7556
7557 /* Separate LE discovery */
7558 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
7559 {
7560         struct mgmt_ev_discovering ev;
7561         struct mgmt_pending_cmd *cmd;
7562
7563         BT_DBG("%s le discovering %u", hdev->name, discovering);
7564
7565         if (discovering)
7566                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7567         else
7568                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7569
7570         if (cmd) {
7571                 u8 type = hdev->le_discovery.type;
7572
7573                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
7574                                   sizeof(type));
7575                 mgmt_pending_remove(cmd);
7576         }
7577
7578         memset(&ev, 0, sizeof(ev));
7579         ev.type = hdev->le_discovery.type;
7580         ev.discovering = discovering;
7581
7582         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7583 }
7584
7585 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
7586                         void *data, u16 len)
7587 {
7588         int err;
7589
7590         BT_DBG("%s", hdev->name);
7591
7592         hci_dev_lock(hdev);
7593
7594         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
7595         if (err < 0)
7596                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
7597
7598         hci_dev_unlock(hdev);
7599
7600         return err;
7601 }
7602
7603 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
7604                 u16 to_multiplier)
7605 {
7606         u16 max_latency;
7607
7608         if (min > max || min < 6 || max > 3200)
7609                 return -EINVAL;
7610
7611         if (to_multiplier < 10 || to_multiplier > 3200)
7612                 return -EINVAL;
7613
7614         if (max >= to_multiplier * 8)
7615                 return -EINVAL;
7616
7617         max_latency = (to_multiplier * 8 / max) - 1;
7618
7619         if (latency > 499 || latency > max_latency)
7620                 return -EINVAL;
7621
7622         return 0;
7623 }
7624
7625 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
7626                 u16 len)
7627 {
7628         struct mgmt_cp_le_conn_update *cp = data;
7629
7630         struct hci_conn *conn;
7631         u16 min, max, latency, supervision_timeout;
7632         int err = -1;
7633
7634         if (!hdev_is_powered(hdev))
7635                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7636                                 MGMT_STATUS_NOT_POWERED);
7637
7638         min = __le16_to_cpu(cp->conn_interval_min);
7639         max = __le16_to_cpu(cp->conn_interval_max);
7640         latency = __le16_to_cpu(cp->conn_latency);
7641         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
7642
7643         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
7644                         min, max, latency, supervision_timeout);
7645
7646         err = check_le_conn_update_param(min, max, latency,
7647                         supervision_timeout);
7648
7649         if (err < 0)
7650                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7651                                 MGMT_STATUS_INVALID_PARAMS);
7652
7653         hci_dev_lock(hdev);
7654
7655         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
7656         if (!conn) {
7657                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7658                                 MGMT_STATUS_NOT_CONNECTED);
7659                 hci_dev_unlock(hdev);
7660                 return err;
7661         }
7662
7663         hci_dev_unlock(hdev);
7664
7665         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
7666
7667         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
7668                                  NULL, 0);
7669 }
7670
7671 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
7672                 u16 opcode)
7673 {
7674         struct mgmt_cp_set_manufacturer_data *cp;
7675         struct mgmt_pending_cmd *cmd;
7676
7677         BT_DBG("status 0x%02x", status);
7678
7679         hci_dev_lock(hdev);
7680
7681         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
7682         if (!cmd)
7683                 goto unlock;
7684
7685         cp = cmd->param;
7686
7687         if (status)
7688                 mgmt_cmd_status(cmd->sk, hdev->id,
7689                                 MGMT_OP_SET_MANUFACTURER_DATA,
7690                                 mgmt_status(status));
7691         else
7692                 mgmt_cmd_complete(cmd->sk, hdev->id,
7693                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
7694                                   cp, sizeof(*cp));
7695
7696         mgmt_pending_remove(cmd);
7697
7698 unlock:
7699         hci_dev_unlock(hdev);
7700 }
7701
7702 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
7703                 void *data, u16 len)
7704 {
7705         struct mgmt_pending_cmd *cmd;
7706         struct hci_request req;
7707         struct mgmt_cp_set_manufacturer_data *cp = data;
7708         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
7709         u8 old_len;
7710         int err;
7711
7712         BT_DBG("%s", hdev->name);
7713
7714         if (!lmp_bredr_capable(hdev))
7715                 return mgmt_cmd_status(sk, hdev->id,
7716                                 MGMT_OP_SET_MANUFACTURER_DATA,
7717                                 MGMT_STATUS_NOT_SUPPORTED);
7718
7719         if (cp->data[0] == 0 ||
7720                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
7721                 return mgmt_cmd_status(sk, hdev->id,
7722                                 MGMT_OP_SET_MANUFACTURER_DATA,
7723                                 MGMT_STATUS_INVALID_PARAMS);
7724
7725         if (cp->data[1] != 0xFF)
7726                 return mgmt_cmd_status(sk, hdev->id,
7727                                 MGMT_OP_SET_MANUFACTURER_DATA,
7728                                 MGMT_STATUS_NOT_SUPPORTED);
7729
7730         hci_dev_lock(hdev);
7731
7732         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
7733                 err = mgmt_cmd_status(sk, hdev->id,
7734                                 MGMT_OP_SET_MANUFACTURER_DATA,
7735                                 MGMT_STATUS_BUSY);
7736                 goto unlocked;
7737         }
7738
7739         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
7740                         len);
7741         if (!cmd) {
7742                 err = -ENOMEM;
7743                 goto unlocked;
7744         }
7745
7746         hci_req_init(&req, hdev);
7747
7748         /* if new data is same as previous data then return command
7749          * complete event
7750          */
7751         if (hdev->manufacturer_len == cp->data[0] - 1 &&
7752             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
7753                 mgmt_pending_remove(cmd);
7754                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
7755                                   0, cp, sizeof(*cp));
7756                 err = 0;
7757                 goto unlocked;
7758         }
7759
7760         old_len = hdev->manufacturer_len;
7761         if (old_len > 0)
7762                 memcpy(old_data, hdev->manufacturer_data, old_len);
7763
7764         hdev->manufacturer_len = cp->data[0] - 1;
7765         if (hdev->manufacturer_len > 0)
7766                 memcpy(hdev->manufacturer_data, cp->data + 2,
7767                                 hdev->manufacturer_len);
7768
7769         __hci_req_update_eir(&req);
7770
7771         err = hci_req_run(&req, set_manufacturer_data_complete);
7772         if (err < 0) {
7773                 mgmt_pending_remove(cmd);
7774                 goto failed;
7775         }
7776
7777 unlocked:
7778         hci_dev_unlock(hdev);
7779
7780         return err;
7781
7782 failed:
7783         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
7784         hdev->manufacturer_len = old_len;
7785         if (hdev->manufacturer_len > 0)
7786                 memcpy(hdev->manufacturer_data, old_data,
7787                        hdev->manufacturer_len);
7788         hci_dev_unlock(hdev);
7789         return err;
7790 }
7791
7792 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
7793                 void *data, u16 len)
7794 {
7795         struct mgmt_cp_le_set_scan_params *cp = data;
7796         __u16 interval, window;
7797         int err;
7798
7799         BT_DBG("%s", hdev->name);
7800
7801         if (!lmp_le_capable(hdev))
7802                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7803                                 MGMT_STATUS_NOT_SUPPORTED);
7804
7805         interval = __le16_to_cpu(cp->interval);
7806
7807         if (interval < 0x0004 || interval > 0x4000)
7808                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7809                                 MGMT_STATUS_INVALID_PARAMS);
7810
7811         window = __le16_to_cpu(cp->window);
7812
7813         if (window < 0x0004 || window > 0x4000)
7814                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7815                                 MGMT_STATUS_INVALID_PARAMS);
7816
7817         if (window > interval)
7818                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7819                                 MGMT_STATUS_INVALID_PARAMS);
7820
7821         hci_dev_lock(hdev);
7822
7823         hdev->le_scan_type = cp->type;
7824         hdev->le_scan_interval = interval;
7825         hdev->le_scan_window = window;
7826
7827         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
7828                                 NULL, 0);
7829
7830         /* If background scan is running, restart it so new parameters are
7831          * loaded.
7832          */
7833         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
7834             hdev->discovery.state == DISCOVERY_STOPPED) {
7835                 struct hci_request req;
7836
7837                 hci_req_init(&req, hdev);
7838
7839                 hci_req_add_le_scan_disable(&req, false);
7840                 hci_req_add_le_passive_scan(&req);
7841
7842                 hci_req_run(&req, NULL);
7843         }
7844
7845         hci_dev_unlock(hdev);
7846
7847         return err;
7848 }
7849
7850 static int set_voice_setting(struct sock *sk, struct hci_dev *hdev,
7851                 void *data, u16 len)
7852 {
7853         struct mgmt_cp_set_voice_setting *cp = data;
7854         struct hci_conn *conn;
7855         struct hci_conn *sco_conn;
7856
7857         int err;
7858
7859         BT_DBG("%s", hdev->name);
7860
7861         if (!lmp_bredr_capable(hdev)) {
7862                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING,
7863                                 MGMT_STATUS_NOT_SUPPORTED);
7864         }
7865
7866         hci_dev_lock(hdev);
7867
7868         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
7869         if (!conn) {
7870                 err = mgmt_cmd_complete(sk, hdev->id,
7871                                 MGMT_OP_SET_VOICE_SETTING, 0, NULL, 0);
7872                 goto unlock;
7873         }
7874
7875         conn->voice_setting = cp->voice_setting;
7876         conn->sco_role = cp->sco_role;
7877
7878         sco_conn = hci_conn_hash_lookup_sco(hdev);
7879         if (sco_conn && bacmp(&sco_conn->dst, &cp->bdaddr) != 0) {
7880                 BT_ERR("There is other SCO connection.");
7881                 goto done;
7882         }
7883
7884         if (conn->sco_role == MGMT_SCO_ROLE_HANDSFREE) {
7885                 if (conn->voice_setting == 0x0063)
7886                         sco_connect_set_wbc(hdev);
7887                 else
7888                         sco_connect_set_nbc(hdev);
7889         } else {
7890                 if (conn->voice_setting == 0x0063)
7891                         sco_connect_set_gw_wbc(hdev);
7892                 else
7893                         sco_connect_set_gw_nbc(hdev);
7894         }
7895
7896 done:
7897         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
7898                         cp, sizeof(cp));
7899
7900 unlock:
7901         hci_dev_unlock(hdev);
7902         return err;
7903 }
7904
7905 static int get_adv_tx_power(struct sock *sk, struct hci_dev *hdev,
7906                 void *data, u16 len)
7907 {
7908         struct mgmt_rp_get_adv_tx_power *rp;
7909         size_t rp_len;
7910         int err;
7911
7912         BT_DBG("%s", hdev->name);
7913
7914         hci_dev_lock(hdev);
7915
7916         rp_len = sizeof(*rp);
7917         rp = kmalloc(rp_len, GFP_KERNEL);
7918         if (!rp) {
7919                 err = -ENOMEM;
7920                 goto unlock;
7921         }
7922
7923         rp->adv_tx_power = hdev->adv_tx_power;
7924
7925         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_TX_POWER, 0, rp,
7926                                 rp_len);
7927
7928         kfree(rp);
7929
7930 unlock:
7931         hci_dev_unlock(hdev);
7932
7933         return err;
7934 }
7935
7936 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
7937 {
7938         struct mgmt_ev_hardware_error ev;
7939
7940         ev.error_code = err_code;
7941         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
7942 }
7943
7944 void mgmt_tx_timeout_error(struct hci_dev *hdev)
7945 {
7946         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
7947 }
7948
7949 void mgmt_multi_adv_state_change_evt(struct hci_dev *hdev, u8 adv_instance,
7950                 u8 state_change_reason, u16 connection_handle)
7951 {
7952         struct mgmt_ev_vendor_specific_multi_adv_state_changed mgmt_ev;
7953
7954         BT_DBG("Multi adv state changed [%2.2X %2.2X %2.2X]",
7955                adv_instance, state_change_reason, connection_handle);
7956
7957         mgmt_ev.adv_instance = adv_instance;
7958         mgmt_ev.state_change_reason = state_change_reason;
7959         mgmt_ev.connection_handle = connection_handle;
7960
7961         mgmt_event(MGMT_EV_MULTI_ADV_STATE_CHANGED, hdev, &mgmt_ev,
7962                 sizeof(struct mgmt_ev_vendor_specific_multi_adv_state_changed),
7963                 NULL);
7964 }
7965
7966 static int enable_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
7967                 void *data, u16 len)
7968 {
7969         int err;
7970         struct mgmt_cp_enable_6lowpan *cp = data;
7971
7972         BT_DBG("%s", hdev->name);
7973
7974         hci_dev_lock(hdev);
7975
7976         if (!hdev_is_powered(hdev)) {
7977                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
7978                                       MGMT_STATUS_NOT_POWERED);
7979                 goto unlocked;
7980         }
7981
7982         if (!lmp_le_capable(hdev)) {
7983                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
7984                                       MGMT_STATUS_NOT_SUPPORTED);
7985                 goto unlocked;
7986         }
7987
7988         if (cp->enable_6lowpan)
7989                 bt_6lowpan_enable();
7990         else
7991                 bt_6lowpan_disable();
7992
7993         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
7994                                 MGMT_STATUS_SUCCESS, NULL, 0);
7995 unlocked:
7996         hci_dev_unlock(hdev);
7997         return err;
7998 }
7999
8000 static int connect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8001                 void *data, u16 len)
8002 {
8003         struct mgmt_cp_connect_6lowpan *cp = data;
8004         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
8005         int err;
8006
8007         BT_DBG("%s", hdev->name);
8008
8009         hci_dev_lock(hdev);
8010
8011         if (!lmp_le_capable(hdev)) {
8012                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8013                                       MGMT_STATUS_NOT_SUPPORTED);
8014                 goto unlocked;
8015         }
8016
8017         if (!hdev_is_powered(hdev)) {
8018                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8019                                       MGMT_STATUS_REJECTED);
8020                 goto unlocked;
8021         }
8022
8023         if (bdaddr_type_is_le(cp->addr.type)) {
8024                 if (cp->addr.type == BDADDR_LE_PUBLIC)
8025                         addr_type = ADDR_LE_DEV_PUBLIC;
8026                 else
8027                         addr_type = ADDR_LE_DEV_RANDOM;
8028         } else {
8029                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8030                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
8031                 goto unlocked;
8032         }
8033
8034         hci_dev_unlock(hdev);
8035
8036         /* 6lowpan Connect */
8037         err = _bt_6lowpan_connect(&cp->addr.bdaddr, cp->addr.type);
8038
8039         hci_dev_lock(hdev);
8040
8041         if (err < 0) {
8042                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8043                                         MGMT_STATUS_REJECTED, NULL, 0);
8044
8045                 goto unlocked;
8046         }
8047
8048         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
8049                                 NULL, 0);
8050 unlocked:
8051         hci_dev_unlock(hdev);
8052         return err;
8053 }
8054
8055 static int disconnect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8056                 void *data, u16 len)
8057 {
8058         struct mgmt_cp_disconnect_6lowpan *cp = data;
