net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #endif
  38
  39 #include "hci_request.h"
  40 #include "smp.h"
  41 #include "mgmt_util.h"
  42 #include "mgmt_config.h"
  43 #include "msft.h"
  44
  45 #define MGMT_VERSION    1
  46 #define MGMT_REVISION   18
  47
  48 static const u16 mgmt_commands[] = {
  49         MGMT_OP_READ_INDEX_LIST,
  50         MGMT_OP_READ_INFO,
  51         MGMT_OP_SET_POWERED,
  52         MGMT_OP_SET_DISCOVERABLE,
  53         MGMT_OP_SET_CONNECTABLE,
  54         MGMT_OP_SET_FAST_CONNECTABLE,
  55         MGMT_OP_SET_BONDABLE,
  56         MGMT_OP_SET_LINK_SECURITY,
  57         MGMT_OP_SET_SSP,
  58         MGMT_OP_SET_HS,
  59         MGMT_OP_SET_LE,
  60         MGMT_OP_SET_DEV_CLASS,
  61         MGMT_OP_SET_LOCAL_NAME,
  62         MGMT_OP_ADD_UUID,
  63         MGMT_OP_REMOVE_UUID,
  64         MGMT_OP_LOAD_LINK_KEYS,
  65         MGMT_OP_LOAD_LONG_TERM_KEYS,
  66         MGMT_OP_DISCONNECT,
  67         MGMT_OP_GET_CONNECTIONS,
  68         MGMT_OP_PIN_CODE_REPLY,
  69         MGMT_OP_PIN_CODE_NEG_REPLY,
  70         MGMT_OP_SET_IO_CAPABILITY,
  71         MGMT_OP_PAIR_DEVICE,
  72         MGMT_OP_CANCEL_PAIR_DEVICE,
  73         MGMT_OP_UNPAIR_DEVICE,
  74         MGMT_OP_USER_CONFIRM_REPLY,
  75         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  76         MGMT_OP_USER_PASSKEY_REPLY,
  77         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  78         MGMT_OP_READ_LOCAL_OOB_DATA,
  79         MGMT_OP_ADD_REMOTE_OOB_DATA,
  80         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  81         MGMT_OP_START_DISCOVERY,
  82         MGMT_OP_STOP_DISCOVERY,
  83         MGMT_OP_CONFIRM_NAME,
  84         MGMT_OP_BLOCK_DEVICE,
  85         MGMT_OP_UNBLOCK_DEVICE,
  86         MGMT_OP_SET_DEVICE_ID,
  87         MGMT_OP_SET_ADVERTISING,
  88         MGMT_OP_SET_BREDR,
  89         MGMT_OP_SET_STATIC_ADDRESS,
  90         MGMT_OP_SET_SCAN_PARAMS,
  91         MGMT_OP_SET_SECURE_CONN,
  92         MGMT_OP_SET_DEBUG_KEYS,
  93         MGMT_OP_SET_PRIVACY,
  94         MGMT_OP_LOAD_IRKS,
  95         MGMT_OP_GET_CONN_INFO,
  96         MGMT_OP_GET_CLOCK_INFO,
  97         MGMT_OP_ADD_DEVICE,
  98         MGMT_OP_REMOVE_DEVICE,
  99         MGMT_OP_LOAD_CONN_PARAM,
 100         MGMT_OP_READ_UNCONF_INDEX_LIST,
 101         MGMT_OP_READ_CONFIG_INFO,
 102         MGMT_OP_SET_EXTERNAL_CONFIG,
 103         MGMT_OP_SET_PUBLIC_ADDRESS,
 104         MGMT_OP_START_SERVICE_DISCOVERY,
 105         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 106         MGMT_OP_READ_EXT_INDEX_LIST,
 107         MGMT_OP_READ_ADV_FEATURES,
 108         MGMT_OP_ADD_ADVERTISING,
 109         MGMT_OP_REMOVE_ADVERTISING,
 110         MGMT_OP_GET_ADV_SIZE_INFO,
 111         MGMT_OP_START_LIMITED_DISCOVERY,
 112         MGMT_OP_READ_EXT_INFO,
 113         MGMT_OP_SET_APPEARANCE,
 114         MGMT_OP_SET_BLOCKED_KEYS,
 115         MGMT_OP_SET_WIDEBAND_SPEECH,
 116         MGMT_OP_READ_SECURITY_INFO,
 117         MGMT_OP_READ_EXP_FEATURES_INFO,
 118         MGMT_OP_SET_EXP_FEATURE,
 119         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 120         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 121         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 122         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 123         MGMT_OP_GET_DEVICE_FLAGS,
 124         MGMT_OP_SET_DEVICE_FLAGS,
 125         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 126         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 127         MGMT_OP_REMOVE_ADV_MONITOR,
 128 };
 129
 130 static const u16 mgmt_events[] = {
 131         MGMT_EV_CONTROLLER_ERROR,
 132         MGMT_EV_INDEX_ADDED,
 133         MGMT_EV_INDEX_REMOVED,
 134         MGMT_EV_NEW_SETTINGS,
 135         MGMT_EV_CLASS_OF_DEV_CHANGED,
 136         MGMT_EV_LOCAL_NAME_CHANGED,
 137         MGMT_EV_NEW_LINK_KEY,
 138         MGMT_EV_NEW_LONG_TERM_KEY,
 139         MGMT_EV_DEVICE_CONNECTED,
 140         MGMT_EV_DEVICE_DISCONNECTED,
 141         MGMT_EV_CONNECT_FAILED,
 142         MGMT_EV_PIN_CODE_REQUEST,
 143         MGMT_EV_USER_CONFIRM_REQUEST,
 144         MGMT_EV_USER_PASSKEY_REQUEST,
 145         MGMT_EV_AUTH_FAILED,
 146         MGMT_EV_DEVICE_FOUND,
 147         MGMT_EV_DISCOVERING,
 148         MGMT_EV_DEVICE_BLOCKED,
 149         MGMT_EV_DEVICE_UNBLOCKED,
 150         MGMT_EV_DEVICE_UNPAIRED,
 151         MGMT_EV_PASSKEY_NOTIFY,
 152         MGMT_EV_NEW_IRK,
 153         MGMT_EV_NEW_CSRK,
 154         MGMT_EV_DEVICE_ADDED,
 155         MGMT_EV_DEVICE_REMOVED,
 156         MGMT_EV_NEW_CONN_PARAM,
 157         MGMT_EV_UNCONF_INDEX_ADDED,
 158         MGMT_EV_UNCONF_INDEX_REMOVED,
 159         MGMT_EV_NEW_CONFIG_OPTIONS,
 160         MGMT_EV_EXT_INDEX_ADDED,
 161         MGMT_EV_EXT_INDEX_REMOVED,
 162         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 163         MGMT_EV_ADVERTISING_ADDED,
 164         MGMT_EV_ADVERTISING_REMOVED,
 165         MGMT_EV_EXT_INFO_CHANGED,
 166         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 167         MGMT_EV_EXP_FEATURE_CHANGED,
 168         MGMT_EV_DEVICE_FLAGS_CHANGED,
 169         MGMT_EV_CONTROLLER_SUSPEND,
 170         MGMT_EV_CONTROLLER_RESUME,
 171 };
 172
 173 static const u16 mgmt_untrusted_commands[] = {
 174         MGMT_OP_READ_INDEX_LIST,
 175         MGMT_OP_READ_INFO,
 176         MGMT_OP_READ_UNCONF_INDEX_LIST,
 177         MGMT_OP_READ_CONFIG_INFO,
 178         MGMT_OP_READ_EXT_INDEX_LIST,
 179         MGMT_OP_READ_EXT_INFO,
 180         MGMT_OP_READ_SECURITY_INFO,
 181         MGMT_OP_READ_EXP_FEATURES_INFO,
 182         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 183         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 184 };
 185
 186 static const u16 mgmt_untrusted_events[] = {
 187         MGMT_EV_INDEX_ADDED,
 188         MGMT_EV_INDEX_REMOVED,
 189         MGMT_EV_NEW_SETTINGS,
 190         MGMT_EV_CLASS_OF_DEV_CHANGED,
 191         MGMT_EV_LOCAL_NAME_CHANGED,
 192         MGMT_EV_UNCONF_INDEX_ADDED,
 193         MGMT_EV_UNCONF_INDEX_REMOVED,
 194         MGMT_EV_NEW_CONFIG_OPTIONS,
 195         MGMT_EV_EXT_INDEX_ADDED,
 196         MGMT_EV_EXT_INDEX_REMOVED,
 197         MGMT_EV_EXT_INFO_CHANGED,
 198         MGMT_EV_EXP_FEATURE_CHANGED,
 199         MGMT_EV_ADV_MONITOR_ADDED,
 200         MGMT_EV_ADV_MONITOR_REMOVED,
 201 };
 202
 203 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 204
 205 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 206                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 207
 208 /* HCI to MGMT error code conversion table */
 209 static const u8 mgmt_status_table[] = {
 210         MGMT_STATUS_SUCCESS,
 211         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 212         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 213         MGMT_STATUS_FAILED,             /* Hardware Failure */
 214         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 215         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 216         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 217         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 218         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 219         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 220         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 221         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 222         MGMT_STATUS_BUSY,               /* Command Disallowed */
 223         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 224         MGMT_STATUS_REJECTED,           /* Rejected Security */
 225         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 226         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 227         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 228         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 229         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 230         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 231         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 232         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 233         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 234         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 235         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 236         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 237         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 238         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 239         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 240         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 241         MGMT_STATUS_FAILED,             /* Unspecified Error */
 242         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 243         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 244         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 245         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 246         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 247         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 248         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 249         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 250         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 251         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 252         MGMT_STATUS_FAILED,             /* Transaction Collision */
 253         MGMT_STATUS_FAILED,             /* Reserved for future use */
 254         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 255         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 256         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 257         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 258         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 259         MGMT_STATUS_FAILED,             /* Reserved for future use */
 260         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 261         MGMT_STATUS_FAILED,             /* Reserved for future use */
 262         MGMT_STATUS_FAILED,             /* Slot Violation */
 263         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 264         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 265         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 266         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 267         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 268         MGMT_STATUS_BUSY,               /* Controller Busy */