8059         struct hci_conn *conn = NULL;
8060         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
8061         int err;
8062
8063         BT_DBG("%s", hdev->name);
8064
8065         hci_dev_lock(hdev);
8066
8067         if (!lmp_le_capable(hdev)) {
8068                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
8069                                       MGMT_STATUS_NOT_SUPPORTED);
8070                 goto unlocked;
8071         }
8072
8073         if (!hdev_is_powered(hdev)) {
8074                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
8075                                       MGMT_STATUS_REJECTED);
8076                 goto unlocked;
8077         }
8078
8079         if (bdaddr_type_is_le(cp->addr.type)) {
8080                 if (cp->addr.type == BDADDR_LE_PUBLIC)
8081                         addr_type = ADDR_LE_DEV_PUBLIC;
8082                 else
8083                         addr_type = ADDR_LE_DEV_RANDOM;
8084         } else {
8085                 err = mgmt_cmd_complete(sk, hdev->id,
8086                                         MGMT_OP_DISCONNECT_6LOWPAN,
8087                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
8088                 goto unlocked;
8089         }
8090
8091         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8092         if (!conn) {
8093                 err = mgmt_cmd_complete(sk, hdev->id,
8094                                         MGMT_OP_DISCONNECT_6LOWPAN,
8095                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
8096                 goto unlocked;
8097         }
8098
8099         if (conn->dst_type != addr_type) {
8100                 err = mgmt_cmd_complete(sk, hdev->id,
8101                                         MGMT_OP_DISCONNECT_6LOWPAN,
8102                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
8103                 goto unlocked;
8104         }
8105
8106         if (conn->state != BT_CONNECTED) {
8107                 err = mgmt_cmd_complete(sk, hdev->id,
8108                                         MGMT_OP_DISCONNECT_6LOWPAN,
8109                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
8110                 goto unlocked;
8111         }
8112
8113         /* 6lowpan Disconnect */
8114         err = _bt_6lowpan_disconnect(conn->l2cap_data, cp->addr.type);
8115         if (err < 0) {
8116                 err = mgmt_cmd_complete(sk, hdev->id,
8117                                         MGMT_OP_DISCONNECT_6LOWPAN,
8118                                         MGMT_STATUS_REJECTED, NULL, 0);
8119                 goto unlocked;
8120         }
8121
8122         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
8123                                 NULL, 0);
8124
8125 unlocked:
8126         hci_dev_unlock(hdev);
8127         return err;
8128 }
8129
8130 void mgmt_6lowpan_conn_changed(struct hci_dev *hdev, char if_name[16],
8131                 bdaddr_t *bdaddr, u8 addr_type, bool connected)
8132 {
8133         char buf[512];
8134         struct mgmt_ev_6lowpan_conn_state_changed *ev = (void *)buf;
8135         size_t ev_size;
8136
8137         memset(buf, 0, sizeof(buf));
8138         bacpy(&ev->addr.bdaddr, bdaddr);
8139         ev->addr.type = addr_type;
8140         ev->connected = connected;
8141         memcpy(ev->ifname, (__u8 *)if_name, 16);
8142
8143         ev_size = sizeof(*ev);
8144
8145         mgmt_event(MGMT_EV_6LOWPAN_CONN_STATE_CHANGED, hdev, ev, ev_size, NULL);
8146 }
8147
8148 void mgmt_le_read_maximum_data_length_complete(struct hci_dev *hdev, u8 status)
8149 {
8150         struct mgmt_pending_cmd *cmd;
8151         struct mgmt_rp_le_read_maximum_data_length rp;
8152
8153         BT_DBG("%s status %u", hdev->name, status);
8154
8155         cmd = pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev);
8156         if (!cmd)
8157                 return;
8158
8159         if (status)
8160                 mgmt_cmd_status(cmd->sk, hdev->id,
8161                                 MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8162                                 mgmt_status(status));
8163
8164         memset(&rp, 0, sizeof(rp));
8165
8166         rp.max_tx_octets = cpu_to_le16(hdev->le_max_tx_len);
8167         rp.max_tx_time = cpu_to_le16(hdev->le_max_tx_time);
8168         rp.max_rx_octets = cpu_to_le16(hdev->le_max_rx_len);
8169         rp.max_rx_time = cpu_to_le16(hdev->le_max_rx_time);
8170
8171         mgmt_cmd_complete(cmd->sk, hdev->id,
8172                           MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, 0,
8173                           &rp, sizeof(rp));
8174
8175         mgmt_pending_remove(cmd);
8176 }
8177
8178 static int read_maximum_le_data_length(struct sock *sk,
8179                 struct hci_dev *hdev, void *data, u16 len)
8180 {
8181         struct mgmt_pending_cmd *cmd;
8182         int err;
8183
8184         BT_DBG("read_maximum_le_data_length  %s", hdev->name);
8185
8186         hci_dev_lock(hdev);
8187
8188         if (!hdev_is_powered(hdev)) {
8189                 err = mgmt_cmd_status(sk, hdev->id,
8190                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8191                                       MGMT_STATUS_NOT_POWERED);
8192                 goto unlock;
8193         }
8194
8195         if (!lmp_le_capable(hdev)) {
8196                 err = mgmt_cmd_status(sk, hdev->id,
8197                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8198                                       MGMT_STATUS_NOT_SUPPORTED);
8199                 goto unlock;
8200         }
8201
8202         if (pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev)) {
8203                 err = mgmt_cmd_status(sk, hdev->id,
8204                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8205                                       MGMT_STATUS_BUSY);
8206                 goto unlock;
8207         }
8208
8209         cmd = mgmt_pending_add(sk, MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
8210                                hdev, data, len);
8211         if (!cmd) {
8212                 err = -ENOMEM;
8213                 goto unlock;
8214         }
8215
8216         err = hci_send_cmd(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
8217         if (err < 0)
8218                 mgmt_pending_remove(cmd);
8219
8220 unlock:
8221         hci_dev_unlock(hdev);
8222         return err;
8223 }
8224 #endif /* TIZEN_BT */
8225
8226 static bool ltk_is_valid(struct mgmt_ltk_info *key)
8227 {
8228         if (key->initiator != 0x00 && key->initiator != 0x01)
8229                 return false;
8230
8231         switch (key->addr.type) {
8232         case BDADDR_LE_PUBLIC:
8233                 return true;
8234
8235         case BDADDR_LE_RANDOM:
8236                 /* Two most significant bits shall be set */
8237                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
8238                         return false;
8239                 return true;
8240         }
8241
8242         return false;
8243 }
8244
8245 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
8246                                void *cp_data, u16 len)
8247 {
8248         struct mgmt_cp_load_long_term_keys *cp = cp_data;
8249         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
8250                                    sizeof(struct mgmt_ltk_info));
8251         u16 key_count, expected_len;
8252         int i, err;
8253
8254         bt_dev_dbg(hdev, "sock %p", sk);
8255
8256         if (!lmp_le_capable(hdev))
8257                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8258                                        MGMT_STATUS_NOT_SUPPORTED);
8259
8260         key_count = __le16_to_cpu(cp->key_count);
8261         if (key_count > max_key_count) {
8262                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
8263                            key_count);
8264                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8265                                        MGMT_STATUS_INVALID_PARAMS);
8266         }
8267
8268         expected_len = struct_size(cp, keys, key_count);
8269         if (expected_len != len) {
8270                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
8271                            expected_len, len);
8272                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8273                                        MGMT_STATUS_INVALID_PARAMS);
8274         }
8275
8276         bt_dev_dbg(hdev, "key_count %u", key_count);
8277
8278         for (i = 0; i < key_count; i++) {
8279                 struct mgmt_ltk_info *key = &cp->keys[i];
8280
8281                 if (!ltk_is_valid(key))
8282                         return mgmt_cmd_status(sk, hdev->id,
8283                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
8284                                                MGMT_STATUS_INVALID_PARAMS);
8285         }
8286
8287         hci_dev_lock(hdev);
8288
8289         hci_smp_ltks_clear(hdev);
8290
8291         for (i = 0; i < key_count; i++) {
8292                 struct mgmt_ltk_info *key = &cp->keys[i];
8293                 u8 type, authenticated;
8294
8295                 if (hci_is_blocked_key(hdev,
8296                                        HCI_BLOCKED_KEY_TYPE_LTK,
8297                                        key->val)) {
8298                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
8299                                     &key->addr.bdaddr);
8300                         continue;
8301                 }
8302
8303                 switch (key->type) {
8304                 case MGMT_LTK_UNAUTHENTICATED:
8305                         authenticated = 0x00;
8306                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8307                         break;
8308                 case MGMT_LTK_AUTHENTICATED:
8309                         authenticated = 0x01;
8310                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8311                         break;
8312                 case MGMT_LTK_P256_UNAUTH:
8313                         authenticated = 0x00;
8314                         type = SMP_LTK_P256;
8315                         break;
8316                 case MGMT_LTK_P256_AUTH:
8317                         authenticated = 0x01;
8318                         type = SMP_LTK_P256;
8319                         break;
8320                 case MGMT_LTK_P256_DEBUG:
8321                         authenticated = 0x00;
8322                         type = SMP_LTK_P256_DEBUG;
8323                         fallthrough;
8324                 default:
8325                         continue;
8326                 }
8327
8328                 hci_add_ltk(hdev, &key->addr.bdaddr,
8329                             le_addr_type(key->addr.type), type, authenticated,
8330                             key->val, key->enc_size, key->ediv, key->rand);
8331         }
8332
8333         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
8334                            NULL, 0);
8335
8336         hci_dev_unlock(hdev);
8337
8338         return err;
8339 }
8340
8341 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8342 {
8343         struct hci_conn *conn = cmd->user_data;
8344         struct mgmt_rp_get_conn_info rp;
8345         int err;
8346
8347         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8348
8349         if (status == MGMT_STATUS_SUCCESS) {
8350                 rp.rssi = conn->rssi;
8351                 rp.tx_power = conn->tx_power;
8352                 rp.max_tx_power = conn->max_tx_power;
8353         } else {
8354                 rp.rssi = HCI_RSSI_INVALID;
8355                 rp.tx_power = HCI_TX_POWER_INVALID;
8356                 rp.max_tx_power = HCI_TX_POWER_INVALID;
8357         }
8358
8359         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
8360                                 status, &rp, sizeof(rp));
8361
8362         hci_conn_drop(conn);
8363         hci_conn_put(conn);
8364
8365         return err;
8366 }
8367
8368 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
8369                                        u16 opcode)
8370 {
8371         struct hci_cp_read_rssi *cp;
8372         struct mgmt_pending_cmd *cmd;
8373         struct hci_conn *conn;
8374         u16 handle;
8375         u8 status;
8376
8377         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
8378
8379         hci_dev_lock(hdev);
8380
8381         /* Commands sent in request are either Read RSSI or Read Transmit Power
8382          * Level so we check which one was last sent to retrieve connection
8383          * handle.  Both commands have handle as first parameter so it's safe to
8384          * cast data on the same command struct.
8385          *
8386          * First command sent is always Read RSSI and we fail only if it fails.
8387          * In other case we simply override error to indicate success as we
8388          * already remembered if TX power value is actually valid.
8389          */
8390         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
8391         if (!cp) {
8392                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
8393                 status = MGMT_STATUS_SUCCESS;
8394         } else {
8395                 status = mgmt_status(hci_status);
8396         }
8397
8398         if (!cp) {
8399                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
8400                 goto unlock;
8401         }
8402
8403         handle = __le16_to_cpu(cp->handle);
8404         conn = hci_conn_hash_lookup_handle(hdev, handle);
8405         if (!conn) {
8406                 bt_dev_err(hdev, "unknown handle (%u) in conn_info response",
8407                            handle);
8408                 goto unlock;
8409         }
8410
8411         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
8412         if (!cmd)
8413                 goto unlock;
8414
8415         cmd->cmd_complete(cmd, status);
8416         mgmt_pending_remove(cmd);
8417
8418 unlock:
8419         hci_dev_unlock(hdev);
8420 }
8421
8422 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
8423                          u16 len)
8424 {
8425         struct mgmt_cp_get_conn_info *cp = data;
8426         struct mgmt_rp_get_conn_info rp;
8427         struct hci_conn *conn;
8428         unsigned long conn_info_age;
8429         int err = 0;
8430
8431         bt_dev_dbg(hdev, "sock %p", sk);
8432
8433         memset(&rp, 0, sizeof(rp));
8434         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8435         rp.addr.type = cp->addr.type;
8436
8437         if (!bdaddr_type_is_valid(cp->addr.type))
8438                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8439                                          MGMT_STATUS_INVALID_PARAMS,
8440                                          &rp, sizeof(rp));
8441
8442         hci_dev_lock(hdev);
8443
8444         if (!hdev_is_powered(hdev)) {
8445                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8446                                         MGMT_STATUS_NOT_POWERED, &rp,
8447                                         sizeof(rp));
8448                 goto unlock;
8449         }
8450
8451         if (cp->addr.type == BDADDR_BREDR)
8452                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8453                                                &cp->addr.bdaddr);
8454         else
8455                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8456
8457         if (!conn || conn->state != BT_CONNECTED) {
8458                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8459                                         MGMT_STATUS_NOT_CONNECTED, &rp,
8460                                         sizeof(rp));
8461                 goto unlock;
8462         }
8463
8464         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
8465                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8466                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
8467                 goto unlock;
8468         }
8469
8470         /* To avoid client trying to guess when to poll again for information we
8471          * calculate conn info age as random value between min/max set in hdev.
8472          */
8473         conn_info_age = hdev->conn_info_min_age +
8474                         prandom_u32_max(hdev->conn_info_max_age -
8475                                         hdev->conn_info_min_age);
8476
8477         /* Query controller to refresh cached values if they are too old or were
8478          * never read.
8479          */
8480         if (time_after(jiffies, conn->conn_info_timestamp +
8481                        msecs_to_jiffies(conn_info_age)) ||
8482             !conn->conn_info_timestamp) {
8483                 struct hci_request req;
8484                 struct hci_cp_read_tx_power req_txp_cp;
8485                 struct hci_cp_read_rssi req_rssi_cp;
8486                 struct mgmt_pending_cmd *cmd;
8487
8488                 hci_req_init(&req, hdev);
8489                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
8490                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
8491                             &req_rssi_cp);
8492
8493                 /* For LE links TX power does not change thus we don't need to
8494                  * query for it once value is known.
8495                  */
8496                 if (!bdaddr_type_is_le(cp->addr.type) ||
8497                     conn->tx_power == HCI_TX_POWER_INVALID) {
8498                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8499                         req_txp_cp.type = 0x00;
8500                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8501                                     sizeof(req_txp_cp), &req_txp_cp);
8502                 }
8503
8504                 /* Max TX power needs to be read only once per connection */
8505                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
8506                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8507                         req_txp_cp.type = 0x01;
8508                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8509                                     sizeof(req_txp_cp), &req_txp_cp);
8510                 }
8511
8512                 err = hci_req_run(&req, conn_info_refresh_complete);
8513                 if (err < 0)
8514                         goto unlock;
8515
8516                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
8517                                        data, len);
8518                 if (!cmd) {
8519                         err = -ENOMEM;
8520                         goto unlock;
8521                 }
8522
8523                 hci_conn_hold(conn);
8524                 cmd->user_data = hci_conn_get(conn);
8525                 cmd->cmd_complete = conn_info_cmd_complete;
8526
8527                 conn->conn_info_timestamp = jiffies;
8528         } else {
8529                 /* Cache is valid, just reply with values cached in hci_conn */
8530                 rp.rssi = conn->rssi;
8531                 rp.tx_power = conn->tx_power;
8532                 rp.max_tx_power = conn->max_tx_power;
8533
8534                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8535                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8536         }
8537
8538 unlock:
8539         hci_dev_unlock(hdev);
8540         return err;
8541 }
8542
8543 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8544 {
8545         struct hci_conn *conn = cmd->user_data;
8546         struct mgmt_rp_get_clock_info rp;
8547         struct hci_dev *hdev;
8548         int err;
8549
8550         memset(&rp, 0, sizeof(rp));
8551         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8552
8553         if (status)
8554                 goto complete;
8555
8556         hdev = hci_dev_get(cmd->index);
8557         if (hdev) {
8558                 rp.local_clock = cpu_to_le32(hdev->clock);
8559                 hci_dev_put(hdev);
8560         }
8561
8562         if (conn) {
8563                 rp.piconet_clock = cpu_to_le32(conn->clock);
8564                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
8565         }
8566
8567 complete:
8568         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
8569                                 sizeof(rp));
8570
8571         if (conn) {
8572                 hci_conn_drop(conn);
8573                 hci_conn_put(conn);
8574         }
8575
8576         return err;
8577 }
8578
8579 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8580 {
8581         struct hci_cp_read_clock *hci_cp;
8582         struct mgmt_pending_cmd *cmd;
8583         struct hci_conn *conn;
8584
8585         bt_dev_dbg(hdev, "status %u", status);
8586
8587         hci_dev_lock(hdev);
8588
8589         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
8590         if (!hci_cp)
8591                 goto unlock;
8592
8593         if (hci_cp->which) {
8594                 u16 handle = __le16_to_cpu(hci_cp->handle);
8595                 conn = hci_conn_hash_lookup_handle(hdev, handle);
8596         } else {
8597                 conn = NULL;
8598         }
8599
8600         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
8601         if (!cmd)
8602                 goto unlock;
8603
8604         cmd->cmd_complete(cmd, mgmt_status(status));
8605         mgmt_pending_remove(cmd);
8606
8607 unlock:
8608         hci_dev_unlock(hdev);
8609 }
8610
8611 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8612                          u16 len)
8613 {
8614         struct mgmt_cp_get_clock_info *cp = data;
8615         struct mgmt_rp_get_clock_info rp;
8616         struct hci_cp_read_clock hci_cp;
8617         struct mgmt_pending_cmd *cmd;
8618         struct hci_request req;
8619         struct hci_conn *conn;
8620         int err;
8621
8622         bt_dev_dbg(hdev, "sock %p", sk);
8623
8624         memset(&rp, 0, sizeof(rp));
8625         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8626         rp.addr.type = cp->addr.type;
8627
8628         if (cp->addr.type != BDADDR_BREDR)
8629                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8630                                          MGMT_STATUS_INVALID_PARAMS,
8631                                          &rp, sizeof(rp));
8632
8633         hci_dev_lock(hdev);
8634
8635         if (!hdev_is_powered(hdev)) {
8636                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8637                                         MGMT_STATUS_NOT_POWERED, &rp,
8638                                         sizeof(rp));
8639                 goto unlock;
8640         }
8641
8642         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8643                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8644                                                &cp->addr.bdaddr);
8645                 if (!conn || conn->state != BT_CONNECTED) {
8646                         err = mgmt_cmd_complete(sk, hdev->id,
8647                                                 MGMT_OP_GET_CLOCK_INFO,
8648                                                 MGMT_STATUS_NOT_CONNECTED,
8649                                                 &rp, sizeof(rp));
8650                         goto unlock;
8651                 }
8652         } else {
8653                 conn = NULL;
8654         }
8655
8656         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8657         if (!cmd) {
8658                 err = -ENOMEM;
8659                 goto unlock;
8660         }
8661
8662         cmd->cmd_complete = clock_info_cmd_complete;
8663
8664         hci_req_init(&req, hdev);
8665
8666         memset(&hci_cp, 0, sizeof(hci_cp));
8667         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8668
8669         if (conn) {
8670                 hci_conn_hold(conn);
8671                 cmd->user_data = hci_conn_get(conn);
8672
8673                 hci_cp.handle = cpu_to_le16(conn->handle);
8674                 hci_cp.which = 0x01; /* Piconet clock */
8675                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8676         }
8677
8678         err = hci_req_run(&req, get_clock_info_complete);
8679         if (err < 0)
8680                 mgmt_pending_remove(cmd);
8681
8682 unlock:
8683         hci_dev_unlock(hdev);
8684         return err;
8685 }
8686
8687 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8688 {
8689         struct hci_conn *conn;
8690
8691         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8692         if (!conn)
8693                 return false;
8694
8695         if (conn->dst_type != type)
8696                 return false;
8697
8698         if (conn->state != BT_CONNECTED)
8699                 return false;
8700
8701         return true;
8702 }
8703
8704 /* This function requires the caller holds hdev->lock */
8705 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
8706                                u8 addr_type, u8 auto_connect)
8707 {
8708         struct hci_conn_params *params;
8709
8710         params = hci_conn_params_add(hdev, addr, addr_type);
8711         if (!params)
8712                 return -EIO;
8713
8714         if (params->auto_connect == auto_connect)
8715                 return 0;
8716
8717         list_del_init(&params->action);
8718
8719         switch (auto_connect) {
8720         case HCI_AUTO_CONN_DISABLED:
8721         case HCI_AUTO_CONN_LINK_LOSS:
8722                 /* If auto connect is being disabled when we're trying to
8723                  * connect to device, keep connecting.
8724                  */
8725                 if (params->explicit_connect)
8726                         list_add(&params->action, &hdev->pend_le_conns);
8727                 break;
8728         case HCI_AUTO_CONN_REPORT:
8729                 if (params->explicit_connect)
8730                         list_add(&params->action, &hdev->pend_le_conns);
8731                 else
8732                         list_add(&params->action, &hdev->pend_le_reports);
8733                 break;
8734         case HCI_AUTO_CONN_DIRECT:
8735         case HCI_AUTO_CONN_ALWAYS:
8736                 if (!is_connected(hdev, addr, addr_type))
8737                         list_add(&params->action, &hdev->pend_le_conns);
8738                 break;
8739         }
8740
8741         params->auto_connect = auto_connect;
8742
8743         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
8744                    addr, addr_type, auto_connect);
8745
8746         return 0;
8747 }
8748
8749 static void device_added(struct sock *sk, struct hci_dev *hdev,
8750                          bdaddr_t *bdaddr, u8 type, u8 action)
8751 {
8752         struct mgmt_ev_device_added ev;
8753
8754         bacpy(&ev.addr.bdaddr, bdaddr);
8755         ev.addr.type = type;
8756         ev.action = action;
8757
8758         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
8759 }
8760
8761 static int add_device(struct sock *sk, struct hci_dev *hdev,
8762                       void *data, u16 len)
8763 {
8764         struct mgmt_cp_add_device *cp = data;
8765         u8 auto_conn, addr_type;
8766         struct hci_conn_params *params;
8767         int err;
8768         u32 current_flags = 0;
8769
8770         bt_dev_dbg(hdev, "sock %p", sk);
8771
8772         if (!bdaddr_type_is_valid(cp->addr.type) ||
8773             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
8774                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8775                                          MGMT_STATUS_INVALID_PARAMS,
8776                                          &cp->addr, sizeof(cp->addr));
8777
8778         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
8779                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8780                                          MGMT_STATUS_INVALID_PARAMS,
8781                                          &cp->addr, sizeof(cp->addr));
8782
8783         hci_dev_lock(hdev);
8784
8785         if (cp->addr.type == BDADDR_BREDR) {
8786                 /* Only incoming connections action is supported for now */
8787                 if (cp->action != 0x01) {
8788                         err = mgmt_cmd_complete(sk, hdev->id,
8789                                                 MGMT_OP_ADD_DEVICE,
8790                                                 MGMT_STATUS_INVALID_PARAMS,
8791                                                 &cp->addr, sizeof(cp->addr));
8792                         goto unlock;
8793                 }
8794
8795                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
8796                                                      &cp->addr.bdaddr,
8797                                                      cp->addr.type, 0);
8798                 if (err)
8799                         goto unlock;
8800
8801                 hci_req_update_scan(hdev);
8802
8803                 goto added;
8804         }
8805
8806         addr_type = le_addr_type(cp->addr.type);
8807
8808         if (cp->action == 0x02)
8809                 auto_conn = HCI_AUTO_CONN_ALWAYS;
8810         else if (cp->action == 0x01)
8811                 auto_conn = HCI_AUTO_CONN_DIRECT;
8812         else
8813                 auto_conn = HCI_AUTO_CONN_REPORT;
8814
8815         /* Kernel internally uses conn_params with resolvable private
8816          * address, but Add Device allows only identity addresses.
8817          * Make sure it is enforced before calling
8818          * hci_conn_params_lookup.
8819          */
8820         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8821                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8822                                         MGMT_STATUS_INVALID_PARAMS,
8823                                         &cp->addr, sizeof(cp->addr));
8824                 goto unlock;
8825         }
8826
8827         /* If the connection parameters don't exist for this device,
8828          * they will be created and configured with defaults.
8829          */
8830         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
8831                                 auto_conn) < 0) {
8832                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8833                                         MGMT_STATUS_FAILED, &cp->addr,
8834                                         sizeof(cp->addr));
8835                 goto unlock;
8836         } else {
8837                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8838                                                 addr_type);
8839                 if (params)
8840                         current_flags = params->current_flags;
8841         }
8842
8843         hci_update_background_scan(hdev);
8844
8845 added:
8846         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
8847         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
8848                              SUPPORTED_DEVICE_FLAGS(), current_flags);
8849
8850         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8851                                 MGMT_STATUS_SUCCESS, &cp->addr,
8852                                 sizeof(cp->addr));
8853
8854 unlock:
8855         hci_dev_unlock(hdev);
8856         return err;
8857 }
8858
8859 static void device_removed(struct sock *sk, struct hci_dev *hdev,
8860                            bdaddr_t *bdaddr, u8 type)
8861 {
8862         struct mgmt_ev_device_removed ev;
8863
8864         bacpy(&ev.addr.bdaddr, bdaddr);
8865         ev.addr.type = type;
8866
8867         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
8868 }
8869
8870 static int remove_device(struct sock *sk, struct hci_dev *hdev,
8871                          void *data, u16 len)
8872 {
8873         struct mgmt_cp_remove_device *cp = data;
8874         int err;
8875
8876         bt_dev_dbg(hdev, "sock %p", sk);
8877
8878         hci_dev_lock(hdev);
8879
8880         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8881                 struct hci_conn_params *params;
8882                 u8 addr_type;
8883
8884                 if (!bdaddr_type_is_valid(cp->addr.type)) {
8885                         err = mgmt_cmd_complete(sk, hdev->id,
8886                                                 MGMT_OP_REMOVE_DEVICE,
8887                                                 MGMT_STATUS_INVALID_PARAMS,
8888                                                 &cp->addr, sizeof(cp->addr));
8889                         goto unlock;
8890                 }
8891
8892                 if (cp->addr.type == BDADDR_BREDR) {
8893                         err = hci_bdaddr_list_del(&hdev->accept_list,
8894                                                   &cp->addr.bdaddr,
8895                                                   cp->addr.type);
8896                         if (err) {
8897                                 err = mgmt_cmd_complete(sk, hdev->id,
8898                                                         MGMT_OP_REMOVE_DEVICE,
8899                                                         MGMT_STATUS_INVALID_PARAMS,
8900                                                         &cp->addr,
8901                                                         sizeof(cp->addr));
8902                                 goto unlock;
8903                         }
8904
8905                         hci_req_update_scan(hdev);
8906
8907                         device_removed(sk, hdev, &cp->addr.bdaddr,
8908                                        cp->addr.type);
8909                         goto complete;
8910                 }
8911
8912                 addr_type = le_addr_type(cp->addr.type);
8913
8914                 /* Kernel internally uses conn_params with resolvable private
8915                  * address, but Remove Device allows only identity addresses.
8916                  * Make sure it is enforced before calling
8917                  * hci_conn_params_lookup.