 269         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 270         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 271         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 272         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 273         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 274 };
 275
 276 static u8 mgmt_status(u8 hci_status)
 277 {
 278         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 279                 return mgmt_status_table[hci_status];
 280
 281         return MGMT_STATUS_FAILED;
 282 }
 283
 284 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 285                             u16 len, int flag)
 286 {
 287         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 288                                flag, NULL);
 289 }
 290
 291 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 292                               u16 len, int flag, struct sock *skip_sk)
 293 {
 294         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 295                                flag, skip_sk);
 296 }
 297
 298 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 299                       struct sock *skip_sk)
 300 {
 301         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 302                                HCI_SOCK_TRUSTED, skip_sk);
 303 }
 304
 305 static u8 le_addr_type(u8 mgmt_addr_type)
 306 {
 307         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 308                 return ADDR_LE_DEV_PUBLIC;
 309         else
 310                 return ADDR_LE_DEV_RANDOM;
 311 }
 312
 313 void mgmt_fill_version_info(void *ver)
 314 {
 315         struct mgmt_rp_read_version *rp = ver;
 316
 317         rp->version = MGMT_VERSION;
 318         rp->revision = cpu_to_le16(MGMT_REVISION);
 319 }
 320
 321 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 322                         u16 data_len)
 323 {
 324         struct mgmt_rp_read_version rp;
 325
 326         bt_dev_dbg(hdev, "sock %p", sk);
 327
 328         mgmt_fill_version_info(&rp);
 329
 330         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 331                                  &rp, sizeof(rp));
 332 }
 333
 334 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 335                          u16 data_len)
 336 {
 337         struct mgmt_rp_read_commands *rp;
 338         u16 num_commands, num_events;
 339         size_t rp_size;
 340         int i, err;
 341
 342         bt_dev_dbg(hdev, "sock %p", sk);
 343
 344         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 345                 num_commands = ARRAY_SIZE(mgmt_commands);
 346                 num_events = ARRAY_SIZE(mgmt_events);
 347         } else {
 348                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 349                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 350         }
 351
 352         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 353
 354         rp = kmalloc(rp_size, GFP_KERNEL);
 355         if (!rp)
 356                 return -ENOMEM;
 357
 358         rp->num_commands = cpu_to_le16(num_commands);
 359         rp->num_events = cpu_to_le16(num_events);
 360
 361         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 362                 __le16 *opcode = rp->opcodes;
 363
 364                 for (i = 0; i < num_commands; i++, opcode++)
 365                         put_unaligned_le16(mgmt_commands[i], opcode);
 366
 367                 for (i = 0; i < num_events; i++, opcode++)
 368                         put_unaligned_le16(mgmt_events[i], opcode);
 369         } else {
 370                 __le16 *opcode = rp->opcodes;
 371
 372                 for (i = 0; i < num_commands; i++, opcode++)
 373                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 374
 375                 for (i = 0; i < num_events; i++, opcode++)
 376                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 377         }
 378
 379         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 380                                 rp, rp_size);
 381         kfree(rp);
 382
 383         return err;
 384 }
 385
 386 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 387                            u16 data_len)
 388 {
 389         struct mgmt_rp_read_index_list *rp;
 390         struct hci_dev *d;
 391         size_t rp_len;
 392         u16 count;
 393         int err;
 394
 395         bt_dev_dbg(hdev, "sock %p", sk);
 396
 397         read_lock(&hci_dev_list_lock);
 398
 399         count = 0;
 400         list_for_each_entry(d, &hci_dev_list, list) {
 401                 if (d->dev_type == HCI_PRIMARY &&
 402                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 403                         count++;
 404         }
 405
 406         rp_len = sizeof(*rp) + (2 * count);
 407         rp = kmalloc(rp_len, GFP_ATOMIC);
 408         if (!rp) {
 409                 read_unlock(&hci_dev_list_lock);
 410                 return -ENOMEM;
 411         }
 412
 413         count = 0;
 414         list_for_each_entry(d, &hci_dev_list, list) {
 415                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 416                     hci_dev_test_flag(d, HCI_CONFIG) ||
 417                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 418                         continue;
 419
 420                 /* Devices marked as raw-only are neither configured
 421                  * nor unconfigured controllers.
 422                  */
 423                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 424                         continue;
 425
 426                 if (d->dev_type == HCI_PRIMARY &&
 427                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 428                         rp->index[count++] = cpu_to_le16(d->id);
 429                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 430                 }
 431         }
 432
 433         rp->num_controllers = cpu_to_le16(count);
 434         rp_len = sizeof(*rp) + (2 * count);
 435
 436         read_unlock(&hci_dev_list_lock);
 437
 438         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 439                                 0, rp, rp_len);
 440
 441         kfree(rp);
 442
 443         return err;
 444 }
 445
 446 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 447                                   void *data, u16 data_len)
 448 {
 449         struct mgmt_rp_read_unconf_index_list *rp;
 450         struct hci_dev *d;
 451         size_t rp_len;
 452         u16 count;
 453         int err;
 454
 455         bt_dev_dbg(hdev, "sock %p", sk);
 456
 457         read_lock(&hci_dev_list_lock);
 458
 459         count = 0;
 460         list_for_each_entry(d, &hci_dev_list, list) {
 461                 if (d->dev_type == HCI_PRIMARY &&
 462                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 463                         count++;
 464         }
 465
 466         rp_len = sizeof(*rp) + (2 * count);
 467         rp = kmalloc(rp_len, GFP_ATOMIC);
 468         if (!rp) {
 469                 read_unlock(&hci_dev_list_lock);
 470                 return -ENOMEM;
 471         }
 472
 473         count = 0;
 474         list_for_each_entry(d, &hci_dev_list, list) {
 475                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 476                     hci_dev_test_flag(d, HCI_CONFIG) ||
 477                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 478                         continue;
 479
 480                 /* Devices marked as raw-only are neither configured
 481                  * nor unconfigured controllers.
 482                  */
 483                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 484                         continue;
 485
 486                 if (d->dev_type == HCI_PRIMARY &&
 487                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 488                         rp->index[count++] = cpu_to_le16(d->id);
 489                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 490                 }
 491         }
 492
 493         rp->num_controllers = cpu_to_le16(count);
 494         rp_len = sizeof(*rp) + (2 * count);
 495
 496         read_unlock(&hci_dev_list_lock);
 497
 498         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 499                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 500
 501         kfree(rp);
 502
 503         return err;
 504 }
 505
 506 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 507                                void *data, u16 data_len)
 508 {
 509         struct mgmt_rp_read_ext_index_list *rp;
 510         struct hci_dev *d;
 511         u16 count;
 512         int err;
 513
 514         bt_dev_dbg(hdev, "sock %p", sk);
 515
 516         read_lock(&hci_dev_list_lock);
 517
 518         count = 0;
 519         list_for_each_entry(d, &hci_dev_list, list) {
 520                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 521                         count++;
 522         }
 523
 524         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 525         if (!rp) {
 526                 read_unlock(&hci_dev_list_lock);
 527                 return -ENOMEM;
 528         }
 529
 530         count = 0;
 531         list_for_each_entry(d, &hci_dev_list, list) {
 532                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 533                     hci_dev_test_flag(d, HCI_CONFIG) ||
 534                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 535                         continue;
 536
 537                 /* Devices marked as raw-only are neither configured
 538                  * nor unconfigured controllers.
 539                  */
 540                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 541                         continue;
 542
 543                 if (d->dev_type == HCI_PRIMARY) {
 544                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 545                                 rp->entry[count].type = 0x01;
 546                         else
 547                                 rp->entry[count].type = 0x00;
 548                 } else if (d->dev_type == HCI_AMP) {
 549                         rp->entry[count].type = 0x02;
 550                 } else {
 551                         continue;
 552                 }
 553
 554                 rp->entry[count].bus = d->bus;
 555                 rp->entry[count++].index = cpu_to_le16(d->id);
 556                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 557         }
 558
 559         rp->num_controllers = cpu_to_le16(count);
 560
 561         read_unlock(&hci_dev_list_lock);
 562
 563         /* If this command is called at least once, then all the
 564          * default index and unconfigured index events are disabled
 565          * and from now on only extended index events are used.