8918                  */
8919                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8920                         err = mgmt_cmd_complete(sk, hdev->id,
8921                                                 MGMT_OP_REMOVE_DEVICE,
8922                                                 MGMT_STATUS_INVALID_PARAMS,
8923                                                 &cp->addr, sizeof(cp->addr));
8924                         goto unlock;
8925                 }
8926
8927                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8928                                                 addr_type);
8929                 if (!params) {
8930                         err = mgmt_cmd_complete(sk, hdev->id,
8931                                                 MGMT_OP_REMOVE_DEVICE,
8932                                                 MGMT_STATUS_INVALID_PARAMS,
8933                                                 &cp->addr, sizeof(cp->addr));
8934                         goto unlock;
8935                 }
8936
8937                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
8938                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
8939                         err = mgmt_cmd_complete(sk, hdev->id,
8940                                                 MGMT_OP_REMOVE_DEVICE,
8941                                                 MGMT_STATUS_INVALID_PARAMS,
8942                                                 &cp->addr, sizeof(cp->addr));
8943                         goto unlock;
8944                 }
8945
8946                 list_del(&params->action);
8947                 list_del(&params->list);
8948                 kfree(params);
8949                 hci_update_background_scan(hdev);
8950
8951                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8952         } else {
8953                 struct hci_conn_params *p, *tmp;
8954                 struct bdaddr_list *b, *btmp;
8955
8956                 if (cp->addr.type) {
8957                         err = mgmt_cmd_complete(sk, hdev->id,
8958                                                 MGMT_OP_REMOVE_DEVICE,
8959                                                 MGMT_STATUS_INVALID_PARAMS,
8960                                                 &cp->addr, sizeof(cp->addr));
8961                         goto unlock;
8962                 }
8963
8964                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
8965                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8966                         list_del(&b->list);
8967                         kfree(b);
8968                 }
8969
8970                 hci_req_update_scan(hdev);
8971
8972                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8973                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8974                                 continue;
8975                         device_removed(sk, hdev, &p->addr, p->addr_type);
8976                         if (p->explicit_connect) {
8977                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8978                                 continue;
8979                         }
8980                         list_del(&p->action);
8981                         list_del(&p->list);
8982                         kfree(p);
8983                 }
8984
8985                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8986
8987                 hci_update_background_scan(hdev);
8988         }
8989
8990 complete:
8991         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
8992                                 MGMT_STATUS_SUCCESS, &cp->addr,
8993                                 sizeof(cp->addr));
8994 unlock:
8995         hci_dev_unlock(hdev);
8996         return err;
8997 }
8998
8999 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
9000                            u16 len)
9001 {
9002         struct mgmt_cp_load_conn_param *cp = data;
9003         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
9004                                      sizeof(struct mgmt_conn_param));
9005         u16 param_count, expected_len;
9006         int i;
9007
9008         if (!lmp_le_capable(hdev))
9009                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9010                                        MGMT_STATUS_NOT_SUPPORTED);
9011
9012         param_count = __le16_to_cpu(cp->param_count);
9013         if (param_count > max_param_count) {
9014                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
9015                            param_count);
9016                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9017                                        MGMT_STATUS_INVALID_PARAMS);
9018         }
9019
9020         expected_len = struct_size(cp, params, param_count);
9021         if (expected_len != len) {
9022                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
9023                            expected_len, len);
9024                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9025                                        MGMT_STATUS_INVALID_PARAMS);
9026         }
9027
9028         bt_dev_dbg(hdev, "param_count %u", param_count);
9029
9030         hci_dev_lock(hdev);
9031
9032         hci_conn_params_clear_disabled(hdev);
9033
9034         for (i = 0; i < param_count; i++) {
9035                 struct mgmt_conn_param *param = &cp->params[i];
9036                 struct hci_conn_params *hci_param;
9037                 u16 min, max, latency, timeout;
9038                 u8 addr_type;
9039
9040                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
9041                            param->addr.type);
9042
9043                 if (param->addr.type == BDADDR_LE_PUBLIC) {
9044                         addr_type = ADDR_LE_DEV_PUBLIC;
9045                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
9046                         addr_type = ADDR_LE_DEV_RANDOM;
9047                 } else {
9048                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9049                         continue;
9050                 }
9051
9052                 min = le16_to_cpu(param->min_interval);
9053                 max = le16_to_cpu(param->max_interval);
9054                 latency = le16_to_cpu(param->latency);
9055                 timeout = le16_to_cpu(param->timeout);
9056
9057                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
9058                            min, max, latency, timeout);
9059
9060                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
9061                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9062                         continue;
9063                 }
9064
9065                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
9066                                                 addr_type);
9067                 if (!hci_param) {
9068                         bt_dev_err(hdev, "failed to add connection parameters");
9069                         continue;
9070                 }
9071
9072                 hci_param->conn_min_interval = min;
9073                 hci_param->conn_max_interval = max;
9074                 hci_param->conn_latency = latency;
9075                 hci_param->supervision_timeout = timeout;
9076         }
9077
9078         hci_dev_unlock(hdev);
9079
9080         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
9081                                  NULL, 0);
9082 }
9083
9084 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
9085                                void *data, u16 len)
9086 {
9087         struct mgmt_cp_set_external_config *cp = data;
9088         bool changed;
9089         int err;
9090
9091         bt_dev_dbg(hdev, "sock %p", sk);
9092
9093         if (hdev_is_powered(hdev))
9094                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9095                                        MGMT_STATUS_REJECTED);
9096
9097         if (cp->config != 0x00 && cp->config != 0x01)
9098                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9099                                          MGMT_STATUS_INVALID_PARAMS);
9100
9101         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
9102                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9103                                        MGMT_STATUS_NOT_SUPPORTED);
9104
9105         hci_dev_lock(hdev);
9106
9107         if (cp->config)
9108                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
9109         else
9110                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
9111
9112         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
9113         if (err < 0)
9114                 goto unlock;
9115
9116         if (!changed)
9117                 goto unlock;
9118
9119         err = new_options(hdev, sk);
9120
9121         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
9122                 mgmt_index_removed(hdev);
9123
9124                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
9125                         hci_dev_set_flag(hdev, HCI_CONFIG);
9126                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9127
9128                         queue_work(hdev->req_workqueue, &hdev->power_on);
9129                 } else {
9130                         set_bit(HCI_RAW, &hdev->flags);
9131                         mgmt_index_added(hdev);
9132                 }
9133         }
9134
9135 unlock:
9136         hci_dev_unlock(hdev);
9137         return err;
9138 }
9139
9140 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
9141                               void *data, u16 len)
9142 {
9143         struct mgmt_cp_set_public_address *cp = data;
9144         bool changed;
9145         int err;
9146
9147         bt_dev_dbg(hdev, "sock %p", sk);
9148
9149         if (hdev_is_powered(hdev))
9150                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9151                                        MGMT_STATUS_REJECTED);
9152
9153         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
9154                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9155                                        MGMT_STATUS_INVALID_PARAMS);
9156
9157         if (!hdev->set_bdaddr)
9158                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9159                                        MGMT_STATUS_NOT_SUPPORTED);
9160
9161         hci_dev_lock(hdev);
9162
9163         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
9164         bacpy(&hdev->public_addr, &cp->bdaddr);
9165
9166         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
9167         if (err < 0)
9168                 goto unlock;
9169
9170         if (!changed)
9171                 goto unlock;
9172
9173         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9174                 err = new_options(hdev, sk);
9175
9176         if (is_configured(hdev)) {
9177                 mgmt_index_removed(hdev);
9178
9179                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9180
9181                 hci_dev_set_flag(hdev, HCI_CONFIG);
9182                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9183
9184                 queue_work(hdev->req_workqueue, &hdev->power_on);
9185         }
9186
9187 unlock:
9188         hci_dev_unlock(hdev);
9189         return err;
9190 }
9191
9192 #ifdef TIZEN_BT
9193 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
9194                             u8 name_len)
9195 {
9196         char buf[512];
9197         struct mgmt_ev_device_name_update *ev = (void *)buf;
9198         u16 eir_len = 0;
9199
9200         if (name_len <= 0)
9201                 return -EINVAL;
9202
9203         bacpy(&ev->addr.bdaddr, bdaddr);
9204         ev->addr.type = BDADDR_BREDR;
9205
9206         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9207                                   name_len);
9208
9209         ev->eir_len = cpu_to_le16(eir_len);
9210
9211         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
9212                           sizeof(*ev) + eir_len, NULL);
9213 }
9214
9215 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9216                                u8 link_type, u8 addr_type, u8 status)
9217 {
9218         struct mgmt_ev_conn_update_failed ev;
9219
9220         bacpy(&ev.addr.bdaddr, bdaddr);
9221         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9222         ev.status = status;
9223
9224         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
9225                                 &ev, sizeof(ev), NULL);
9226 }
9227
9228 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
9229                          u8 link_type, u8 addr_type, u16 conn_interval,
9230                          u16 conn_latency, u16 supervision_timeout)
9231 {
9232         struct mgmt_ev_conn_updated ev;
9233
9234         bacpy(&ev.addr.bdaddr, bdaddr);
9235         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9236         ev.conn_interval = cpu_to_le16(conn_interval);
9237         ev.conn_latency = cpu_to_le16(conn_latency);
9238         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
9239
9240         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
9241                                 &ev, sizeof(ev), NULL);
9242 }
9243
9244 /* le device found event - Pass adv type */
9245 void mgmt_le_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9246                 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, u8 *eir,
9247                 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, u8 adv_type)
9248 {
9249         char buf[512];
9250         struct mgmt_ev_le_device_found *ev = (void *)buf;
9251         size_t ev_size;
9252
9253         if (!hci_discovery_active(hdev) && !hci_le_discovery_active(hdev))
9254                 return;
9255
9256         /* Make sure that the buffer is big enough. The 5 extra bytes
9257          * are for the potential CoD field.
9258          */
9259         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9260                 return;
9261
9262         memset(buf, 0, sizeof(buf));
9263
9264         bacpy(&ev->addr.bdaddr, bdaddr);
9265         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9266         ev->rssi = rssi;
9267         ev->flags = cpu_to_le32(flags);
9268         ev->adv_type = adv_type;
9269
9270         if (eir_len > 0)
9271                 memcpy(ev->eir, eir, eir_len);
9272
9273         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, NULL))
9274                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9275                                           dev_class, 3);
9276
9277         if (scan_rsp_len > 0)
9278                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9279
9280         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9281         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9282
9283         mgmt_event(MGMT_EV_LE_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9284 }
9285 #endif
9286
9287 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
9288                                              u16 opcode, struct sk_buff *skb)
9289 {
9290         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
9291         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
9292         u8 *h192, *r192, *h256, *r256;
9293         struct mgmt_pending_cmd *cmd;
9294         u16 eir_len;
9295         int err;
9296
9297         bt_dev_dbg(hdev, "status %u", status);
9298
9299         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
9300         if (!cmd)
9301                 return;
9302
9303         mgmt_cp = cmd->param;
9304
9305         if (status) {
9306                 status = mgmt_status(status);
9307                 eir_len = 0;
9308
9309                 h192 = NULL;
9310                 r192 = NULL;
9311                 h256 = NULL;
9312                 r256 = NULL;
9313         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
9314                 struct hci_rp_read_local_oob_data *rp;
9315
9316                 if (skb->len != sizeof(*rp)) {
9317                         status = MGMT_STATUS_FAILED;
9318                         eir_len = 0;
9319                 } else {
9320                         status = MGMT_STATUS_SUCCESS;
9321                         rp = (void *)skb->data;
9322
9323                         eir_len = 5 + 18 + 18;
9324                         h192 = rp->hash;
9325                         r192 = rp->rand;
9326                         h256 = NULL;
9327                         r256 = NULL;
9328                 }
9329         } else {
9330                 struct hci_rp_read_local_oob_ext_data *rp;
9331
9332                 if (skb->len != sizeof(*rp)) {
9333                         status = MGMT_STATUS_FAILED;
9334                         eir_len = 0;
9335                 } else {
9336                         status = MGMT_STATUS_SUCCESS;
9337                         rp = (void *)skb->data;
9338
9339                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
9340                                 eir_len = 5 + 18 + 18;
9341                                 h192 = NULL;
9342                                 r192 = NULL;
9343                         } else {
9344                                 eir_len = 5 + 18 + 18 + 18 + 18;
9345                                 h192 = rp->hash192;
9346                                 r192 = rp->rand192;
9347                         }
9348
9349                         h256 = rp->hash256;
9350                         r256 = rp->rand256;
9351                 }
9352         }
9353
9354         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
9355         if (!mgmt_rp)
9356                 goto done;
9357
9358         if (eir_len == 0)
9359                 goto send_rsp;
9360
9361         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
9362                                   hdev->dev_class, 3);
9363
9364         if (h192 && r192) {
9365                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9366                                           EIR_SSP_HASH_C192, h192, 16);
9367                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9368                                           EIR_SSP_RAND_R192, r192, 16);
9369         }
9370
9371         if (h256 && r256) {
9372                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9373                                           EIR_SSP_HASH_C256, h256, 16);
9374                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9375                                           EIR_SSP_RAND_R256, r256, 16);
9376         }
9377
9378 send_rsp:
9379         mgmt_rp->type = mgmt_cp->type;
9380         mgmt_rp->eir_len = cpu_to_le16(eir_len);
9381
9382         err = mgmt_cmd_complete(cmd->sk, hdev->id,
9383                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
9384                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
9385         if (err < 0 || status)
9386                 goto done;
9387
9388         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
9389
9390         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9391                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
9392                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
9393 done:
9394         kfree(mgmt_rp);
9395         mgmt_pending_remove(cmd);
9396 }
9397
9398 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
9399                                   struct mgmt_cp_read_local_oob_ext_data *cp)
9400 {
9401         struct mgmt_pending_cmd *cmd;
9402         struct hci_request req;
9403         int err;
9404
9405         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
9406                                cp, sizeof(*cp));
9407         if (!cmd)
9408                 return -ENOMEM;
9409
9410         hci_req_init(&req, hdev);
9411
9412         if (bredr_sc_enabled(hdev))
9413                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
9414         else
9415                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
9416
9417         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
9418         if (err < 0) {
9419                 mgmt_pending_remove(cmd);
9420                 return err;
9421         }
9422
9423         return 0;
9424 }
9425
9426 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
9427                                    void *data, u16 data_len)
9428 {
9429         struct mgmt_cp_read_local_oob_ext_data *cp = data;
9430         struct mgmt_rp_read_local_oob_ext_data *rp;
9431         size_t rp_len;
9432         u16 eir_len;
9433         u8 status, flags, role, addr[7], hash[16], rand[16];
9434         int err;
9435
9436         bt_dev_dbg(hdev, "sock %p", sk);
9437
9438         if (hdev_is_powered(hdev)) {
9439                 switch (cp->type) {
9440                 case BIT(BDADDR_BREDR):
9441                         status = mgmt_bredr_support(hdev);
9442                         if (status)
9443                                 eir_len = 0;
9444                         else
9445                                 eir_len = 5;
9446                         break;
9447                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9448                         status = mgmt_le_support(hdev);
9449                         if (status)
9450                                 eir_len = 0;
9451                         else
9452                                 eir_len = 9 + 3 + 18 + 18 + 3;
9453                         break;
9454                 default:
9455                         status = MGMT_STATUS_INVALID_PARAMS;
9456                         eir_len = 0;
9457                         break;
9458                 }
9459         } else {
9460                 status = MGMT_STATUS_NOT_POWERED;
9461                 eir_len = 0;
9462         }
9463
9464         rp_len = sizeof(*rp) + eir_len;
9465         rp = kmalloc(rp_len, GFP_ATOMIC);
9466         if (!rp)
9467                 return -ENOMEM;
9468
9469         if (status)
9470                 goto complete;
9471
9472         hci_dev_lock(hdev);
9473
9474         eir_len = 0;
9475         switch (cp->type) {
9476         case BIT(BDADDR_BREDR):
9477                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9478                         err = read_local_ssp_oob_req(hdev, sk, cp);
9479                         hci_dev_unlock(hdev);
9480                         if (!err)
9481                                 goto done;
9482
9483                         status = MGMT_STATUS_FAILED;
9484                         goto complete;
9485                 } else {
9486                         eir_len = eir_append_data(rp->eir, eir_len,
9487                                                   EIR_CLASS_OF_DEV,
9488                                                   hdev->dev_class, 3);
9489                 }
9490                 break;
9491         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9492                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
9493                     smp_generate_oob(hdev, hash, rand) < 0) {
9494                         hci_dev_unlock(hdev);
9495                         status = MGMT_STATUS_FAILED;
9496                         goto complete;
9497                 }
9498
9499                 /* This should return the active RPA, but since the RPA
9500                  * is only programmed on demand, it is really hard to fill
9501                  * this in at the moment. For now disallow retrieving
9502                  * local out-of-band data when privacy is in use.
9503                  *
9504                  * Returning the identity address will not help here since
9505                  * pairing happens before the identity resolving key is
9506                  * known and thus the connection establishment happens
9507                  * based on the RPA and not the identity address.
9508                  */
9509                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
9510                         hci_dev_unlock(hdev);
9511                         status = MGMT_STATUS_REJECTED;
9512                         goto complete;
9513                 }
9514
9515                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
9516                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
9517                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
9518                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
9519                         memcpy(addr, &hdev->static_addr, 6);
9520                         addr[6] = 0x01;
9521                 } else {
9522                         memcpy(addr, &hdev->bdaddr, 6);
9523                         addr[6] = 0x00;
9524                 }
9525
9526                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
9527                                           addr, sizeof(addr));
9528
9529                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
9530                         role = 0x02;
9531                 else
9532                         role = 0x01;
9533
9534                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
9535                                           &role, sizeof(role));
9536
9537                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
9538                         eir_len = eir_append_data(rp->eir, eir_len,
9539                                                   EIR_LE_SC_CONFIRM,
9540                                                   hash, sizeof(hash));
9541
9542                         eir_len = eir_append_data(rp->eir, eir_len,
9543                                                   EIR_LE_SC_RANDOM,
9544                                                   rand, sizeof(rand));
9545                 }
9546
9547                 flags = mgmt_get_adv_discov_flags(hdev);
9548
9549                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9550                         flags |= LE_AD_NO_BREDR;
9551
9552                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
9553                                           &flags, sizeof(flags));
9554                 break;
9555         }
9556
9557         hci_dev_unlock(hdev);
9558
9559         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
9560
9561         status = MGMT_STATUS_SUCCESS;
9562
9563 complete:
9564         rp->type = cp->type;
9565         rp->eir_len = cpu_to_le16(eir_len);
9566
9567         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
9568                                 status, rp, sizeof(*rp) + eir_len);
9569         if (err < 0 || status)
9570                 goto done;
9571
9572         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9573                                  rp, sizeof(*rp) + eir_len,
9574                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
9575
9576 done:
9577         kfree(rp);
9578
9579         return err;
9580 }
9581
9582 static u32 get_supported_adv_flags(struct hci_dev *hdev)
9583 {
9584         u32 flags = 0;
9585
9586         flags |= MGMT_ADV_FLAG_CONNECTABLE;
9587         flags |= MGMT_ADV_FLAG_DISCOV;
9588         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
9589         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
9590         flags |= MGMT_ADV_FLAG_APPEARANCE;
9591         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
9592         flags |= MGMT_ADV_PARAM_DURATION;
9593         flags |= MGMT_ADV_PARAM_TIMEOUT;
9594         flags |= MGMT_ADV_PARAM_INTERVALS;
9595         flags |= MGMT_ADV_PARAM_TX_POWER;
9596         flags |= MGMT_ADV_PARAM_SCAN_RSP;
9597
9598         /* In extended adv TX_POWER returned from Set Adv Param
9599          * will be always valid.
9600          */
9601         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
9602             ext_adv_capable(hdev))
9603                 flags |= MGMT_ADV_FLAG_TX_POWER;
9604
9605         if (ext_adv_capable(hdev)) {
9606                 flags |= MGMT_ADV_FLAG_SEC_1M;
9607                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
9608                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
9609
9610                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
9611                         flags |= MGMT_ADV_FLAG_SEC_2M;
9612
9613                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
9614                         flags |= MGMT_ADV_FLAG_SEC_CODED;
9615         }
9616
9617         return flags;
9618 }
9619
9620 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
9621                              void *data, u16 data_len)
9622 {
9623         struct mgmt_rp_read_adv_features *rp;
9624         size_t rp_len;
9625         int err;
9626         struct adv_info *adv_instance;
9627         u32 supported_flags;
9628         u8 *instance;
9629
9630         bt_dev_dbg(hdev, "sock %p", sk);
9631
9632         if (!lmp_le_capable(hdev))
9633                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9634                                        MGMT_STATUS_REJECTED);
9635
9636         /* Enabling the experimental LL Privay support disables support for
9637          * advertising.
9638          */
9639         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9640                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9641                                        MGMT_STATUS_NOT_SUPPORTED);
9642
9643         hci_dev_lock(hdev);
9644
9645         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
9646         rp = kmalloc(rp_len, GFP_ATOMIC);
9647         if (!rp) {
9648                 hci_dev_unlock(hdev);
9649                 return -ENOMEM;
9650         }
9651
9652         supported_flags = get_supported_adv_flags(hdev);
9653
9654         rp->supported_flags = cpu_to_le32(supported_flags);
9655         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
9656         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
9657         rp->max_instances = hdev->le_num_of_adv_sets;
9658         rp->num_instances = hdev->adv_instance_cnt;
9659
9660         instance = rp->instance;
9661         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9662                 *instance = adv_instance->instance;
9663                 instance++;
9664         }
9665
9666         hci_dev_unlock(hdev);
9667
9668         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9669                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9670
9671         kfree(rp);
9672
9673         return err;
9674 }
9675
9676 static u8 calculate_name_len(struct hci_dev *hdev)
9677 {
9678         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9679
9680         return append_local_name(hdev, buf, 0);
9681 }
9682
9683 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9684                            bool is_adv_data)
9685 {
9686         u8 max_len = HCI_MAX_AD_LENGTH;
9687
9688         if (is_adv_data) {
9689                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9690                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9691                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9692                         max_len -= 3;
9693
9694                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9695                         max_len -= 3;
9696         } else {
9697                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9698                         max_len -= calculate_name_len(hdev);
9699
9700                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9701                         max_len -= 4;
9702         }
9703
9704         return max_len;
9705 }
9706
9707 static bool flags_managed(u32 adv_flags)
9708 {
9709         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
9710                             MGMT_ADV_FLAG_LIMITED_DISCOV |
9711                             MGMT_ADV_FLAG_MANAGED_FLAGS);
9712 }
9713
9714 static bool tx_power_managed(u32 adv_flags)
9715 {
9716         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
9717 }
9718
9719 static bool name_managed(u32 adv_flags)
9720 {
9721         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
9722 }
9723
9724 static bool appearance_managed(u32 adv_flags)
9725 {
9726         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
9727 }
9728
9729 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
9730                               u8 len, bool is_adv_data)
9731 {
9732         int i, cur_len;
9733         u8 max_len;
9734
9735         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
9736
9737         if (len > max_len)
9738                 return false;
9739
9740         /* Make sure that the data is correctly formatted. */
9741         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
9742                 cur_len = data[i];
9743
9744                 if (!cur_len)
9745                         continue;
9746
9747                 if (data[i + 1] == EIR_FLAGS &&
9748                     (!is_adv_data || flags_managed(adv_flags)))
9749                         return false;
9750
9751                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
9752                         return false;
9753
9754                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
9755                         return false;
9756
9757                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
9758                         return false;
9759
9760                 if (data[i + 1] == EIR_APPEARANCE &&
9761                     appearance_managed(adv_flags))
9762                         return false;
9763
9764                 /* If the current field length would exceed the total data
9765                  * length, then it's invalid.
9766                  */
9767                 if (i + cur_len >= len)
9768                         return false;
9769         }
9770
9771         return true;
9772 }
9773
9774 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
9775 {
9776         u32 supported_flags, phy_flags;
9777
9778         /* The current implementation only supports a subset of the specified
9779          * flags. Also need to check mutual exclusiveness of sec flags.
9780          */
9781         supported_flags = get_supported_adv_flags(hdev);
9782         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
9783         if (adv_flags & ~supported_flags ||
9784             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
9785                 return false;
9786
9787         return true;
9788 }
9789
9790 static bool adv_busy(struct hci_dev *hdev)
9791 {
9792         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
9793                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
9794                 pending_find(MGMT_OP_SET_LE, hdev) ||
9795                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
9796                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
9797 }
9798
9799 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
9800                                      u16 opcode)
9801 {
9802         struct mgmt_pending_cmd *cmd;
9803         struct mgmt_cp_add_advertising *cp;
9804         struct mgmt_rp_add_advertising rp;
9805         struct adv_info *adv_instance, *n;
9806         u8 instance;
9807
9808         bt_dev_dbg(hdev, "status %u", status);
9809
9810         hci_dev_lock(hdev);
9811
9812         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
9813         if (!cmd)
9814                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
9815
9816         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
9817                 if (!adv_instance->pending)
9818                         continue;
9819
9820                 if (!status) {
9821                         adv_instance->pending = false;
9822                         continue;
9823                 }
9824
9825                 instance = adv_instance->instance;
9826
9827                 if (hdev->cur_adv_instance == instance)
9828                         cancel_adv_timeout(hdev);
9829
9830                 hci_remove_adv_instance(hdev, instance);
9831                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
9832         }
9833
9834         if (!cmd)
9835                 goto unlock;
9836
9837         cp = cmd->param;
9838         rp.instance = cp->instance;
9839
9840         if (status)
9841                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9842                                 mgmt_status(status));
9843         else
9844                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9845                                   mgmt_status(status), &rp, sizeof(rp));
9846
9847         mgmt_pending_remove(cmd);
9848
9849 unlock:
9850         hci_dev_unlock(hdev);
9851 }
9852
9853 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
9854                            void *data, u16 data_len)
9855 {
9856         struct mgmt_cp_add_advertising *cp = data;
9857         struct mgmt_rp_add_advertising rp;
9858         u32 flags;
9859         u8 status;
9860         u16 timeout, duration;
9861         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
9862         u8 schedule_instance = 0;
9863         struct adv_info *next_instance;
9864         int err;
9865         struct mgmt_pending_cmd *cmd;
9866         struct hci_request req;
9867
9868         bt_dev_dbg(hdev, "sock %p", sk);
9869
9870         status = mgmt_le_support(hdev);
9871         if (status)
9872                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9873                                        status);
9874
9875         /* Enabling the experimental LL Privay support disables support for
9876          * advertising.
9877          */
9878         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9879                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9880                                        MGMT_STATUS_NOT_SUPPORTED);
9881
9882         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9883                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9884                                        MGMT_STATUS_INVALID_PARAMS);
9885
9886         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9887                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9888                                        MGMT_STATUS_INVALID_PARAMS);
9889
9890         flags = __le32_to_cpu(cp->flags);
9891         timeout = __le16_to_cpu(cp->timeout);
9892         duration = __le16_to_cpu(cp->duration);
9893
9894         if (!requested_adv_flags_are_valid(hdev, flags))
9895                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9896                                        MGMT_STATUS_INVALID_PARAMS);
9897
9898         hci_dev_lock(hdev);
9899
9900         if (timeout && !hdev_is_powered(hdev)) {
9901                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9902                                       MGMT_STATUS_REJECTED);
9903                 goto unlock;
9904         }
9905
9906         if (adv_busy(hdev)) {
9907                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9908                                       MGMT_STATUS_BUSY);
9909                 goto unlock;
9910         }
9911
9912         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9913             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9914                                cp->scan_rsp_len, false)) {
9915                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9916                                       MGMT_STATUS_INVALID_PARAMS);
9917                 goto unlock;
9918         }
9919
9920         err = hci_add_adv_instance(hdev, cp->instance, flags,
9921                                    cp->adv_data_len, cp->data,
9922                                    cp->scan_rsp_len,
9923                                    cp->data + cp->adv_data_len,
9924                                    timeout, duration,
9925                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
9926                                    hdev->le_adv_min_interval,
9927                                    hdev->le_adv_max_interval);
9928         if (err < 0) {
9929                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9930                                       MGMT_STATUS_FAILED);
9931                 goto unlock;
9932         }
9933
9934         /* Only trigger an advertising added event if a new instance was
9935          * actually added.
9936          */
9937         if (hdev->adv_instance_cnt > prev_instance_cnt)
9938                 mgmt_advertising_added(sk, hdev, cp->instance);
9939
9940         if (hdev->cur_adv_instance == cp->instance) {
9941                 /* If the currently advertised instance is being changed then
9942                  * cancel the current advertising and schedule the next
9943                  * instance. If there is only one instance then the overridden
9944                  * advertising data will be visible right away.
9945                  */
9946                 cancel_adv_timeout(hdev);
9947
9948                 next_instance = hci_get_next_instance(hdev, cp->instance);
9949                 if (next_instance)
9950                         schedule_instance = next_instance->instance;
9951         } else if (!hdev->adv_instance_timeout) {
9952                 /* Immediately advertise the new instance if no other
9953                  * instance is currently being advertised.
9954                  */
9955                 schedule_instance = cp->instance;
9956         }
9957
9958         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9959          * there is no instance to be advertised then we have no HCI
9960          * communication to make. Simply return.
9961          */
9962         if (!hdev_is_powered(hdev) ||
9963             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9964             !schedule_instance) {
9965                 rp.instance = cp->instance;
9966                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9967                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9968                 goto unlock;
9969         }
9970
9971         /* We're good to go, update advertising data, parameters, and start
9972          * advertising.
9973          */
9974         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9975                                data_len);
9976         if (!cmd) {
9977                 err = -ENOMEM;
9978                 goto unlock;
9979         }
9980
9981         hci_req_init(&req, hdev);
9982
9983         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
9984
9985         if (!err)
9986                 err = hci_req_run(&req, add_advertising_complete);
9987
9988         if (err < 0) {
9989                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9990                                       MGMT_STATUS_FAILED);
9991                 mgmt_pending_remove(cmd);
9992         }
9993
9994 unlock:
9995         hci_dev_unlock(hdev);
9996
9997         return err;
9998 }
9999
10000 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
10001                                         u16 opcode)
10002 {
10003         struct mgmt_pending_cmd *cmd;
10004         struct mgmt_cp_add_ext_adv_params *cp;
10005         struct mgmt_rp_add_ext_adv_params rp;
10006         struct adv_info *adv_instance;
10007         u32 flags;
10008
10009         BT_DBG("%s", hdev->name);
10010
10011         hci_dev_lock(hdev);
10012
10013         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
10014         if (!cmd)
10015                 goto unlock;
10016
10017         cp = cmd->param;
10018         adv_instance = hci_find_adv_instance(hdev, cp->instance);
10019         if (!adv_instance)
10020                 goto unlock;
10021
10022         rp.instance = cp->instance;
10023         rp.tx_power = adv_instance->tx_power;
10024
10025         /* While we're at it, inform userspace of the available space for this
10026          * advertisement, given the flags that will be used.
10027          */
10028         flags = __le32_to_cpu(cp->flags);
10029         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10030         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10031
10032         if (status) {
10033                 /* If this advertisement was previously advertising and we
10034                  * failed to update it, we signal that it has been removed and
10035                  * delete its structure
10036                  */
10037                 if (!adv_instance->pending)
10038                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
10039
10040                 hci_remove_adv_instance(hdev, cp->instance);
10041
10042                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10043                                 mgmt_status(status));
10044
10045         } else {
10046                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10047                                   mgmt_status(status), &rp, sizeof(rp));
10048         }
10049
10050 unlock:
10051         if (cmd)
10052                 mgmt_pending_remove(cmd);
10053
10054         hci_dev_unlock(hdev);
10055 }
10056
10057 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
10058                               void *data, u16 data_len)
10059 {
10060         struct mgmt_cp_add_ext_adv_params *cp = data;
10061         struct mgmt_rp_add_ext_adv_params rp;
10062         struct mgmt_pending_cmd *cmd = NULL;
10063         struct adv_info *adv_instance;
10064         struct hci_request req;
10065         u32 flags, min_interval, max_interval;
10066         u16 timeout, duration;
10067         u8 status;
10068         s8 tx_power;
10069         int err;
10070
10071         BT_DBG("%s", hdev->name);
10072
10073         status = mgmt_le_support(hdev);
10074         if (status)
10075                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10076                                        status);
10077
10078         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10079                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10080                                        MGMT_STATUS_INVALID_PARAMS);
10081
10082         /* The purpose of breaking add_advertising into two separate MGMT calls
10083          * for params and data is to allow more parameters to be added to this
10084          * structure in the future. For this reason, we verify that we have the
10085          * bare minimum structure we know of when the interface was defined. Any
10086          * extra parameters we don't know about will be ignored in this request.