 566          */
 567         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 568         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 569         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 570
 571         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 572                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 573                                 struct_size(rp, entry, count));
 574
 575         kfree(rp);
 576
 577         return err;
 578 }
 579
 580 static bool is_configured(struct hci_dev *hdev)
 581 {
 582         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 583             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 584                 return false;
 585
 586         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 587              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 588             !bacmp(&hdev->public_addr, BDADDR_ANY))
 589                 return false;
 590
 591         return true;
 592 }
 593
 594 static __le32 get_missing_options(struct hci_dev *hdev)
 595 {
 596         u32 options = 0;
 597
 598         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 599             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 600                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 601
 602         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 603              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 604             !bacmp(&hdev->public_addr, BDADDR_ANY))
 605                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 606
 607         return cpu_to_le32(options);
 608 }
 609
 610 static int new_options(struct hci_dev *hdev, struct sock *skip)
 611 {
 612         __le32 options = get_missing_options(hdev);
 613
 614         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 615                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 616 }
 617
 618 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 619 {
 620         __le32 options = get_missing_options(hdev);
 621
 622         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 623                                  sizeof(options));
 624 }
 625
 626 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 627                             void *data, u16 data_len)
 628 {
 629         struct mgmt_rp_read_config_info rp;
 630         u32 options = 0;
 631
 632         bt_dev_dbg(hdev, "sock %p", sk);
 633
 634         hci_dev_lock(hdev);
 635
 636         memset(&rp, 0, sizeof(rp));
 637         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 638
 639         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 640                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 641
 642         if (hdev->set_bdaddr)
 643                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 644
 645         rp.supported_options = cpu_to_le32(options);
 646         rp.missing_options = get_missing_options(hdev);
 647
 648         hci_dev_unlock(hdev);
 649
 650         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 651                                  &rp, sizeof(rp));
 652 }
 653
 654 static u32 get_supported_phys(struct hci_dev *hdev)
 655 {
 656         u32 supported_phys = 0;
 657
 658         if (lmp_bredr_capable(hdev)) {
 659                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 660
 661                 if (hdev->features[0][0] & LMP_3SLOT)
 662                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 663
 664                 if (hdev->features[0][0] & LMP_5SLOT)
 665                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 666
 667                 if (lmp_edr_2m_capable(hdev)) {
 668                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 669
 670                         if (lmp_edr_3slot_capable(hdev))
 671                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 672
 673                         if (lmp_edr_5slot_capable(hdev))
 674                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 675
 676                         if (lmp_edr_3m_capable(hdev)) {
 677                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 678
 679                                 if (lmp_edr_3slot_capable(hdev))
 680                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 681
 682                                 if (lmp_edr_5slot_capable(hdev))
 683                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 684                         }
 685                 }
 686         }
 687
 688         if (lmp_le_capable(hdev)) {
 689                 supported_phys |= MGMT_PHY_LE_1M_TX;
 690                 supported_phys |= MGMT_PHY_LE_1M_RX;
 691
 692                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 693                         supported_phys |= MGMT_PHY_LE_2M_TX;
 694                         supported_phys |= MGMT_PHY_LE_2M_RX;
 695                 }
 696
 697                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 698                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 699                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 700                 }
 701         }
 702
 703         return supported_phys;
 704 }
 705
 706 static u32 get_selected_phys(struct hci_dev *hdev)
 707 {
 708         u32 selected_phys = 0;
 709
 710         if (lmp_bredr_capable(hdev)) {
 711                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 712
 713                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 714                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 715
 716                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 717                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 718
 719                 if (lmp_edr_2m_capable(hdev)) {
 720                         if (!(hdev->pkt_type & HCI_2DH1))
 721                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 722
 723                         if (lmp_edr_3slot_capable(hdev) &&
 724                             !(hdev->pkt_type & HCI_2DH3))
 725                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 726
 727                         if (lmp_edr_5slot_capable(hdev) &&
 728                             !(hdev->pkt_type & HCI_2DH5))
 729                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 730
 731                         if (lmp_edr_3m_capable(hdev)) {
 732                                 if (!(hdev->pkt_type & HCI_3DH1))
 733                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 734
 735                                 if (lmp_edr_3slot_capable(hdev) &&
 736                                     !(hdev->pkt_type & HCI_3DH3))
 737                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 738
 739                                 if (lmp_edr_5slot_capable(hdev) &&
 740                                     !(hdev->pkt_type & HCI_3DH5))
 741                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 742                         }
 743                 }
 744         }
 745
 746         if (lmp_le_capable(hdev)) {
 747                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 748                         selected_phys |= MGMT_PHY_LE_1M_TX;
 749
 750                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 751                         selected_phys |= MGMT_PHY_LE_1M_RX;
 752
 753                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 754                         selected_phys |= MGMT_PHY_LE_2M_TX;
 755
 756                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 757                         selected_phys |= MGMT_PHY_LE_2M_RX;
 758
 759                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 760                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 761
 762                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 763                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 764         }
 765
 766         return selected_phys;
 767 }
 768
 769 static u32 get_configurable_phys(struct hci_dev *hdev)
 770 {
 771         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 772                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 773 }
 774
 775 static u32 get_supported_settings(struct hci_dev *hdev)
 776 {
 777         u32 settings = 0;
 778
 779         settings |= MGMT_SETTING_POWERED;
 780         settings |= MGMT_SETTING_BONDABLE;
 781         settings |= MGMT_SETTING_DEBUG_KEYS;
 782         settings |= MGMT_SETTING_CONNECTABLE;
 783         settings |= MGMT_SETTING_DISCOVERABLE;
 784
 785         if (lmp_bredr_capable(hdev)) {
 786                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 787                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 788                 settings |= MGMT_SETTING_BREDR;
 789                 settings |= MGMT_SETTING_LINK_SECURITY;
 790
 791                 if (lmp_ssp_capable(hdev)) {
 792                         settings |= MGMT_SETTING_SSP;
 793                         if (IS_ENABLED(CONFIG_BT_HS))
 794                                 settings |= MGMT_SETTING_HS;
 795                 }
 796
 797                 if (lmp_sc_capable(hdev))
 798                         settings |= MGMT_SETTING_SECURE_CONN;
 799
 800                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 801                              &hdev->quirks))
 802                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 803         }
 804
 805         if (lmp_le_capable(hdev)) {
 806                 settings |= MGMT_SETTING_LE;
 807                 settings |= MGMT_SETTING_SECURE_CONN;
 808                 settings |= MGMT_SETTING_PRIVACY;
 809                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 810
 811                 /* When the experimental feature for LL Privacy support is
 812                  * enabled, then advertising is no longer supported.
 813                  */
 814                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 815                         settings |= MGMT_SETTING_ADVERTISING;
 816         }
 817
 818         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 819             hdev->set_bdaddr)
 820                 settings |= MGMT_SETTING_CONFIGURATION;
 821
 822         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 823
 824         return settings;
 825 }
 826
 827 static u32 get_current_settings(struct hci_dev *hdev)
 828 {
 829         u32 settings = 0;
 830
 831         if (hdev_is_powered(hdev))
 832                 settings |= MGMT_SETTING_POWERED;
 833
 834         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 835                 settings |= MGMT_SETTING_CONNECTABLE;
 836
 837         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 838                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 839
 840         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 841                 settings |= MGMT_SETTING_DISCOVERABLE;
 842
 843         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 844                 settings |= MGMT_SETTING_BONDABLE;
 845
 846         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 847                 settings |= MGMT_SETTING_BREDR;
 848
 849         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 850                 settings |= MGMT_SETTING_LE;
 851
 852         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 853                 settings |= MGMT_SETTING_LINK_SECURITY;
 854
 855         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 856                 settings |= MGMT_SETTING_SSP;
 857
 858         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 859                 settings |= MGMT_SETTING_HS;
 860
 861         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 862                 settings |= MGMT_SETTING_ADVERTISING;
 863
 864         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 865                 settings |= MGMT_SETTING_SECURE_CONN;
 866
 867         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 868                 settings |= MGMT_SETTING_DEBUG_KEYS;
 869
 870         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 871                 settings |= MGMT_SETTING_PRIVACY;
 872
 873         /* The current setting for static address has two purposes. The
 874          * first is to indicate if the static address will be used and
 875          * the second is to indicate if it is actually set.
 876          *
 877          * This means if the static address is not configured, this flag
 878          * will never be set. If the address is configured, then if the
 879          * address is actually used decides if the flag is set or not.
 880          *
 881          * For single mode LE only controllers and dual-mode controllers
 882          * with BR/EDR disabled, the existence of the static address will
 883          * be evaluated.
 884          */
 885         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 886             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 887             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 888                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 889                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 890         }
 891
 892         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 893                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 894
 895         return settings;
 896 }
 897
 898 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 899 {
 900         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 901 }
 902
 903 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 904                                                   struct hci_dev *hdev,
 905                                                   const void *data)
 906 {
 907         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 908 }
 909
 910 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 911 {
 912         struct mgmt_pending_cmd *cmd;
 913
 914         /* If there's a pending mgmt command the flags will not yet have
 915          * their final values, so check for this first.
 916          */
 917         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 918         if (cmd) {
 919                 struct mgmt_mode *cp = cmd->param;
 920                 if (cp->val == 0x01)
 921                         return LE_AD_GENERAL;
 922                 else if (cp->val == 0x02)
 923                         return LE_AD_LIMITED;
 924         } else {
 925                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 926                         return LE_AD_LIMITED;
 927                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 928                         return LE_AD_GENERAL;
 929         }
 930
 931         return 0;
 932 }
 933
 934 bool mgmt_get_connectable(struct hci_dev *hdev)
 935 {
 936         struct mgmt_pending_cmd *cmd;
 937
 938         /* If there's a pending mgmt command the flag will not yet have
 939          * it's final value, so check for this first.
 940          */
 941         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 942         if (cmd) {
 943                 struct mgmt_mode *cp = cmd->param;
 944
 945                 return cp->val;
 946         }
 947
 948         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 949 }
 950
 951 static void service_cache_off(struct work_struct *work)
 952 {
 953         struct hci_dev *hdev = container_of(work, struct hci_dev,
 954                                             service_cache.work);
 955         struct hci_request req;
 956
 957         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 958                 return;
 959
 960         hci_req_init(&req, hdev);
 961
 962         hci_dev_lock(hdev);
 963
 964         __hci_req_update_eir(&req);
 965         __hci_req_update_class(&req);
 966
 967         hci_dev_unlock(hdev);
 968
 969         hci_req_run(&req, NULL);
 970 }
 971
 972 static void rpa_expired(struct work_struct *work)
 973 {
 974         struct hci_dev *hdev = container_of(work, struct hci_dev,
 975                                             rpa_expired.work);
 976         struct hci_request req;
 977
 978         bt_dev_dbg(hdev, "");
 979
 980         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 981
 982         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 983                 return;
 984
 985         /* The generation of a new RPA and programming it into the
 986          * controller happens in the hci_req_enable_advertising()
 987          * function.
 988          */
 989         hci_req_init(&req, hdev);
 990         if (ext_adv_capable(hdev))
 991                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 992         else
 993                 __hci_req_enable_advertising(&req);
 994         hci_req_run(&req, NULL);
 995 }
 996
 997 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 998 {
 999         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1000                 return;
1001
1002         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1003         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1004
1005         /* Non-mgmt controlled devices get this bit set
1006          * implicitly so that pairing works for them, however
1007          * for mgmt we require user-space to explicitly enable
1008          * it
1009          */
1010         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1011 }
1012
1013 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1014                                 void *data, u16 data_len)
1015 {
1016         struct mgmt_rp_read_info rp;
1017
1018         bt_dev_dbg(hdev, "sock %p", sk);
1019
1020         hci_dev_lock(hdev);
1021
1022         memset(&rp, 0, sizeof(rp));
1023
1024         bacpy(&rp.bdaddr, &hdev->bdaddr);
1025
1026         rp.version = hdev->hci_ver;
1027         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1028
1029         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1030         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1031
1032         memcpy(rp.dev_class, hdev->dev_class, 3);
1033
1034         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1035         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1036
1037         hci_dev_unlock(hdev);
1038
1039         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1040                                  sizeof(rp));
1041 }
1042
1043 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1044 {
1045         u16 eir_len = 0;
1046         size_t name_len;
1047
1048         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1049                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1050                                           hdev->dev_class, 3);
1051
1052         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1053                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1054                                           hdev->appearance);
1055
1056         name_len = strlen(hdev->dev_name);
1057         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1058                                   hdev->dev_name, name_len);
1059
1060         name_len = strlen(hdev->short_name);
1061         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1062                                   hdev->short_name, name_len);
1063
1064         return eir_len;
1065 }
1066
1067 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1068                                     void *data, u16 data_len)
1069 {
1070         char buf[512];
1071         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1072         u16 eir_len;
1073
1074         bt_dev_dbg(hdev, "sock %p", sk);
1075
1076         memset(&buf, 0, sizeof(buf));
1077
1078         hci_dev_lock(hdev);
1079
1080         bacpy(&rp->bdaddr, &hdev->bdaddr);
1081
1082         rp->version = hdev->hci_ver;
1083         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1084
1085         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1086         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1087
1088
1089         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1090         rp->eir_len = cpu_to_le16(eir_len);
1091
1092         hci_dev_unlock(hdev);
1093
1094         /* If this command is called at least once, then the events
1095          * for class of device and local name changes are disabled
1096          * and only the new extended controller information event
1097          * is used.