10087          */
10088         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
10089                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10090                                        MGMT_STATUS_INVALID_PARAMS);
10091
10092         flags = __le32_to_cpu(cp->flags);
10093
10094         if (!requested_adv_flags_are_valid(hdev, flags))
10095                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10096                                        MGMT_STATUS_INVALID_PARAMS);
10097
10098         hci_dev_lock(hdev);
10099
10100         /* In new interface, we require that we are powered to register */
10101         if (!hdev_is_powered(hdev)) {
10102                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10103                                       MGMT_STATUS_REJECTED);
10104                 goto unlock;
10105         }
10106
10107         if (adv_busy(hdev)) {
10108                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10109                                       MGMT_STATUS_BUSY);
10110                 goto unlock;
10111         }
10112
10113         /* Parse defined parameters from request, use defaults otherwise */
10114         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
10115                   __le16_to_cpu(cp->timeout) : 0;
10116
10117         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
10118                    __le16_to_cpu(cp->duration) :
10119                    hdev->def_multi_adv_rotation_duration;
10120
10121         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10122                        __le32_to_cpu(cp->min_interval) :
10123                        hdev->le_adv_min_interval;
10124
10125         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10126                        __le32_to_cpu(cp->max_interval) :
10127                        hdev->le_adv_max_interval;
10128
10129         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
10130                    cp->tx_power :
10131                    HCI_ADV_TX_POWER_NO_PREFERENCE;
10132
10133         /* Create advertising instance with no advertising or response data */
10134         err = hci_add_adv_instance(hdev, cp->instance, flags,
10135                                    0, NULL, 0, NULL, timeout, duration,
10136                                    tx_power, min_interval, max_interval);
10137
10138         if (err < 0) {
10139                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10140                                       MGMT_STATUS_FAILED);
10141                 goto unlock;
10142         }
10143
10144         /* Submit request for advertising params if ext adv available */
10145         if (ext_adv_capable(hdev)) {
10146                 hci_req_init(&req, hdev);
10147                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
10148
10149                 /* Updating parameters of an active instance will return a
10150                  * Command Disallowed error, so we must first disable the
10151                  * instance if it is active.
10152                  */
10153                 if (!adv_instance->pending)
10154                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
10155
10156                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
10157
10158                 err = hci_req_run(&req, add_ext_adv_params_complete);
10159
10160                 if (!err)
10161                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
10162                                                hdev, data, data_len);
10163                 if (!cmd) {
10164                         err = -ENOMEM;
10165                         hci_remove_adv_instance(hdev, cp->instance);
10166                         goto unlock;
10167                 }
10168
10169         } else {
10170                 rp.instance = cp->instance;
10171                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
10172                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10173                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10174                 err = mgmt_cmd_complete(sk, hdev->id,
10175                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
10176                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10177         }
10178
10179 unlock:
10180         hci_dev_unlock(hdev);
10181
10182         return err;
10183 }
10184
10185 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
10186                             u16 data_len)
10187 {
10188         struct mgmt_cp_add_ext_adv_data *cp = data;
10189         struct mgmt_rp_add_ext_adv_data rp;
10190         u8 schedule_instance = 0;
10191         struct adv_info *next_instance;
10192         struct adv_info *adv_instance;
10193         int err = 0;
10194         struct mgmt_pending_cmd *cmd;
10195         struct hci_request req;
10196
10197         BT_DBG("%s", hdev->name);
10198
10199         hci_dev_lock(hdev);
10200
10201         adv_instance = hci_find_adv_instance(hdev, cp->instance);
10202
10203         if (!adv_instance) {
10204                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10205                                       MGMT_STATUS_INVALID_PARAMS);
10206                 goto unlock;
10207         }
10208
10209         /* In new interface, we require that we are powered to register */
10210         if (!hdev_is_powered(hdev)) {
10211                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10212                                       MGMT_STATUS_REJECTED);
10213                 goto clear_new_instance;
10214         }
10215
10216         if (adv_busy(hdev)) {
10217                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10218                                       MGMT_STATUS_BUSY);
10219                 goto clear_new_instance;
10220         }
10221
10222         /* Validate new data */
10223         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
10224                                cp->adv_data_len, true) ||
10225             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
10226                                cp->adv_data_len, cp->scan_rsp_len, false)) {
10227                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10228                                       MGMT_STATUS_INVALID_PARAMS);
10229                 goto clear_new_instance;
10230         }
10231
10232         /* Set the data in the advertising instance */
10233         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
10234                                   cp->data, cp->scan_rsp_len,
10235                                   cp->data + cp->adv_data_len);
10236
10237         /* We're good to go, update advertising data, parameters, and start
10238          * advertising.
10239          */
10240
10241         hci_req_init(&req, hdev);
10242
10243         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
10244
10245         if (ext_adv_capable(hdev)) {
10246                 __hci_req_update_adv_data(&req, cp->instance);
10247                 __hci_req_update_scan_rsp_data(&req, cp->instance);
10248                 __hci_req_enable_ext_advertising(&req, cp->instance);
10249
10250         } else {
10251                 /* If using software rotation, determine next instance to use */
10252
10253                 if (hdev->cur_adv_instance == cp->instance) {
10254                         /* If the currently advertised instance is being changed
10255                          * then cancel the current advertising and schedule the
10256                          * next instance. If there is only one instance then the
10257                          * overridden advertising data will be visible right
10258                          * away
10259                          */
10260                         cancel_adv_timeout(hdev);
10261
10262                         next_instance = hci_get_next_instance(hdev,
10263                                                               cp->instance);
10264                         if (next_instance)
10265                                 schedule_instance = next_instance->instance;
10266                 } else if (!hdev->adv_instance_timeout) {
10267                         /* Immediately advertise the new instance if no other
10268                          * instance is currently being advertised.
10269                          */
10270                         schedule_instance = cp->instance;
10271                 }
10272
10273                 /* If the HCI_ADVERTISING flag is set or there is no instance to
10274                  * be advertised then we have no HCI communication to make.
10275                  * Simply return.
10276                  */
10277                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
10278                     !schedule_instance) {
10279                         if (adv_instance->pending) {
10280                                 mgmt_advertising_added(sk, hdev, cp->instance);
10281                                 adv_instance->pending = false;
10282                         }
10283                         rp.instance = cp->instance;
10284                         err = mgmt_cmd_complete(sk, hdev->id,
10285                                                 MGMT_OP_ADD_EXT_ADV_DATA,
10286                                                 MGMT_STATUS_SUCCESS, &rp,
10287                                                 sizeof(rp));
10288                         goto unlock;
10289                 }
10290
10291                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
10292                                                       true);
10293         }
10294
10295         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
10296                                data_len);
10297         if (!cmd) {
10298                 err = -ENOMEM;
10299                 goto clear_new_instance;
10300         }
10301
10302         if (!err)
10303                 err = hci_req_run(&req, add_advertising_complete);
10304
10305         if (err < 0) {
10306                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10307                                       MGMT_STATUS_FAILED);
10308                 mgmt_pending_remove(cmd);
10309                 goto clear_new_instance;
10310         }
10311
10312         /* We were successful in updating data, so trigger advertising_added
10313          * event if this is an instance that wasn't previously advertising. If
10314          * a failure occurs in the requests we initiated, we will remove the
10315          * instance again in add_advertising_complete
10316          */
10317         if (adv_instance->pending)
10318                 mgmt_advertising_added(sk, hdev, cp->instance);
10319
10320         goto unlock;
10321
10322 clear_new_instance:
10323         hci_remove_adv_instance(hdev, cp->instance);
10324
10325 unlock:
10326         hci_dev_unlock(hdev);
10327
10328         return err;
10329 }
10330
10331 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
10332                                         u16 opcode)
10333 {
10334         struct mgmt_pending_cmd *cmd;
10335         struct mgmt_cp_remove_advertising *cp;
10336         struct mgmt_rp_remove_advertising rp;
10337
10338         bt_dev_dbg(hdev, "status %u", status);
10339
10340         hci_dev_lock(hdev);
10341
10342         /* A failure status here only means that we failed to disable
10343          * advertising. Otherwise, the advertising instance has been removed,
10344          * so report success.
10345          */
10346         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
10347         if (!cmd)
10348                 goto unlock;
10349
10350         cp = cmd->param;
10351         rp.instance = cp->instance;
10352
10353         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
10354                           &rp, sizeof(rp));
10355         mgmt_pending_remove(cmd);
10356
10357 unlock:
10358         hci_dev_unlock(hdev);
10359 }
10360
10361 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
10362                               void *data, u16 data_len)
10363 {
10364         struct mgmt_cp_remove_advertising *cp = data;
10365         struct mgmt_rp_remove_advertising rp;
10366         struct mgmt_pending_cmd *cmd;
10367         struct hci_request req;
10368         int err;
10369
10370         bt_dev_dbg(hdev, "sock %p", sk);
10371
10372         /* Enabling the experimental LL Privay support disables support for
10373          * advertising.
10374          */
10375         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
10376                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
10377                                        MGMT_STATUS_NOT_SUPPORTED);
10378
10379         hci_dev_lock(hdev);
10380
10381         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
10382                 err = mgmt_cmd_status(sk, hdev->id,
10383                                       MGMT_OP_REMOVE_ADVERTISING,
10384                                       MGMT_STATUS_INVALID_PARAMS);
10385                 goto unlock;
10386         }
10387
10388         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
10389             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
10390             pending_find(MGMT_OP_SET_LE, hdev)) {
10391                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10392                                       MGMT_STATUS_BUSY);
10393                 goto unlock;
10394         }
10395
10396         if (list_empty(&hdev->adv_instances)) {
10397                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10398                                       MGMT_STATUS_INVALID_PARAMS);
10399                 goto unlock;
10400         }
10401
10402         hci_req_init(&req, hdev);
10403
10404         /* If we use extended advertising, instance is disabled and removed */
10405         if (ext_adv_capable(hdev)) {
10406                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
10407                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
10408         }
10409
10410         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
10411
10412         if (list_empty(&hdev->adv_instances))
10413                 __hci_req_disable_advertising(&req);
10414
10415         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
10416          * flag is set or the device isn't powered then we have no HCI
10417          * communication to make. Simply return.
10418          */
10419         if (skb_queue_empty(&req.cmd_q) ||
10420             !hdev_is_powered(hdev) ||
10421             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
10422                 hci_req_purge(&req);
10423                 rp.instance = cp->instance;
10424                 err = mgmt_cmd_complete(sk, hdev->id,
10425                                         MGMT_OP_REMOVE_ADVERTISING,
10426                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10427                 goto unlock;
10428         }
10429
10430         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
10431                                data_len);
10432         if (!cmd) {
10433                 err = -ENOMEM;
10434                 goto unlock;
10435         }
10436
10437         err = hci_req_run(&req, remove_advertising_complete);
10438         if (err < 0)
10439                 mgmt_pending_remove(cmd);
10440
10441 unlock:
10442         hci_dev_unlock(hdev);
10443
10444         return err;
10445 }
10446
10447 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
10448                              void *data, u16 data_len)
10449 {
10450         struct mgmt_cp_get_adv_size_info *cp = data;
10451         struct mgmt_rp_get_adv_size_info rp;
10452         u32 flags, supported_flags;
10453         int err;
10454
10455         bt_dev_dbg(hdev, "sock %p", sk);
10456
10457         if (!lmp_le_capable(hdev))
10458                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10459                                        MGMT_STATUS_REJECTED);
10460
10461         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10462                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10463                                        MGMT_STATUS_INVALID_PARAMS);
10464
10465         flags = __le32_to_cpu(cp->flags);
10466
10467         /* The current implementation only supports a subset of the specified
10468          * flags.
10469          */
10470         supported_flags = get_supported_adv_flags(hdev);
10471         if (flags & ~supported_flags)
10472                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10473                                        MGMT_STATUS_INVALID_PARAMS);
10474
10475         rp.instance = cp->instance;
10476         rp.flags = cp->flags;
10477         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10478         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10479
10480         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10481                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10482
10483         return err;
10484 }
10485
10486 static const struct hci_mgmt_handler mgmt_handlers[] = {
10487         { NULL }, /* 0x0000 (no command) */
10488         { read_version,            MGMT_READ_VERSION_SIZE,
10489                                                 HCI_MGMT_NO_HDEV |
10490                                                 HCI_MGMT_UNTRUSTED },
10491         { read_commands,           MGMT_READ_COMMANDS_SIZE,
10492                                                 HCI_MGMT_NO_HDEV |
10493                                                 HCI_MGMT_UNTRUSTED },
10494         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
10495                                                 HCI_MGMT_NO_HDEV |
10496                                                 HCI_MGMT_UNTRUSTED },
10497         { read_controller_info,    MGMT_READ_INFO_SIZE,
10498                                                 HCI_MGMT_UNTRUSTED },
10499         { set_powered,             MGMT_SETTING_SIZE },
10500         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
10501         { set_connectable,         MGMT_SETTING_SIZE },
10502         { set_fast_connectable,    MGMT_SETTING_SIZE },
10503         { set_bondable,            MGMT_SETTING_SIZE },
10504         { set_link_security,       MGMT_SETTING_SIZE },
10505         { set_ssp,                 MGMT_SETTING_SIZE },
10506         { set_hs,                  MGMT_SETTING_SIZE },
10507         { set_le,                  MGMT_SETTING_SIZE },
10508         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
10509         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
10510         { add_uuid,                MGMT_ADD_UUID_SIZE },
10511         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
10512         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
10513                                                 HCI_MGMT_VAR_LEN },
10514         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
10515                                                 HCI_MGMT_VAR_LEN },
10516         { disconnect,              MGMT_DISCONNECT_SIZE },
10517         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
10518         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
10519         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
10520         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
10521         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
10522         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
10523         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
10524         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
10525         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
10526         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
10527         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
10528         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
10529         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
10530                                                 HCI_MGMT_VAR_LEN },
10531         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
10532         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
10533         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
10534         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
10535         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
10536         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
10537         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
10538         { set_advertising,         MGMT_SETTING_SIZE },
10539         { set_bredr,               MGMT_SETTING_SIZE },
10540         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
10541         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
10542         { set_secure_conn,         MGMT_SETTING_SIZE },
10543         { set_debug_keys,          MGMT_SETTING_SIZE },
10544         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
10545         { load_irks,               MGMT_LOAD_IRKS_SIZE,
10546                                                 HCI_MGMT_VAR_LEN },
10547         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
10548         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
10549         { add_device,              MGMT_ADD_DEVICE_SIZE },
10550         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
10551         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
10552                                                 HCI_MGMT_VAR_LEN },
10553         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
10554                                                 HCI_MGMT_NO_HDEV |
10555                                                 HCI_MGMT_UNTRUSTED },
10556         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
10557                                                 HCI_MGMT_UNCONFIGURED |
10558                                                 HCI_MGMT_UNTRUSTED },
10559         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
10560                                                 HCI_MGMT_UNCONFIGURED },
10561         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
10562                                                 HCI_MGMT_UNCONFIGURED },
10563         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
10564                                                 HCI_MGMT_VAR_LEN },
10565         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
10566         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
10567                                                 HCI_MGMT_NO_HDEV |
10568                                                 HCI_MGMT_UNTRUSTED },
10569         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
10570         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
10571                                                 HCI_MGMT_VAR_LEN },
10572         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
10573         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
10574         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
10575         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
10576                                                 HCI_MGMT_UNTRUSTED },
10577         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
10578         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
10579         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
10580         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
10581                                                 HCI_MGMT_VAR_LEN },
10582         { set_wideband_speech,     MGMT_SETTING_SIZE },
10583         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
10584                                                 HCI_MGMT_UNTRUSTED },
10585         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
10586                                                 HCI_MGMT_UNTRUSTED |
10587                                                 HCI_MGMT_HDEV_OPTIONAL },
10588         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
10589                                                 HCI_MGMT_VAR_LEN |
10590                                                 HCI_MGMT_HDEV_OPTIONAL },
10591         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
10592                                                 HCI_MGMT_UNTRUSTED },
10593         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
10594                                                 HCI_MGMT_VAR_LEN },
10595         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
10596                                                 HCI_MGMT_UNTRUSTED },
10597         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
10598                                                 HCI_MGMT_VAR_LEN },
10599         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
10600         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
10601         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
10602         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
10603                                                 HCI_MGMT_VAR_LEN },
10604         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
10605         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
10606                                                 HCI_MGMT_VAR_LEN },
10607         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
10608                                                 HCI_MGMT_VAR_LEN },
10609         { add_adv_patterns_monitor_rssi,
10610                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
10611                                                 HCI_MGMT_VAR_LEN },
10612 };
10613
10614 #ifdef TIZEN_BT
10615 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
10616         { NULL }, /* 0x0000 (no command) */
10617         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
10618         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
10619                                                 HCI_MGMT_VAR_LEN },
10620         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
10621                                                 HCI_MGMT_VAR_LEN },
10622         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
10623         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
10624         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
10625         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
10626         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
10627         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
10628         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
10629         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
10630         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
10631         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
10632         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
10633         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
10634         { set_voice_setting,       MGMT_SET_VOICE_SETTING_SIZE },
10635         { get_adv_tx_power,        MGMT_GET_ADV_TX_POWER_SIZE },
10636         { enable_bt_6lowpan,       MGMT_ENABLE_BT_6LOWPAN_SIZE },
10637         { connect_bt_6lowpan,      MGMT_CONNECT_6LOWPAN_SIZE },
10638         { disconnect_bt_6lowpan,   MGMT_DISCONNECT_6LOWPAN_SIZE },
10639         { read_maximum_le_data_length,
10640                                    MGMT_LE_READ_MAXIMUM_DATA_LENGTH_SIZE },
10641 };
10642 #endif
10643
10644 void mgmt_index_added(struct hci_dev *hdev)
10645 {
10646         struct mgmt_ev_ext_index ev;
10647
10648         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10649                 return;
10650
10651         switch (hdev->dev_type) {
10652         case HCI_PRIMARY:
10653                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10654                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
10655                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10656                         ev.type = 0x01;
10657                 } else {
10658                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
10659                                          HCI_MGMT_INDEX_EVENTS);
10660                         ev.type = 0x00;
10661                 }
10662                 break;
10663         case HCI_AMP:
10664                 ev.type = 0x02;
10665                 break;
10666         default:
10667                 return;
10668         }
10669
10670         ev.bus = hdev->bus;
10671
10672         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
10673                          HCI_MGMT_EXT_INDEX_EVENTS);
10674 }
10675
10676 void mgmt_index_removed(struct hci_dev *hdev)
10677 {
10678         struct mgmt_ev_ext_index ev;
10679         u8 status = MGMT_STATUS_INVALID_INDEX;
10680
10681         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10682                 return;
10683
10684         switch (hdev->dev_type) {
10685         case HCI_PRIMARY:
10686                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10687
10688                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10689                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
10690                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10691                         ev.type = 0x01;
10692                 } else {
10693                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
10694                                          HCI_MGMT_INDEX_EVENTS);
10695                         ev.type = 0x00;
10696                 }
10697                 break;
10698         case HCI_AMP:
10699                 ev.type = 0x02;
10700                 break;
10701         default:
10702                 return;
10703         }
10704
10705         ev.bus = hdev->bus;
10706
10707         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
10708                          HCI_MGMT_EXT_INDEX_EVENTS);
10709 }
10710
10711 /* This function requires the caller holds hdev->lock */
10712 static void restart_le_actions(struct hci_dev *hdev)
10713 {
10714         struct hci_conn_params *p;
10715
10716         list_for_each_entry(p, &hdev->le_conn_params, list) {
10717                 /* Needed for AUTO_OFF case where might not "really"
10718                  * have been powered off.
10719                  */
10720                 list_del_init(&p->action);
10721
10722                 switch (p->auto_connect) {
10723                 case HCI_AUTO_CONN_DIRECT:
10724                 case HCI_AUTO_CONN_ALWAYS:
10725                         list_add(&p->action, &hdev->pend_le_conns);
10726                         break;
10727                 case HCI_AUTO_CONN_REPORT:
10728                         list_add(&p->action, &hdev->pend_le_reports);
10729                         break;
10730                 default:
10731                         break;
10732                 }
10733         }
10734 }
10735
10736 void mgmt_power_on(struct hci_dev *hdev, int err)
10737 {
10738         struct cmd_lookup match = { NULL, hdev };
10739
10740         bt_dev_dbg(hdev, "err %d", err);
10741
10742         hci_dev_lock(hdev);
10743
10744         if (!err) {
10745                 restart_le_actions(hdev);
10746                 hci_update_background_scan(hdev);
10747         }
10748
10749         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10750
10751         new_settings(hdev, match.sk);
10752
10753         if (match.sk)
10754                 sock_put(match.sk);
10755
10756         hci_dev_unlock(hdev);
10757 }
10758
10759 void __mgmt_power_off(struct hci_dev *hdev)
10760 {
10761         struct cmd_lookup match = { NULL, hdev };
10762         u8 status, zero_cod[] = { 0, 0, 0 };
10763
10764         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10765
10766         /* If the power off is because of hdev unregistration let
10767          * use the appropriate INVALID_INDEX status. Otherwise use
10768          * NOT_POWERED. We cover both scenarios here since later in
10769          * mgmt_index_removed() any hci_conn callbacks will have already
10770          * been triggered, potentially causing misleading DISCONNECTED
10771          * status responses.
10772          */
10773         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
10774                 status = MGMT_STATUS_INVALID_INDEX;
10775         else
10776                 status = MGMT_STATUS_NOT_POWERED;
10777
10778         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10779
10780         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
10781                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
10782                                    zero_cod, sizeof(zero_cod),
10783                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10784                 ext_info_changed(hdev, NULL);
10785         }
10786
10787         new_settings(hdev, match.sk);
10788
10789         if (match.sk)
10790                 sock_put(match.sk);
10791 }
10792
10793 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
10794 {
10795         struct mgmt_pending_cmd *cmd;
10796         u8 status;
10797
10798         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10799         if (!cmd)
10800                 return;
10801
10802         if (err == -ERFKILL)
10803                 status = MGMT_STATUS_RFKILLED;
10804         else
10805                 status = MGMT_STATUS_FAILED;
10806
10807         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
10808
10809         mgmt_pending_remove(cmd);
10810 }
10811
10812 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
10813                        bool persistent)
10814 {
10815         struct mgmt_ev_new_link_key ev;
10816
10817         memset(&ev, 0, sizeof(ev));
10818
10819         ev.store_hint = persistent;
10820         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10821         ev.key.addr.type = BDADDR_BREDR;
10822         ev.key.type = key->type;
10823         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
10824         ev.key.pin_len = key->pin_len;
10825
10826         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
10827 }
10828
10829 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
10830 {
10831         switch (ltk->type) {
10832         case SMP_LTK:
10833         case SMP_LTK_RESPONDER:
10834                 if (ltk->authenticated)
10835                         return MGMT_LTK_AUTHENTICATED;
10836                 return MGMT_LTK_UNAUTHENTICATED;
10837         case SMP_LTK_P256:
10838                 if (ltk->authenticated)
10839                         return MGMT_LTK_P256_AUTH;
10840                 return MGMT_LTK_P256_UNAUTH;
10841         case SMP_LTK_P256_DEBUG:
10842                 return MGMT_LTK_P256_DEBUG;
10843         }
10844
10845         return MGMT_LTK_UNAUTHENTICATED;
10846 }
10847
10848 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
10849 {
10850         struct mgmt_ev_new_long_term_key ev;
10851
10852         memset(&ev, 0, sizeof(ev));
10853
10854         /* Devices using resolvable or non-resolvable random addresses
10855          * without providing an identity resolving key don't require
10856          * to store long term keys. Their addresses will change the
10857          * next time around.
10858          *
10859          * Only when a remote device provides an identity address
10860          * make sure the long term key is stored. If the remote
10861          * identity is known, the long term keys are internally
10862          * mapped to the identity address. So allow static random
10863          * and public addresses here.
10864          */
10865         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10866             (key->bdaddr.b[5] & 0xc0) != 0xc0)
10867                 ev.store_hint = 0x00;
10868         else
10869                 ev.store_hint = persistent;
10870
10871         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10872         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
10873         ev.key.type = mgmt_ltk_type(key);
10874         ev.key.enc_size = key->enc_size;
10875         ev.key.ediv = key->ediv;
10876         ev.key.rand = key->rand;
10877
10878         if (key->type == SMP_LTK)
10879                 ev.key.initiator = 1;
10880
10881         /* Make sure we copy only the significant bytes based on the
10882          * encryption key size, and set the rest of the value to zeroes.
10883          */
10884         memcpy(ev.key.val, key->val, key->enc_size);
10885         memset(ev.key.val + key->enc_size, 0,
10886                sizeof(ev.key.val) - key->enc_size);
10887
10888         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
10889 }
10890
10891 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
10892 {
10893         struct mgmt_ev_new_irk ev;
10894
10895         memset(&ev, 0, sizeof(ev));
10896
10897         ev.store_hint = persistent;
10898
10899         bacpy(&ev.rpa, &irk->rpa);
10900         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
10901         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
10902         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
10903
10904         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
10905 }
10906
10907 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
10908                    bool persistent)
10909 {
10910         struct mgmt_ev_new_csrk ev;
10911
10912         memset(&ev, 0, sizeof(ev));
10913
10914         /* Devices using resolvable or non-resolvable random addresses
10915          * without providing an identity resolving key don't require
10916          * to store signature resolving keys. Their addresses will change
10917          * the next time around.
10918          *
10919          * Only when a remote device provides an identity address
10920          * make sure the signature resolving key is stored. So allow
10921          * static random and public addresses here.
10922          */
10923         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10924             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
10925                 ev.store_hint = 0x00;
10926         else
10927                 ev.store_hint = persistent;
10928
10929         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
10930         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
10931         ev.key.type = csrk->type;
10932         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
10933
10934         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
10935 }
10936
10937 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
10938                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
10939                          u16 max_interval, u16 latency, u16 timeout)
10940 {
10941         struct mgmt_ev_new_conn_param ev;
10942
10943         if (!hci_is_identity_address(bdaddr, bdaddr_type))
10944                 return;
10945
10946         memset(&ev, 0, sizeof(ev));
10947         bacpy(&ev.addr.bdaddr, bdaddr);
10948         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
10949         ev.store_hint = store_hint;
10950         ev.min_interval = cpu_to_le16(min_interval);
10951         ev.max_interval = cpu_to_le16(max_interval);
10952         ev.latency = cpu_to_le16(latency);
10953         ev.timeout = cpu_to_le16(timeout);
10954
10955         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
10956 }
10957
10958 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
10959                            u8 *name, u8 name_len)
10960 {
10961         char buf[512];
10962         struct mgmt_ev_device_connected *ev = (void *) buf;
10963         u16 eir_len = 0;
10964         u32 flags = 0;
10965
10966         bacpy(&ev->addr.bdaddr, &conn->dst);
10967         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10968
10969         if (conn->out)
10970                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
10971
10972         ev->flags = __cpu_to_le32(flags);
10973
10974         /* We must ensure that the EIR Data fields are ordered and
10975          * unique. Keep it simple for now and avoid the problem by not
10976          * adding any BR/EDR data to the LE adv.
10977          */
10978         if (conn->le_adv_data_len > 0) {
10979                 memcpy(&ev->eir[eir_len],
10980                        conn->le_adv_data, conn->le_adv_data_len);
10981                 eir_len = conn->le_adv_data_len;
10982         } else {
10983                 if (name_len > 0)
10984                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
10985                                                   name, name_len);
10986
10987                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
10988                         eir_len = eir_append_data(ev->eir, eir_len,
10989                                                   EIR_CLASS_OF_DEV,
10990                                                   conn->dev_class, 3);
10991         }
10992
10993         ev->eir_len = cpu_to_le16(eir_len);
10994
10995         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
10996                     sizeof(*ev) + eir_len, NULL);
10997 }
10998
10999 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
11000 {
11001         struct sock **sk = data;
11002
11003         cmd->cmd_complete(cmd, 0);
11004
11005         *sk = cmd->sk;
11006         sock_hold(*sk);
11007
11008         mgmt_pending_remove(cmd);
11009 }
11010
11011 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
11012 {
11013         struct hci_dev *hdev = data;
11014         struct mgmt_cp_unpair_device *cp = cmd->param;
11015
11016         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
11017
11018         cmd->cmd_complete(cmd, 0);
11019         mgmt_pending_remove(cmd);
11020 }
11021
11022 bool mgmt_powering_down(struct hci_dev *hdev)
11023 {
11024         struct mgmt_pending_cmd *cmd;
11025         struct mgmt_mode *cp;
11026
11027         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11028         if (!cmd)
11029                 return false;
11030
11031         cp = cmd->param;
11032         if (!cp->val)
11033                 return true;
11034
11035         return false;
11036 }
11037
11038 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
11039                               u8 link_type, u8 addr_type, u8 reason,
11040                               bool mgmt_connected)
11041 {
11042         struct mgmt_ev_device_disconnected ev;
11043         struct sock *sk = NULL;
11044
11045         /* The connection is still in hci_conn_hash so test for 1
11046          * instead of 0 to know if this is the last one.
11047          */
11048         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11049                 cancel_delayed_work(&hdev->power_off);
11050                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11051         }
11052
11053         if (!mgmt_connected)
11054                 return;
11055
11056         if (link_type != ACL_LINK && link_type != LE_LINK)
11057                 return;
11058
11059         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
11060
11061         bacpy(&ev.addr.bdaddr, bdaddr);
11062         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11063         ev.reason = reason;
11064
11065         /* Report disconnects due to suspend */
11066         if (hdev->suspended)
11067                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
11068
11069         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
11070
11071         if (sk)
11072                 sock_put(sk);
11073
11074         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11075                              hdev);
11076 }
11077
11078 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
11079                             u8 link_type, u8 addr_type, u8 status)
11080 {
11081         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
11082         struct mgmt_cp_disconnect *cp;
11083         struct mgmt_pending_cmd *cmd;
11084
11085         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11086                              hdev);
11087
11088         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
11089         if (!cmd)
11090                 return;
11091
11092         cp = cmd->param;
11093
11094         if (bacmp(bdaddr, &cp->addr.bdaddr))
11095                 return;
11096
11097         if (cp->addr.type != bdaddr_type)
11098                 return;
11099
11100         cmd->cmd_complete(cmd, mgmt_status(status));
11101         mgmt_pending_remove(cmd);
11102 }
11103
11104 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11105                          u8 addr_type, u8 status)
11106 {
11107         struct mgmt_ev_connect_failed ev;
11108
11109         /* The connection is still in hci_conn_hash so test for 1
11110          * instead of 0 to know if this is the last one.