1098          */
1099         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1100         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1101         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1102
1103         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1104                                  sizeof(*rp) + eir_len);
1105 }
1106
1107 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1108 {
1109         char buf[512];
1110         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1111         u16 eir_len;
1112
1113         memset(buf, 0, sizeof(buf));
1114
1115         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1116         ev->eir_len = cpu_to_le16(eir_len);
1117
1118         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1119                                   sizeof(*ev) + eir_len,
1120                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1121 }
1122
1123 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1124 {
1125         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1126
1127         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1128                                  sizeof(settings));
1129 }
1130
1131 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1132 {
1133         bt_dev_dbg(hdev, "status 0x%02x", status);
1134
1135         if (hci_conn_count(hdev) == 0) {
1136                 cancel_delayed_work(&hdev->power_off);
1137                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1138         }
1139 }
1140
1141 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1142 {
1143         struct mgmt_ev_advertising_added ev;
1144
1145         ev.instance = instance;
1146
1147         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1148 }
1149
1150 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1151                               u8 instance)
1152 {
1153         struct mgmt_ev_advertising_removed ev;
1154
1155         ev.instance = instance;
1156
1157         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1158 }
1159
1160 static void cancel_adv_timeout(struct hci_dev *hdev)
1161 {
1162         if (hdev->adv_instance_timeout) {
1163                 hdev->adv_instance_timeout = 0;
1164                 cancel_delayed_work(&hdev->adv_instance_expire);
1165         }
1166 }
1167
1168 static int clean_up_hci_state(struct hci_dev *hdev)
1169 {
1170         struct hci_request req;
1171         struct hci_conn *conn;
1172         bool discov_stopped;
1173         int err;
1174
1175         hci_req_init(&req, hdev);
1176
1177         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1178             test_bit(HCI_PSCAN, &hdev->flags)) {
1179                 u8 scan = 0x00;
1180                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1181         }
1182
1183         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1184
1185         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1186                 __hci_req_disable_advertising(&req);
1187
1188         discov_stopped = hci_req_stop_discovery(&req);
1189
1190         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1191                 /* 0x15 == Terminated due to Power Off */
1192                 __hci_abort_conn(&req, conn, 0x15);
1193         }
1194
1195         err = hci_req_run(&req, clean_up_hci_complete);
1196         if (!err && discov_stopped)
1197                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1198
1199         return err;
1200 }
1201
1202 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1203                        u16 len)
1204 {
1205         struct mgmt_mode *cp = data;
1206         struct mgmt_pending_cmd *cmd;
1207         int err;
1208
1209         bt_dev_dbg(hdev, "sock %p", sk);
1210
1211         if (cp->val != 0x00 && cp->val != 0x01)
1212                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1213                                        MGMT_STATUS_INVALID_PARAMS);
1214
1215         hci_dev_lock(hdev);
1216
1217         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1218                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1219                                       MGMT_STATUS_BUSY);
1220                 goto failed;
1221         }
1222
1223         if (!!cp->val == hdev_is_powered(hdev)) {
1224                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1225                 goto failed;
1226         }
1227
1228         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1229         if (!cmd) {
1230                 err = -ENOMEM;
1231                 goto failed;
1232         }
1233
1234         if (cp->val) {
1235                 queue_work(hdev->req_workqueue, &hdev->power_on);
1236                 err = 0;
1237         } else {
1238                 /* Disconnect connections, stop scans, etc */
1239                 err = clean_up_hci_state(hdev);
1240                 if (!err)
1241                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1242                                            HCI_POWER_OFF_TIMEOUT);
1243
1244                 /* ENODATA means there were no HCI commands queued */
1245                 if (err == -ENODATA) {
1246                         cancel_delayed_work(&hdev->power_off);
1247                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1248                         err = 0;
1249                 }
1250         }
1251
1252 failed:
1253         hci_dev_unlock(hdev);
1254         return err;
1255 }
1256
1257 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1258 {
1259         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1260
1261         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1262                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1263 }
1264
1265 int mgmt_new_settings(struct hci_dev *hdev)
1266 {
1267         return new_settings(hdev, NULL);
1268 }
1269
1270 struct cmd_lookup {
1271         struct sock *sk;
1272         struct hci_dev *hdev;
1273         u8 mgmt_status;
1274 };
1275
1276 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1277 {
1278         struct cmd_lookup *match = data;
1279
1280         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1281
1282         list_del(&cmd->list);
1283
1284         if (match->sk == NULL) {
1285                 match->sk = cmd->sk;
1286                 sock_hold(match->sk);
1287         }
1288
1289         mgmt_pending_free(cmd);
1290 }
1291
1292 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1293 {
1294         u8 *status = data;
1295
1296         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1297         mgmt_pending_remove(cmd);
1298 }
1299
1300 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1301 {
1302         if (cmd->cmd_complete) {
1303                 u8 *status = data;
1304
1305                 cmd->cmd_complete(cmd, *status);
1306                 mgmt_pending_remove(cmd);
1307
1308                 return;
1309         }
1310
1311         cmd_status_rsp(cmd, data);
1312 }
1313
1314 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1315 {
1316         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1317                                  cmd->param, cmd->param_len);
1318 }
1319
1320 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1321 {
1322         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1323                                  cmd->param, sizeof(struct mgmt_addr_info));
1324 }
1325
1326 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1327 {
1328         if (!lmp_bredr_capable(hdev))
1329                 return MGMT_STATUS_NOT_SUPPORTED;
1330         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1331                 return MGMT_STATUS_REJECTED;
1332         else
1333                 return MGMT_STATUS_SUCCESS;
1334 }
1335
1336 static u8 mgmt_le_support(struct hci_dev *hdev)
1337 {
1338         if (!lmp_le_capable(hdev))
1339                 return MGMT_STATUS_NOT_SUPPORTED;
1340         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1341                 return MGMT_STATUS_REJECTED;
1342         else
1343                 return MGMT_STATUS_SUCCESS;
1344 }
1345
1346 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1347 {
1348         struct mgmt_pending_cmd *cmd;
1349
1350         bt_dev_dbg(hdev, "status 0x%02x", status);
1351
1352         hci_dev_lock(hdev);
1353
1354         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1355         if (!cmd)
1356                 goto unlock;
1357
1358         if (status) {
1359                 u8 mgmt_err = mgmt_status(status);
1360                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1361                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1362                 goto remove_cmd;
1363         }
1364
1365         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1366             hdev->discov_timeout > 0) {
1367                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1368                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1369         }
1370
1371         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1372         new_settings(hdev, cmd->sk);
1373
1374 remove_cmd:
1375         mgmt_pending_remove(cmd);
1376
1377 unlock:
1378         hci_dev_unlock(hdev);
1379 }
1380
1381 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1382                             u16 len)
1383 {
1384         struct mgmt_cp_set_discoverable *cp = data;
1385         struct mgmt_pending_cmd *cmd;
1386         u16 timeout;
1387         int err;
1388
1389         bt_dev_dbg(hdev, "sock %p", sk);
1390
1391         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1392             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1393                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1394                                        MGMT_STATUS_REJECTED);
1395
1396         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1397                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1398                                        MGMT_STATUS_INVALID_PARAMS);
1399
1400         timeout = __le16_to_cpu(cp->timeout);
1401
1402         /* Disabling discoverable requires that no timeout is set,
1403          * and enabling limited discoverable requires a timeout.
1404          */
1405         if ((cp->val == 0x00 && timeout > 0) ||
1406             (cp->val == 0x02 && timeout == 0))
1407                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1408                                        MGMT_STATUS_INVALID_PARAMS);
1409
1410         hci_dev_lock(hdev);
1411
1412         if (!hdev_is_powered(hdev) && timeout > 0) {
1413                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1414                                       MGMT_STATUS_NOT_POWERED);
1415                 goto failed;
1416         }
1417
1418         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1419             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1420                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1421                                       MGMT_STATUS_BUSY);
1422                 goto failed;
1423         }
1424
1425         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1426                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1427                                       MGMT_STATUS_REJECTED);
1428                 goto failed;
1429         }
1430
1431         if (hdev->advertising_paused) {
1432                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1433                                       MGMT_STATUS_BUSY);
1434                 goto failed;
1435         }
1436
1437         if (!hdev_is_powered(hdev)) {
1438                 bool changed = false;
1439
1440                 /* Setting limited discoverable when powered off is
1441                  * not a valid operation since it requires a timeout
1442                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1443                  */
1444                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1445                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1446                         changed = true;
1447                 }
1448
1449                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1450                 if (err < 0)
1451                         goto failed;
1452
1453                 if (changed)
1454                         err = new_settings(hdev, sk);
1455
1456                 goto failed;
1457         }
1458
1459         /* If the current mode is the same, then just update the timeout
1460          * value with the new value. And if only the timeout gets updated,
1461          * then no need for any HCI transactions.
1462          */
1463         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1464             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1465                                                    HCI_LIMITED_DISCOVERABLE)) {
1466                 cancel_delayed_work(&hdev->discov_off);
1467                 hdev->discov_timeout = timeout;
1468
1469                 if (cp->val && hdev->discov_timeout > 0) {
1470                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1471                         queue_delayed_work(hdev->req_workqueue,
1472                                            &hdev->discov_off, to);
1473                 }
1474
1475                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1476                 goto failed;
1477         }
1478
1479         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1480         if (!cmd) {
1481                 err = -ENOMEM;
1482                 goto failed;
1483         }
1484
1485         /* Cancel any potential discoverable timeout that might be
1486          * still active and store new timeout value. The arming of
1487          * the timeout happens in the complete handler.
1488          */
1489         cancel_delayed_work(&hdev->discov_off);
1490         hdev->discov_timeout = timeout;
1491
1492         if (cp->val)
1493                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1494         else
1495                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1496
1497         /* Limited discoverable mode */
1498         if (cp->val == 0x02)
1499                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1500         else
1501                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1502
1503         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1504         err = 0;
1505
1506 failed:
1507         hci_dev_unlock(hdev);
1508         return err;
1509 }
1510
1511 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1512 {
1513         struct mgmt_pending_cmd *cmd;
1514
1515         bt_dev_dbg(hdev, "status 0x%02x", status);
1516
1517         hci_dev_lock(hdev);
1518
1519         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1520         if (!cmd)
1521                 goto unlock;
1522
1523         if (status) {
1524                 u8 mgmt_err = mgmt_status(status);
1525                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1526                 goto remove_cmd;
1527         }
1528
1529         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1530         new_settings(hdev, cmd->sk);
1531
1532 remove_cmd:
1533         mgmt_pending_remove(cmd);
1534
1535 unlock:
1536         hci_dev_unlock(hdev);
1537 }
1538
1539 static int set_connectable_update_settings(struct hci_dev *hdev,
1540                                            struct sock *sk, u8 val)
1541 {
1542         bool changed = false;
1543         int err;
1544
1545         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1546                 changed = true;
1547
1548         if (val) {
1549                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1550         } else {
1551                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1552                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1553         }
1554
1555         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1556         if (err < 0)
1557                 return err;
1558
1559         if (changed) {
1560                 hci_req_update_scan(hdev);
1561                 hci_update_background_scan(hdev);
1562                 return new_settings(hdev, sk);
1563         }
1564
1565         return 0;
1566 }
1567
1568 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1569                            u16 len)
1570 {
1571         struct mgmt_mode *cp = data;
1572         struct mgmt_pending_cmd *cmd;
1573         int err;
1574
1575         bt_dev_dbg(hdev, "sock %p", sk);
1576
1577         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1578             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1579                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1580                                        MGMT_STATUS_REJECTED);
1581
1582         if (cp->val != 0x00 && cp->val != 0x01)
1583                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1584                                        MGMT_STATUS_INVALID_PARAMS);
1585
1586         hci_dev_lock(hdev);
1587
1588         if (!hdev_is_powered(hdev)) {
1589                 err = set_connectable_update_settings(hdev, sk, cp->val);
1590                 goto failed;
1591         }
1592
1593         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1594             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1595                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1596                                       MGMT_STATUS_BUSY);
1597                 goto failed;
1598         }
1599
1600         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1601         if (!cmd) {
1602                 err = -ENOMEM;
1603                 goto failed;
1604         }
1605
1606         if (cp->val) {
1607                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1608         } else {
1609                 if (hdev->discov_timeout > 0)
1610                         cancel_delayed_work(&hdev->discov_off);
1611
1612                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1613                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1614                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1615         }
1616
1617         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1618         err = 0;
1619
1620 failed:
1621         hci_dev_unlock(hdev);
1622         return err;
1623 }
1624
1625 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1626                         u16 len)
1627 {
1628         struct mgmt_mode *cp = data;
1629         bool changed;
1630         int err;
1631
1632         bt_dev_dbg(hdev, "sock %p", sk);
1633
1634         if (cp->val != 0x00 && cp->val != 0x01)
1635                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1636                                        MGMT_STATUS_INVALID_PARAMS);
1637
1638         hci_dev_lock(hdev);
1639
1640         if (cp->val)
1641                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1642         else
1643                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1644
1645         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1646         if (err < 0)
1647                 goto unlock;
1648
1649         if (changed) {
1650                 /* In limited privacy mode the change of bondable mode
1651                  * may affect the local advertising address.
1652                  */
1653                 if (hdev_is_powered(hdev) &&
1654                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1655                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1656                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1657                         queue_work(hdev->req_workqueue,
1658                                    &hdev->discoverable_update);
1659
1660                 err = new_settings(hdev, sk);
1661         }
1662
1663 unlock:
1664         hci_dev_unlock(hdev);
1665         return err;
1666 }
1667
1668 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1669                              u16 len)
1670 {
1671         struct mgmt_mode *cp = data;
1672         struct mgmt_pending_cmd *cmd;
1673         u8 val, status;
1674         int err;
1675
1676         bt_dev_dbg(hdev, "sock %p", sk);
1677
1678         status = mgmt_bredr_support(hdev);
1679         if (status)
1680                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1681                                        status);
1682
1683         if (cp->val != 0x00 && cp->val != 0x01)
1684                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1685                                        MGMT_STATUS_INVALID_PARAMS);
1686
1687         hci_dev_lock(hdev);
1688
1689         if (!hdev_is_powered(hdev)) {
1690                 bool changed = false;
1691
1692                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1693                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1694                         changed = true;
1695                 }
1696
1697                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1698                 if (err < 0)
1699                         goto failed;
1700
1701                 if (changed)
1702                         err = new_settings(hdev, sk);
1703
1704                 goto failed;
1705         }
1706
1707         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1708                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1709                                       MGMT_STATUS_BUSY);
1710                 goto failed;
1711         }
1712
1713         val = !!cp->val;
1714
1715         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1716                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1717                 goto failed;
1718         }
1719
1720         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1721         if (!cmd) {
1722                 err = -ENOMEM;
1723                 goto failed;
1724         }
1725
1726         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1727         if (err < 0) {
1728                 mgmt_pending_remove(cmd);
1729                 goto failed;
1730         }
1731
1732 failed:
1733         hci_dev_unlock(hdev);
1734         return err;
1735 }
1736
1737 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1738 {
1739         struct mgmt_mode *cp = data;
1740         struct mgmt_pending_cmd *cmd;
1741         u8 status;
1742         int err;
1743
1744         bt_dev_dbg(hdev, "sock %p", sk);
1745
1746         status = mgmt_bredr_support(hdev);
1747         if (status)
1748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1749
1750         if (!lmp_ssp_capable(hdev))
1751                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1752                                        MGMT_STATUS_NOT_SUPPORTED);
1753
1754         if (cp->val != 0x00 && cp->val != 0x01)
1755                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1756                                        MGMT_STATUS_INVALID_PARAMS);
1757
1758         hci_dev_lock(hdev);
1759
1760         if (!hdev_is_powered(hdev)) {
1761                 bool changed;
1762
1763                 if (cp->val) {
1764                         changed = !hci_dev_test_and_set_flag(hdev,
1765                                                              HCI_SSP_ENABLED);
1766                 } else {
1767                         changed = hci_dev_test_and_clear_flag(hdev,
1768                                                               HCI_SSP_ENABLED);
1769                         if (!changed)
1770                                 changed = hci_dev_test_and_clear_flag(hdev,
1771                                                                       HCI_HS_ENABLED);
1772                         else
1773                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1774                 }
1775
1776                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1777                 if (err < 0)
1778                         goto failed;
1779
1780                 if (changed)
1781                         err = new_settings(hdev, sk);
1782
1783                 goto failed;
1784         }
1785
1786         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1787                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1788                                       MGMT_STATUS_BUSY);
1789                 goto failed;
1790         }
1791
1792         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1793                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1794                 goto failed;
1795         }
1796
1797         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1798         if (!cmd) {
1799                 err = -ENOMEM;
1800                 goto failed;
1801         }
1802
1803         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1804                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1805                              sizeof(cp->val), &cp->val);
1806
1807         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1808         if (err < 0) {
1809                 mgmt_pending_remove(cmd);
1810                 goto failed;
1811         }
1812
1813 failed:
1814         hci_dev_unlock(hdev);
1815         return err;
1816 }
1817
1818 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1819 {
1820         struct mgmt_mode *cp = data;
1821         bool changed;
1822         u8 status;
1823         int err;
1824
1825         bt_dev_dbg(hdev, "sock %p", sk);
1826
1827         if (!IS_ENABLED(CONFIG_BT_HS))
1828                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1829                                        MGMT_STATUS_NOT_SUPPORTED);
1830
1831         status = mgmt_bredr_support(hdev);
1832         if (status)
1833                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1834
1835         if (!lmp_ssp_capable(hdev))
1836                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1837                                        MGMT_STATUS_NOT_SUPPORTED);
1838
1839         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1840                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1841                                        MGMT_STATUS_REJECTED);
1842
1843         if (cp->val != 0x00 && cp->val != 0x01)
1844                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1845                                        MGMT_STATUS_INVALID_PARAMS);
1846
1847         hci_dev_lock(hdev);
1848
1849         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1850                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1851                                       MGMT_STATUS_BUSY);
1852                 goto unlock;
1853         }
1854
1855         if (cp->val) {
1856                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1857         } else {
1858                 if (hdev_is_powered(hdev)) {
1859                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1860                                               MGMT_STATUS_REJECTED);
1861                         goto unlock;
1862                 }
1863
1864                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1865         }
1866
1867         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1868         if (err < 0)
1869                 goto unlock;
1870
1871         if (changed)
1872                 err = new_settings(hdev, sk);
1873
1874 unlock:
1875         hci_dev_unlock(hdev);
1876         return err;
1877 }
1878
1879 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1880 {
1881         struct cmd_lookup match = { NULL, hdev };
1882
1883         hci_dev_lock(hdev);
1884
1885         if (status) {
1886                 u8 mgmt_err = mgmt_status(status);
1887
1888                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1889                                      &mgmt_err);
1890                 goto unlock;
1891         }
1892
1893         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1894
1895         new_settings(hdev, match.sk);
1896
1897         if (match.sk)
1898                 sock_put(match.sk);
1899
1900         /* Make sure the controller has a good default for
1901          * advertising data. Restrict the update to when LE
1902          * has actually been enabled. During power on, the
1903          * update in powered_update_hci will take care of it.
1904          */
1905         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1906                 struct hci_request req;
1907                 hci_req_init(&req, hdev);
1908                 if (ext_adv_capable(hdev)) {
1909                         int err;
1910
1911                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1912                         if (!err)
1913                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1914                 } else {
1915                         __hci_req_update_adv_data(&req, 0x00);
1916                         __hci_req_update_scan_rsp_data(&req, 0x00);
1917                 }
1918                 hci_req_run(&req, NULL);
1919                 hci_update_background_scan(hdev);
1920         }
1921
1922 unlock:
1923         hci_dev_unlock(hdev);
1924 }
1925
1926 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1927 {
1928         struct mgmt_mode *cp = data;
1929         struct hci_cp_write_le_host_supported hci_cp;
1930         struct mgmt_pending_cmd *cmd;
1931         struct hci_request req;
1932         int err;
1933         u8 val, enabled;
1934
1935         bt_dev_dbg(hdev, "sock %p", sk);
1936
1937         if (!lmp_le_capable(hdev))
1938                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1939                                        MGMT_STATUS_NOT_SUPPORTED);
1940
1941         if (cp->val != 0x00 && cp->val != 0x01)
1942                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1943                                        MGMT_STATUS_INVALID_PARAMS);
1944
1945         /* Bluetooth single mode LE only controllers or dual-mode
1946          * controllers configured as LE only devices, do not allow
1947          * switching LE off. These have either LE enabled explicitly
1948          * or BR/EDR has been previously switched off.
1949          *
1950          * When trying to enable an already enabled LE, then gracefully
1951          * send a positive response. Trying to disable it however will
1952          * result into rejection.