11111          */
11112         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11113                 cancel_delayed_work(&hdev->power_off);
11114                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11115         }
11116
11117         bacpy(&ev.addr.bdaddr, bdaddr);
11118         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11119         ev.status = mgmt_status(status);
11120
11121         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
11122 }
11123
11124 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
11125 {
11126         struct mgmt_ev_pin_code_request ev;
11127
11128         bacpy(&ev.addr.bdaddr, bdaddr);
11129         ev.addr.type = BDADDR_BREDR;
11130         ev.secure = secure;
11131
11132         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
11133 }
11134
11135 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11136                                   u8 status)
11137 {
11138         struct mgmt_pending_cmd *cmd;
11139
11140         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
11141         if (!cmd)
11142                 return;
11143
11144         cmd->cmd_complete(cmd, mgmt_status(status));
11145         mgmt_pending_remove(cmd);
11146 }
11147
11148 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11149                                       u8 status)
11150 {
11151         struct mgmt_pending_cmd *cmd;
11152
11153         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
11154         if (!cmd)
11155                 return;
11156
11157         cmd->cmd_complete(cmd, mgmt_status(status));
11158         mgmt_pending_remove(cmd);
11159 }
11160
11161 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11162                               u8 link_type, u8 addr_type, u32 value,
11163                               u8 confirm_hint)
11164 {
11165         struct mgmt_ev_user_confirm_request ev;
11166
11167         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11168
11169         bacpy(&ev.addr.bdaddr, bdaddr);
11170         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11171         ev.confirm_hint = confirm_hint;
11172         ev.value = cpu_to_le32(value);
11173
11174         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
11175                           NULL);
11176 }
11177
11178 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11179                               u8 link_type, u8 addr_type)
11180 {
11181         struct mgmt_ev_user_passkey_request ev;
11182
11183         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11184
11185         bacpy(&ev.addr.bdaddr, bdaddr);
11186         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11187
11188         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
11189                           NULL);
11190 }
11191
11192 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11193                                       u8 link_type, u8 addr_type, u8 status,
11194                                       u8 opcode)
11195 {
11196         struct mgmt_pending_cmd *cmd;
11197
11198         cmd = pending_find(opcode, hdev);
11199         if (!cmd)
11200                 return -ENOENT;
11201
11202         cmd->cmd_complete(cmd, mgmt_status(status));
11203         mgmt_pending_remove(cmd);
11204
11205         return 0;
11206 }
11207
11208 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11209                                      u8 link_type, u8 addr_type, u8 status)
11210 {
11211         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11212                                           status, MGMT_OP_USER_CONFIRM_REPLY);
11213 }
11214
11215 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11216                                          u8 link_type, u8 addr_type, u8 status)
11217 {
11218         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11219                                           status,
11220                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
11221 }
11222
11223 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11224                                      u8 link_type, u8 addr_type, u8 status)
11225 {
11226         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11227                                           status, MGMT_OP_USER_PASSKEY_REPLY);
11228 }
11229
11230 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11231                                          u8 link_type, u8 addr_type, u8 status)
11232 {
11233         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11234                                           status,
11235                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
11236 }
11237
11238 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
11239                              u8 link_type, u8 addr_type, u32 passkey,
11240                              u8 entered)
11241 {
11242         struct mgmt_ev_passkey_notify ev;
11243
11244         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11245
11246         bacpy(&ev.addr.bdaddr, bdaddr);
11247         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11248         ev.passkey = __cpu_to_le32(passkey);
11249         ev.entered = entered;
11250
11251         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
11252 }
11253
11254 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
11255 {
11256         struct mgmt_ev_auth_failed ev;
11257         struct mgmt_pending_cmd *cmd;
11258         u8 status = mgmt_status(hci_status);
11259
11260         bacpy(&ev.addr.bdaddr, &conn->dst);
11261         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11262         ev.status = status;
11263
11264         cmd = find_pairing(conn);
11265
11266         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
11267                     cmd ? cmd->sk : NULL);
11268
11269         if (cmd) {
11270                 cmd->cmd_complete(cmd, status);
11271                 mgmt_pending_remove(cmd);
11272         }
11273 }
11274
11275 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
11276 {
11277         struct cmd_lookup match = { NULL, hdev };
11278         bool changed;
11279
11280         if (status) {
11281                 u8 mgmt_err = mgmt_status(status);
11282                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
11283                                      cmd_status_rsp, &mgmt_err);
11284                 return;
11285         }
11286
11287         if (test_bit(HCI_AUTH, &hdev->flags))
11288                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
11289         else
11290                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
11291
11292         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
11293                              &match);
11294
11295         if (changed)
11296                 new_settings(hdev, match.sk);
11297
11298         if (match.sk)
11299                 sock_put(match.sk);
11300 }
11301
11302 static void clear_eir(struct hci_request *req)
11303 {
11304         struct hci_dev *hdev = req->hdev;
11305         struct hci_cp_write_eir cp;
11306
11307         if (!lmp_ext_inq_capable(hdev))
11308                 return;
11309
11310         memset(hdev->eir, 0, sizeof(hdev->eir));
11311
11312         memset(&cp, 0, sizeof(cp));
11313
11314         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
11315 }
11316
11317 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
11318 {
11319         struct cmd_lookup match = { NULL, hdev };
11320         struct hci_request req;
11321         bool changed = false;
11322
11323         if (status) {
11324                 u8 mgmt_err = mgmt_status(status);
11325
11326                 if (enable && hci_dev_test_and_clear_flag(hdev,
11327                                                           HCI_SSP_ENABLED)) {
11328                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
11329                         new_settings(hdev, NULL);
11330                 }
11331
11332                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
11333                                      &mgmt_err);
11334                 return;
11335         }
11336
11337         if (enable) {
11338                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
11339         } else {
11340                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
11341                 if (!changed)
11342                         changed = hci_dev_test_and_clear_flag(hdev,
11343                                                               HCI_HS_ENABLED);
11344                 else
11345                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
11346         }
11347
11348         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
11349
11350         if (changed)
11351                 new_settings(hdev, match.sk);
11352
11353         if (match.sk)
11354                 sock_put(match.sk);
11355
11356         hci_req_init(&req, hdev);
11357
11358         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
11359                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
11360                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
11361                                     sizeof(enable), &enable);
11362                 __hci_req_update_eir(&req);
11363         } else {
11364                 clear_eir(&req);
11365         }
11366
11367         hci_req_run(&req, NULL);
11368 }
11369
11370 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
11371 {
11372         struct cmd_lookup *match = data;
11373
11374         if (match->sk == NULL) {
11375                 match->sk = cmd->sk;
11376                 sock_hold(match->sk);
11377         }
11378 }
11379
11380 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
11381                                     u8 status)
11382 {
11383         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
11384
11385         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
11386         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
11387         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
11388
11389         if (!status) {
11390                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
11391                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11392                 ext_info_changed(hdev, NULL);
11393         }
11394
11395         if (match.sk)
11396                 sock_put(match.sk);
11397 }
11398
11399 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
11400 {
11401         struct mgmt_cp_set_local_name ev;
11402         struct mgmt_pending_cmd *cmd;
11403
11404         if (status)
11405                 return;
11406
11407         memset(&ev, 0, sizeof(ev));
11408         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
11409         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
11410
11411         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
11412         if (!cmd) {
11413                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
11414
11415                 /* If this is a HCI command related to powering on the
11416                  * HCI dev don't send any mgmt signals.
11417                  */
11418                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
11419                         return;
11420         }
11421
11422         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
11423                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
11424         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
11425 }
11426
11427 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
11428 {
11429         int i;
11430
11431         for (i = 0; i < uuid_count; i++) {
11432                 if (!memcmp(uuid, uuids[i], 16))
11433                         return true;
11434         }
11435
11436         return false;
11437 }
11438
11439 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
11440 {
11441         u16 parsed = 0;
11442
11443         while (parsed < eir_len) {
11444                 u8 field_len = eir[0];
11445                 u8 uuid[16];
11446                 int i;
11447
11448                 if (field_len == 0)
11449                         break;
11450
11451                 if (eir_len - parsed < field_len + 1)
11452                         break;
11453
11454                 switch (eir[1]) {
11455                 case EIR_UUID16_ALL:
11456                 case EIR_UUID16_SOME:
11457                         for (i = 0; i + 3 <= field_len; i += 2) {
11458                                 memcpy(uuid, bluetooth_base_uuid, 16);
11459                                 uuid[13] = eir[i + 3];
11460                                 uuid[12] = eir[i + 2];
11461                                 if (has_uuid(uuid, uuid_count, uuids))
11462                                         return true;
11463                         }
11464                         break;
11465                 case EIR_UUID32_ALL:
11466                 case EIR_UUID32_SOME:
11467                         for (i = 0; i + 5 <= field_len; i += 4) {
11468                                 memcpy(uuid, bluetooth_base_uuid, 16);
11469                                 uuid[15] = eir[i + 5];
11470                                 uuid[14] = eir[i + 4];
11471                                 uuid[13] = eir[i + 3];
11472                                 uuid[12] = eir[i + 2];
11473                                 if (has_uuid(uuid, uuid_count, uuids))
11474                                         return true;
11475                         }
11476                         break;
11477                 case EIR_UUID128_ALL:
11478                 case EIR_UUID128_SOME:
11479                         for (i = 0; i + 17 <= field_len; i += 16) {
11480                                 memcpy(uuid, eir + i + 2, 16);
11481                                 if (has_uuid(uuid, uuid_count, uuids))
11482                                         return true;
11483                         }
11484                         break;
11485                 }
11486
11487                 parsed += field_len + 1;
11488                 eir += field_len + 1;
11489         }
11490
11491         return false;
11492 }
11493
11494 static void restart_le_scan(struct hci_dev *hdev)
11495 {
11496         /* If controller is not scanning we are done. */
11497         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
11498                 return;
11499
11500         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
11501                        hdev->discovery.scan_start +
11502                        hdev->discovery.scan_duration))
11503                 return;
11504
11505         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
11506                            DISCOV_LE_RESTART_DELAY);
11507 }
11508
11509 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
11510                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11511 {
11512         /* If a RSSI threshold has been specified, and
11513          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
11514          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
11515          * is set, let it through for further processing, as we might need to
11516          * restart the scan.
11517          *
11518          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
11519          * the results are also dropped.
11520          */
11521         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11522             (rssi == HCI_RSSI_INVALID ||
11523             (rssi < hdev->discovery.rssi &&
11524              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
11525                 return  false;
11526
11527         if (hdev->discovery.uuid_count != 0) {
11528                 /* If a list of UUIDs is provided in filter, results with no
11529                  * matching UUID should be dropped.
11530                  */
11531                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
11532                                    hdev->discovery.uuids) &&
11533                     !eir_has_uuids(scan_rsp, scan_rsp_len,
11534                                    hdev->discovery.uuid_count,
11535                                    hdev->discovery.uuids))
11536                         return false;
11537         }
11538
11539         /* If duplicate filtering does not report RSSI changes, then restart
11540          * scanning to ensure updated result with updated RSSI values.
11541          */
11542         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
11543                 restart_le_scan(hdev);
11544
11545                 /* Validate RSSI value against the RSSI threshold once more. */
11546                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11547                     rssi < hdev->discovery.rssi)
11548                         return false;
11549         }
11550
11551         return true;
11552 }
11553
11554 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11555                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
11556                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11557 {
11558         char buf[512];
11559         struct mgmt_ev_device_found *ev = (void *)buf;
11560         size_t ev_size;
11561
11562         /* Don't send events for a non-kernel initiated discovery. With
11563          * LE one exception is if we have pend_le_reports > 0 in which
11564          * case we're doing passive scanning and want these events.
11565          */
11566         if (!hci_discovery_active(hdev)) {
11567                 if (link_type == ACL_LINK)
11568                         return;
11569                 if (link_type == LE_LINK &&
11570                     list_empty(&hdev->pend_le_reports) &&
11571                     !hci_is_adv_monitoring(hdev)) {
11572                         return;
11573                 }
11574         }
11575
11576         if (hdev->discovery.result_filtering) {
11577                 /* We are using service discovery */
11578                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
11579                                      scan_rsp_len))
11580                         return;
11581         }
11582
11583         if (hdev->discovery.limited) {
11584                 /* Check for limited discoverable bit */
11585                 if (dev_class) {
11586                         if (!(dev_class[1] & 0x20))
11587                                 return;
11588                 } else {
11589                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
11590                         if (!flags || !(flags[0] & LE_AD_LIMITED))
11591                                 return;
11592                 }
11593         }
11594
11595         /* Make sure that the buffer is big enough. The 5 extra bytes
11596          * are for the potential CoD field.
11597          */
11598         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
11599                 return;
11600
11601         memset(buf, 0, sizeof(buf));
11602
11603         /* In case of device discovery with BR/EDR devices (pre 1.2), the
11604          * RSSI value was reported as 0 when not available. This behavior
11605          * is kept when using device discovery. This is required for full
11606          * backwards compatibility with the API.
11607          *
11608          * However when using service discovery, the value 127 will be
11609          * returned when the RSSI is not available.
11610          */
11611         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
11612             link_type == ACL_LINK)
11613                 rssi = 0;
11614
11615         bacpy(&ev->addr.bdaddr, bdaddr);
11616         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11617         ev->rssi = rssi;
11618         ev->flags = cpu_to_le32(flags);
11619
11620         if (eir_len > 0)
11621                 /* Copy EIR or advertising data into event */
11622                 memcpy(ev->eir, eir, eir_len);
11623
11624         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11625                                        NULL))
11626                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11627                                           dev_class, 3);
11628
11629         if (scan_rsp_len > 0)
11630                 /* Append scan response data to event */
11631                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
11632
11633         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11634         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
11635
11636         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
11637 }
11638
11639 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11640                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
11641 {
11642         struct mgmt_ev_device_found *ev;
11643         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
11644         u16 eir_len;
11645
11646         ev = (struct mgmt_ev_device_found *) buf;
11647
11648         memset(buf, 0, sizeof(buf));
11649
11650         bacpy(&ev->addr.bdaddr, bdaddr);
11651         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11652         ev->rssi = rssi;
11653
11654         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
11655                                   name_len);
11656
11657         ev->eir_len = cpu_to_le16(eir_len);
11658
11659         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
11660 }
11661
11662 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
11663 {
11664         struct mgmt_ev_discovering ev;
11665
11666         bt_dev_dbg(hdev, "discovering %u", discovering);
11667
11668         memset(&ev, 0, sizeof(ev));
11669         ev.type = hdev->discovery.type;
11670         ev.discovering = discovering;
11671
11672         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
11673 }
11674
11675 void mgmt_suspending(struct hci_dev *hdev, u8 state)
11676 {
11677         struct mgmt_ev_controller_suspend ev;
11678
11679         ev.suspend_state = state;
11680         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
11681 }
11682
11683 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
11684                    u8 addr_type)
11685 {
11686         struct mgmt_ev_controller_resume ev;
11687
11688         ev.wake_reason = reason;
11689         if (bdaddr) {
11690                 bacpy(&ev.addr.bdaddr, bdaddr);
11691                 ev.addr.type = addr_type;
11692         } else {
11693                 memset(&ev.addr, 0, sizeof(ev.addr));
11694         }
11695
11696         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
11697 }
11698
11699 static struct hci_mgmt_chan chan = {
11700         .channel        = HCI_CHANNEL_CONTROL,
11701         .handler_count  = ARRAY_SIZE(mgmt_handlers),
11702         .handlers       = mgmt_handlers,
11703 #ifdef TIZEN_BT
11704         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
11705         .tizen_handlers = tizen_mgmt_handlers,
11706 #endif
11707         .hdev_init      = mgmt_init_hdev,
11708 };
11709
11710 int mgmt_init(void)
11711 {
11712         return hci_mgmt_chan_register(&chan);
11713 }
11714
11715 void mgmt_exit(void)
11716 {
11717         hci_mgmt_chan_unregister(&chan);
11718 }