1953          */
1954         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1955                 if (cp->val == 0x01)
1956                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1957
1958                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1959                                        MGMT_STATUS_REJECTED);
1960         }
1961
1962         hci_dev_lock(hdev);
1963
1964         val = !!cp->val;
1965         enabled = lmp_host_le_capable(hdev);
1966
1967         if (!val)
1968                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1969
1970         if (!hdev_is_powered(hdev) || val == enabled) {
1971                 bool changed = false;
1972
1973                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1974                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1975                         changed = true;
1976                 }
1977
1978                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1979                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1980                         changed = true;
1981                 }
1982
1983                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1984                 if (err < 0)
1985                         goto unlock;
1986
1987                 if (changed)
1988                         err = new_settings(hdev, sk);
1989
1990                 goto unlock;
1991         }
1992
1993         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1994             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1995                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1996                                       MGMT_STATUS_BUSY);
1997                 goto unlock;
1998         }
1999
2000         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2001         if (!cmd) {
2002                 err = -ENOMEM;
2003                 goto unlock;
2004         }
2005
2006         hci_req_init(&req, hdev);
2007
2008         memset(&hci_cp, 0, sizeof(hci_cp));
2009
2010         if (val) {
2011                 hci_cp.le = val;
2012                 hci_cp.simul = 0x00;
2013         } else {
2014                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2015                         __hci_req_disable_advertising(&req);
2016
2017                 if (ext_adv_capable(hdev))
2018                         __hci_req_clear_ext_adv_sets(&req);
2019         }
2020
2021         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2022                     &hci_cp);
2023
2024         err = hci_req_run(&req, le_enable_complete);
2025         if (err < 0)
2026                 mgmt_pending_remove(cmd);
2027
2028 unlock:
2029         hci_dev_unlock(hdev);
2030         return err;
2031 }
2032
2033 /* This is a helper function to test for pending mgmt commands that can
2034  * cause CoD or EIR HCI commands. We can only allow one such pending
2035  * mgmt command at a time since otherwise we cannot easily track what
2036  * the current values are, will be, and based on that calculate if a new
2037  * HCI command needs to be sent and if yes with what value.
2038  */
2039 static bool pending_eir_or_class(struct hci_dev *hdev)
2040 {
2041         struct mgmt_pending_cmd *cmd;
2042
2043         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2044                 switch (cmd->opcode) {
2045                 case MGMT_OP_ADD_UUID:
2046                 case MGMT_OP_REMOVE_UUID:
2047                 case MGMT_OP_SET_DEV_CLASS:
2048                 case MGMT_OP_SET_POWERED:
2049                         return true;
2050                 }
2051         }
2052
2053         return false;
2054 }
2055
2056 static const u8 bluetooth_base_uuid[] = {
2057                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2058                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2059 };
2060
2061 static u8 get_uuid_size(const u8 *uuid)
2062 {
2063         u32 val;
2064
2065         if (memcmp(uuid, bluetooth_base_uuid, 12))
2066                 return 128;
2067
2068         val = get_unaligned_le32(&uuid[12]);
2069         if (val > 0xffff)
2070                 return 32;
2071
2072         return 16;
2073 }
2074
2075 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2076 {
2077         struct mgmt_pending_cmd *cmd;
2078
2079         hci_dev_lock(hdev);
2080
2081         cmd = pending_find(mgmt_op, hdev);
2082         if (!cmd)
2083                 goto unlock;
2084
2085         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2086                           mgmt_status(status), hdev->dev_class, 3);
2087
2088         mgmt_pending_remove(cmd);
2089
2090 unlock:
2091         hci_dev_unlock(hdev);
2092 }
2093
2094 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2095 {
2096         bt_dev_dbg(hdev, "status 0x%02x", status);
2097
2098         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2099 }
2100
2101 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2102 {
2103         struct mgmt_cp_add_uuid *cp = data;
2104         struct mgmt_pending_cmd *cmd;
2105         struct hci_request req;
2106         struct bt_uuid *uuid;
2107         int err;
2108
2109         bt_dev_dbg(hdev, "sock %p", sk);
2110
2111         hci_dev_lock(hdev);
2112
2113         if (pending_eir_or_class(hdev)) {
2114                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2115                                       MGMT_STATUS_BUSY);
2116                 goto failed;
2117         }
2118
2119         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2120         if (!uuid) {
2121                 err = -ENOMEM;
2122                 goto failed;
2123         }
2124
2125         memcpy(uuid->uuid, cp->uuid, 16);
2126         uuid->svc_hint = cp->svc_hint;
2127         uuid->size = get_uuid_size(cp->uuid);
2128
2129         list_add_tail(&uuid->list, &hdev->uuids);
2130
2131         hci_req_init(&req, hdev);
2132
2133         __hci_req_update_class(&req);
2134         __hci_req_update_eir(&req);
2135
2136         err = hci_req_run(&req, add_uuid_complete);
2137         if (err < 0) {
2138                 if (err != -ENODATA)
2139                         goto failed;
2140
2141                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2142                                         hdev->dev_class, 3);
2143                 goto failed;
2144         }
2145
2146         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2147         if (!cmd) {
2148                 err = -ENOMEM;
2149                 goto failed;
2150         }
2151
2152         err = 0;
2153
2154 failed:
2155         hci_dev_unlock(hdev);
2156         return err;
2157 }
2158
2159 static bool enable_service_cache(struct hci_dev *hdev)
2160 {
2161         if (!hdev_is_powered(hdev))
2162                 return false;
2163
2164         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2165                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2166                                    CACHE_TIMEOUT);
2167                 return true;
2168         }
2169
2170         return false;
2171 }
2172
2173 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2174 {
2175         bt_dev_dbg(hdev, "status 0x%02x", status);
2176
2177         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2178 }
2179
2180 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2181                        u16 len)
2182 {
2183         struct mgmt_cp_remove_uuid *cp = data;
2184         struct mgmt_pending_cmd *cmd;
2185         struct bt_uuid *match, *tmp;
2186         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2187         struct hci_request req;
2188         int err, found;
2189
2190         bt_dev_dbg(hdev, "sock %p", sk);
2191
2192         hci_dev_lock(hdev);
2193
2194         if (pending_eir_or_class(hdev)) {
2195                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2196                                       MGMT_STATUS_BUSY);
2197                 goto unlock;
2198         }
2199
2200         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2201                 hci_uuids_clear(hdev);
2202
2203                 if (enable_service_cache(hdev)) {
2204                         err = mgmt_cmd_complete(sk, hdev->id,
2205                                                 MGMT_OP_REMOVE_UUID,
2206                                                 0, hdev->dev_class, 3);
2207                         goto unlock;
2208                 }
2209
2210                 goto update_class;
2211         }
2212
2213         found = 0;
2214
2215         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2216                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2217                         continue;
2218
2219                 list_del(&match->list);
2220                 kfree(match);
2221                 found++;
2222         }
2223
2224         if (found == 0) {
2225                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2226                                       MGMT_STATUS_INVALID_PARAMS);
2227                 goto unlock;
2228         }
2229
2230 update_class:
2231         hci_req_init(&req, hdev);
2232
2233         __hci_req_update_class(&req);
2234         __hci_req_update_eir(&req);
2235
2236         err = hci_req_run(&req, remove_uuid_complete);
2237         if (err < 0) {
2238                 if (err != -ENODATA)
2239                         goto unlock;
2240
2241                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2242                                         hdev->dev_class, 3);
2243                 goto unlock;
2244         }
2245
2246         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2247         if (!cmd) {
2248                 err = -ENOMEM;
2249                 goto unlock;
2250         }
2251
2252         err = 0;
2253
2254 unlock:
2255         hci_dev_unlock(hdev);
2256         return err;
2257 }
2258
2259 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2260 {
2261         bt_dev_dbg(hdev, "status 0x%02x", status);
2262
2263         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2264 }
2265
2266 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2267                          u16 len)
2268 {
2269         struct mgmt_cp_set_dev_class *cp = data;
2270         struct mgmt_pending_cmd *cmd;
2271         struct hci_request req;
2272         int err;
2273
2274         bt_dev_dbg(hdev, "sock %p", sk);
2275
2276         if (!lmp_bredr_capable(hdev))
2277                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2278                                        MGMT_STATUS_NOT_SUPPORTED);
2279
2280         hci_dev_lock(hdev);
2281
2282         if (pending_eir_or_class(hdev)) {
2283                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2284                                       MGMT_STATUS_BUSY);
2285                 goto unlock;
2286         }
2287
2288         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2289                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2290                                       MGMT_STATUS_INVALID_PARAMS);
2291                 goto unlock;
2292         }
2293
2294         hdev->major_class = cp->major;
2295         hdev->minor_class = cp->minor;
2296
2297         if (!hdev_is_powered(hdev)) {
2298                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2299                                         hdev->dev_class, 3);
2300                 goto unlock;
2301         }
2302
2303         hci_req_init(&req, hdev);
2304
2305         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2306                 hci_dev_unlock(hdev);
2307                 cancel_delayed_work_sync(&hdev->service_cache);
2308                 hci_dev_lock(hdev);
2309                 __hci_req_update_eir(&req);
2310         }
2311
2312         __hci_req_update_class(&req);
2313
2314         err = hci_req_run(&req, set_class_complete);
2315         if (err < 0) {
2316                 if (err != -ENODATA)
2317                         goto unlock;
2318
2319                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2320                                         hdev->dev_class, 3);
2321                 goto unlock;
2322         }
2323
2324         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2325         if (!cmd) {
2326                 err = -ENOMEM;
2327                 goto unlock;
2328         }
2329
2330         err = 0;
2331
2332 unlock:
2333         hci_dev_unlock(hdev);
2334         return err;
2335 }
2336
2337 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2338                           u16 len)
2339 {
2340         struct mgmt_cp_load_link_keys *cp = data;
2341         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2342                                    sizeof(struct mgmt_link_key_info));
2343         u16 key_count, expected_len;
2344         bool changed;
2345         int i;
2346
2347         bt_dev_dbg(hdev, "sock %p", sk);
2348
2349         if (!lmp_bredr_capable(hdev))
2350                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2351                                        MGMT_STATUS_NOT_SUPPORTED);
2352
2353         key_count = __le16_to_cpu(cp->key_count);
2354         if (key_count > max_key_count) {
2355                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2356                            key_count);
2357                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2358                                        MGMT_STATUS_INVALID_PARAMS);
2359         }
2360
2361         expected_len = struct_size(cp, keys, key_count);
2362         if (expected_len != len) {
2363                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2364                            expected_len, len);
2365                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2366                                        MGMT_STATUS_INVALID_PARAMS);
2367         }
2368
2369         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2370                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2371                                        MGMT_STATUS_INVALID_PARAMS);
2372
2373         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2374                    key_count);
2375
2376         for (i = 0; i < key_count; i++) {
2377                 struct mgmt_link_key_info *key = &cp->keys[i];
2378
2379                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2380                         return mgmt_cmd_status(sk, hdev->id,
2381                                                MGMT_OP_LOAD_LINK_KEYS,
2382                                                MGMT_STATUS_INVALID_PARAMS);
2383         }
2384
2385         hci_dev_lock(hdev);
2386
2387         hci_link_keys_clear(hdev);
2388
2389         if (cp->debug_keys)
2390                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2391         else
2392                 changed = hci_dev_test_and_clear_flag(hdev,
2393                                                       HCI_KEEP_DEBUG_KEYS);
2394
2395         if (changed)
2396                 new_settings(hdev, NULL);
2397
2398         for (i = 0; i < key_count; i++) {
2399                 struct mgmt_link_key_info *key = &cp->keys[i];
2400
2401                 if (hci_is_blocked_key(hdev,
2402                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2403                                        key->val)) {
2404                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2405                                     &key->addr.bdaddr);
2406                         continue;
2407                 }
2408
2409                 /* Always ignore debug keys and require a new pairing if
2410                  * the user wants to use them.
2411                  */
2412                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2413                         continue;
2414
2415                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2416                                  key->type, key->pin_len, NULL);
2417         }
2418
2419         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2420
2421         hci_dev_unlock(hdev);
2422
2423         return 0;
2424 }
2425
2426 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2427                            u8 addr_type, struct sock *skip_sk)
2428 {
2429         struct mgmt_ev_device_unpaired ev;
2430
2431         bacpy(&ev.addr.bdaddr, bdaddr);
2432         ev.addr.type = addr_type;
2433
2434         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2435                           skip_sk);
2436 }
2437
2438 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2439                          u16 len)
2440 {
2441         struct mgmt_cp_unpair_device *cp = data;
2442         struct mgmt_rp_unpair_device rp;
2443         struct hci_conn_params *params;
2444         struct mgmt_pending_cmd *cmd;
2445         struct hci_conn *conn;
2446         u8 addr_type;
2447         int err;
2448
2449         memset(&rp, 0, sizeof(rp));
2450         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2451         rp.addr.type = cp->addr.type;
2452
2453         if (!bdaddr_type_is_valid(cp->addr.type))
2454                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2455                                          MGMT_STATUS_INVALID_PARAMS,
2456                                          &rp, sizeof(rp));
2457
2458         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2459                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2460                                          MGMT_STATUS_INVALID_PARAMS,
2461                                          &rp, sizeof(rp));
2462
2463         hci_dev_lock(hdev);
2464
2465         if (!hdev_is_powered(hdev)) {
2466                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2467                                         MGMT_STATUS_NOT_POWERED, &rp,
2468                                         sizeof(rp));
2469                 goto unlock;
2470         }
2471
2472         if (cp->addr.type == BDADDR_BREDR) {
2473                 /* If disconnection is requested, then look up the
2474                  * connection. If the remote device is connected, it
2475                  * will be later used to terminate the link.
2476                  *
2477                  * Setting it to NULL explicitly will cause no
2478                  * termination of the link.
2479                  */
2480                 if (cp->disconnect)
2481                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2482                                                        &cp->addr.bdaddr);
2483                 else
2484                         conn = NULL;
2485
2486                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2487                 if (err < 0) {
2488                         err = mgmt_cmd_complete(sk, hdev->id,
2489                                                 MGMT_OP_UNPAIR_DEVICE,
2490                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2491                                                 sizeof(rp));
2492                         goto unlock;
2493                 }
2494
2495                 goto done;
2496         }
2497
2498         /* LE address type */
2499         addr_type = le_addr_type(cp->addr.type);
2500
2501         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2502         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2503         if (err < 0) {
2504                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2505                                         MGMT_STATUS_NOT_PAIRED, &rp,
2506                                         sizeof(rp));
2507                 goto unlock;
2508         }
2509
2510         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2511         if (!conn) {
2512                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2513                 goto done;
2514         }
2515
2516
2517         /* Defer clearing up the connection parameters until closing to
2518          * give a chance of keeping them if a repairing happens.
2519          */
2520         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2521
2522         /* Disable auto-connection parameters if present */
2523         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2524         if (params) {
2525                 if (params->explicit_connect)
2526                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2527                 else
2528                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2529         }
2530
2531         /* If disconnection is not requested, then clear the connection
2532          * variable so that the link is not terminated.
2533          */
2534         if (!cp->disconnect)
2535                 conn = NULL;
2536
2537 done:
2538         /* If the connection variable is set, then termination of the
2539          * link is requested.
2540          */
2541         if (!conn) {
2542                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2543                                         &rp, sizeof(rp));
2544                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2545                 goto unlock;
2546         }
2547
2548         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2549                                sizeof(*cp));
2550         if (!cmd) {
2551                 err = -ENOMEM;
2552                 goto unlock;
2553         }
2554
2555         cmd->cmd_complete = addr_cmd_complete;
2556
2557         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2558         if (err < 0)
2559                 mgmt_pending_remove(cmd);
2560
2561 unlock:
2562         hci_dev_unlock(hdev);
2563         return err;
2564 }
2565
2566 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2567                       u16 len)
2568 {
2569         struct mgmt_cp_disconnect *cp = data;
2570         struct mgmt_rp_disconnect rp;
2571         struct mgmt_pending_cmd *cmd;
2572         struct hci_conn *conn;
2573         int err;
2574
2575         bt_dev_dbg(hdev, "sock %p", sk);
2576
2577         memset(&rp, 0, sizeof(rp));
2578         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2579         rp.addr.type = cp->addr.type;
2580
2581         if (!bdaddr_type_is_valid(cp->addr.type))
2582                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2583                                          MGMT_STATUS_INVALID_PARAMS,
2584                                          &rp, sizeof(rp));
2585
2586         hci_dev_lock(hdev);
2587
2588         if (!test_bit(HCI_UP, &hdev->flags)) {
2589                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2590                                         MGMT_STATUS_NOT_POWERED, &rp,
2591                                         sizeof(rp));
2592                 goto failed;
2593         }
2594
2595         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2596                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2597                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2598                 goto failed;
2599         }
2600
2601         if (cp->addr.type == BDADDR_BREDR)
2602                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2603                                                &cp->addr.bdaddr);
2604         else
2605                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2606                                                le_addr_type(cp->addr.type));
2607
2608         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2609                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2610                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2611                                         sizeof(rp));
2612                 goto failed;
2613         }
2614
2615         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2616         if (!cmd) {
2617                 err = -ENOMEM;
2618                 goto failed;
2619         }
2620
2621         cmd->cmd_complete = generic_cmd_complete;
2622
2623         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2624         if (err < 0)
2625                 mgmt_pending_remove(cmd);
2626
2627 failed:
2628         hci_dev_unlock(hdev);
2629         return err;
2630 }
2631
2632 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2633 {
2634         switch (link_type) {
2635         case LE_LINK:
2636                 switch (addr_type) {
2637                 case ADDR_LE_DEV_PUBLIC:
2638                         return BDADDR_LE_PUBLIC;
2639
2640                 default:
2641                         /* Fallback to LE Random address type */
2642                         return BDADDR_LE_RANDOM;
2643                 }
2644
2645         default:
2646                 /* Fallback to BR/EDR type */
2647                 return BDADDR_BREDR;
2648         }
2649 }
2650
2651 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2652                            u16 data_len)
2653 {
2654         struct mgmt_rp_get_connections *rp;
2655         struct hci_conn *c;
2656         int err;
2657         u16 i;
2658
2659         bt_dev_dbg(hdev, "sock %p", sk);
2660
2661         hci_dev_lock(hdev);
2662
2663         if (!hdev_is_powered(hdev)) {
2664                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2665                                       MGMT_STATUS_NOT_POWERED);
2666                 goto unlock;
2667         }
2668
2669         i = 0;
2670         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2671                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2672                         i++;
2673         }
2674
2675         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2676         if (!rp) {
2677                 err = -ENOMEM;
2678                 goto unlock;
2679         }
2680
2681         i = 0;
2682         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2683                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2684                         continue;
2685                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2686                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2687                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2688                         continue;
2689                 i++;
2690         }
2691
2692         rp->conn_count = cpu_to_le16(i);
2693
2694         /* Recalculate length in case of filtered SCO connections, etc */
2695         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2696                                 struct_size(rp, addr, i));
2697
2698         kfree(rp);
2699
2700 unlock:
2701         hci_dev_unlock(hdev);
2702         return err;
2703 }
2704
2705 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2706                                    struct mgmt_cp_pin_code_neg_reply *cp)
2707 {
2708         struct mgmt_pending_cmd *cmd;
2709         int err;
2710
2711         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2712                                sizeof(*cp));
2713         if (!cmd)
2714                 return -ENOMEM;
2715
2716         cmd->cmd_complete = addr_cmd_complete;
2717
2718         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2719                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2720         if (err < 0)
2721                 mgmt_pending_remove(cmd);
2722
2723         return err;
2724 }
2725
2726 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2727                           u16 len)
2728 {
2729         struct hci_conn *conn;
2730         struct mgmt_cp_pin_code_reply *cp = data;
2731         struct hci_cp_pin_code_reply reply;
2732         struct mgmt_pending_cmd *cmd;
2733         int err;
2734
2735         bt_dev_dbg(hdev, "sock %p", sk);
2736
2737         hci_dev_lock(hdev);
2738
2739         if (!hdev_is_powered(hdev)) {
2740                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2741                                       MGMT_STATUS_NOT_POWERED);
2742                 goto failed;
2743         }
2744
2745         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2746         if (!conn) {
2747                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2748                                       MGMT_STATUS_NOT_CONNECTED);
2749                 goto failed;
2750         }
2751
2752         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2753                 struct mgmt_cp_pin_code_neg_reply ncp;
2754
2755                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2756
2757                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2758
2759                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2760                 if (err >= 0)
2761                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2762                                               MGMT_STATUS_INVALID_PARAMS);
2763
2764                 goto failed;
2765         }
2766
2767         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2768         if (!cmd) {
2769                 err = -ENOMEM;
2770                 goto failed;
2771         }
2772
2773         cmd->cmd_complete = addr_cmd_complete;
2774
2775         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2776         reply.pin_len = cp->pin_len;
2777         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2778
2779         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2780         if (err < 0)
2781                 mgmt_pending_remove(cmd);
2782
2783 failed:
2784         hci_dev_unlock(hdev);
2785         return err;
2786 }
2787
2788 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2789                              u16 len)
2790 {
2791         struct mgmt_cp_set_io_capability *cp = data;
2792
2793         bt_dev_dbg(hdev, "sock %p", sk);
2794
2795         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2796                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2797                                        MGMT_STATUS_INVALID_PARAMS);
2798
2799         hci_dev_lock(hdev);
2800
2801         hdev->io_capability = cp->io_capability;
2802
2803         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2804
2805         hci_dev_unlock(hdev);
2806
2807         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2808                                  NULL, 0);
2809 }
2810
2811 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2812 {
2813         struct hci_dev *hdev = conn->hdev;
2814         struct mgmt_pending_cmd *cmd;
2815
2816         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2817                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2818                         continue;
2819
2820                 if (cmd->user_data != conn)
2821                         continue;
2822
2823                 return cmd;
2824         }
2825
2826         return NULL;
2827 }
2828
2829 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2830 {
2831         struct mgmt_rp_pair_device rp;
2832         struct hci_conn *conn = cmd->user_data;
2833         int err;
2834
2835         bacpy(&rp.addr.bdaddr, &conn->dst);
2836         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2837
2838         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2839                                 status, &rp, sizeof(rp));
2840
2841         /* So we don't get further callbacks for this connection */
2842         conn->connect_cfm_cb = NULL;
2843         conn->security_cfm_cb = NULL;
2844         conn->disconn_cfm_cb = NULL;
2845
2846         hci_conn_drop(conn);
2847
2848         /* The device is paired so there is no need to remove
2849          * its connection parameters anymore.
2850          */
2851         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2852
2853         hci_conn_put(conn);
2854
2855         return err;
2856 }
2857
2858 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2859 {
2860         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2861         struct mgmt_pending_cmd *cmd;
2862
2863         cmd = find_pairing(conn);
2864         if (cmd) {
2865                 cmd->cmd_complete(cmd, status);
2866                 mgmt_pending_remove(cmd);
2867         }
2868 }
2869
2870 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2871 {
2872         struct mgmt_pending_cmd *cmd;
2873
2874         BT_DBG("status %u", status);
2875
2876         cmd = find_pairing(conn);
2877         if (!cmd) {
2878                 BT_DBG("Unable to find a pending command");
2879                 return;
2880         }
2881
2882         cmd->cmd_complete(cmd, mgmt_status(status));
2883         mgmt_pending_remove(cmd);
2884 }
2885
2886 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2887 {
2888         struct mgmt_pending_cmd *cmd;
2889
2890         BT_DBG("status %u", status);
2891
2892         if (!status)
2893                 return;
2894
2895         cmd = find_pairing(conn);
2896         if (!cmd) {
2897                 BT_DBG("Unable to find a pending command");
2898                 return;
2899         }
2900
2901         cmd->cmd_complete(cmd, mgmt_status(status));
2902         mgmt_pending_remove(cmd);
2903 }
2904
2905 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2906                        u16 len)
2907 {
2908         struct mgmt_cp_pair_device *cp = data;
2909         struct mgmt_rp_pair_device rp;
2910         struct mgmt_pending_cmd *cmd;
2911         u8 sec_level, auth_type;
2912         struct hci_conn *conn;
2913         int err;
2914
2915         bt_dev_dbg(hdev, "sock %p", sk);
2916
2917         memset(&rp, 0, sizeof(rp));
2918         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2919         rp.addr.type = cp->addr.type;
2920
2921         if (!bdaddr_type_is_valid(cp->addr.type))
2922                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2923                                          MGMT_STATUS_INVALID_PARAMS,
2924                                          &rp, sizeof(rp));
2925
2926         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2927                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2928                                          MGMT_STATUS_INVALID_PARAMS,
2929                                          &rp, sizeof(rp));
2930
2931         hci_dev_lock(hdev);
2932
2933         if (!hdev_is_powered(hdev)) {
2934                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2935                                         MGMT_STATUS_NOT_POWERED, &rp,
2936                                         sizeof(rp));
2937                 goto unlock;
2938         }
2939
2940         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2941                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2942                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2943                                         sizeof(rp));
2944                 goto unlock;
2945         }
2946
2947         sec_level = BT_SECURITY_MEDIUM;
2948         auth_type = HCI_AT_DEDICATED_BONDING;
2949
2950         if (cp->addr.type == BDADDR_BREDR) {
2951                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2952                                        auth_type, CONN_REASON_PAIR_DEVICE);
2953         } else {
2954                 u8 addr_type = le_addr_type(cp->addr.type);
2955                 struct hci_conn_params *p;
2956
2957                 /* When pairing a new device, it is expected to remember
2958                  * this device for future connections. Adding the connection
2959                  * parameter information ahead of time allows tracking
2960                  * of the slave preferred values and will speed up any
2961                  * further connection establishment.
2962                  *
2963                  * If connection parameters already exist, then they
2964                  * will be kept and this function does nothing.
2965                  */
2966                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2967
2968                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2969                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2970
2971                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2972                                            sec_level, HCI_LE_CONN_TIMEOUT,
2973                                            CONN_REASON_PAIR_DEVICE);
2974         }
2975
2976         if (IS_ERR(conn)) {
2977                 int status;
2978
2979                 if (PTR_ERR(conn) == -EBUSY)
2980                         status = MGMT_STATUS_BUSY;
2981                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2982                         status = MGMT_STATUS_NOT_SUPPORTED;
2983                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2984                         status = MGMT_STATUS_REJECTED;
2985                 else
2986                         status = MGMT_STATUS_CONNECT_FAILED;
2987
2988                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2989                                         status, &rp, sizeof(rp));
2990                 goto unlock;
2991         }
2992
2993         if (conn->connect_cfm_cb) {
2994                 hci_conn_drop(conn);
2995                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2996                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2997                 goto unlock;
2998         }
2999
3000         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3001         if (!cmd) {
3002                 err = -ENOMEM;
3003                 hci_conn_drop(conn);
3004                 goto unlock;
3005         }
3006
3007         cmd->cmd_complete = pairing_complete;
3008
3009         /* For LE, just connecting isn't a proof that the pairing finished */
3010         if (cp->addr.type == BDADDR_BREDR) {
3011                 conn->connect_cfm_cb = pairing_complete_cb;
3012                 conn->security_cfm_cb = pairing_complete_cb;
3013                 conn->disconn_cfm_cb = pairing_complete_cb;
3014         } else {
3015                 conn->connect_cfm_cb = le_pairing_complete_cb;
3016                 conn->security_cfm_cb = le_pairing_complete_cb;
3017                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3018         }
3019
3020         conn->io_capability = cp->io_cap;
3021         cmd->user_data = hci_conn_get(conn);
3022
3023         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3024             hci_conn_security(conn, sec_level, auth_type, true)) {
3025                 cmd->cmd_complete(cmd, 0);
3026                 mgmt_pending_remove(cmd);
3027         }
3028
3029         err = 0;
3030
3031 unlock:
3032         hci_dev_unlock(hdev);
3033         return err;
3034 }
3035
3036 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3037                               u16 len)
3038 {
3039         struct mgmt_addr_info *addr = data;
3040         struct mgmt_pending_cmd *cmd;
3041         struct hci_conn *conn;
3042         int err;
3043
3044         bt_dev_dbg(hdev, "sock %p", sk);
3045
3046         hci_dev_lock(hdev);
3047
3048         if (!hdev_is_powered(hdev)) {
3049                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3050                                       MGMT_STATUS_NOT_POWERED);
3051                 goto unlock;
3052         }
3053
3054         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3055         if (!cmd) {
3056                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3057                                       MGMT_STATUS_INVALID_PARAMS);
3058                 goto unlock;
3059         }
3060
3061         conn = cmd->user_data;
3062
3063         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3064                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3065                                       MGMT_STATUS_INVALID_PARAMS);
3066                 goto unlock;
3067         }
3068
3069         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3070         mgmt_pending_remove(cmd);
3071
3072         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3073                                 addr, sizeof(*addr));
3074
3075         /* Since user doesn't want to proceed with the connection, abort any
3076          * ongoing pairing and then terminate the link if it was created
3077          * because of the pair device action.
3078          */
3079         if (addr->type == BDADDR_BREDR)
3080                 hci_remove_link_key(hdev, &addr->bdaddr);
3081         else
3082                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3083                                               le_addr_type(addr->type));
3084
3085         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3086                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3087
3088 unlock:
3089         hci_dev_unlock(hdev);
3090         return err;
3091 }
3092
3093 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3094                              struct mgmt_addr_info *addr, u16 mgmt_op,
3095                              u16 hci_op, __le32 passkey)
3096 {
3097         struct mgmt_pending_cmd *cmd;
3098         struct hci_conn *conn;
3099         int err;
3100
3101         hci_dev_lock(hdev);
3102
3103         if (!hdev_is_powered(hdev)) {
3104                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3105                                         MGMT_STATUS_NOT_POWERED, addr,
3106                                         sizeof(*addr));
3107                 goto done;
3108         }
3109
3110         if (addr->type == BDADDR_BREDR)
3111                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3112         else
3113                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3114                                                le_addr_type(addr->type));
3115
3116         if (!conn) {
3117                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3118                                         MGMT_STATUS_NOT_CONNECTED, addr,
3119                                         sizeof(*addr));
3120                 goto done;
3121         }
3122
3123         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3124                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3125                 if (!err)
3126                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3127                                                 MGMT_STATUS_SUCCESS, addr,
3128                                                 sizeof(*addr));
3129                 else
3130                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3131                                                 MGMT_STATUS_FAILED, addr,
3132                                                 sizeof(*addr));
3133
3134                 goto done;
3135         }
3136
3137         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3138         if (!cmd) {
3139                 err = -ENOMEM;
3140                 goto done;
3141         }
3142
3143         cmd->cmd_complete = addr_cmd_complete;
3144
3145         /* Continue with pairing via HCI */
3146         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3147                 struct hci_cp_user_passkey_reply cp;
3148
3149                 bacpy(&cp.bdaddr, &addr->bdaddr);
3150                 cp.passkey = passkey;
3151                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3152         } else
3153                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3154                                    &addr->bdaddr);
3155
3156         if (err < 0)
3157                 mgmt_pending_remove(cmd);
3158
3159 done:
3160         hci_dev_unlock(hdev);
3161         return err;
3162 }
3163
3164 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3165                               void *data, u16 len)
3166 {
3167         struct mgmt_cp_pin_code_neg_reply *cp = data;
3168
3169         bt_dev_dbg(hdev, "sock %p", sk);
3170
3171         return user_pairing_resp(sk, hdev, &cp->addr,
3172                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3173                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3174 }
3175
3176 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3177                               u16 len)
3178 {
3179         struct mgmt_cp_user_confirm_reply *cp = data;
3180
3181         bt_dev_dbg(hdev, "sock %p", sk);
3182
3183         if (len != sizeof(*cp))
3184                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3185                                        MGMT_STATUS_INVALID_PARAMS);
3186
3187         return user_pairing_resp(sk, hdev, &cp->addr,
3188                                  MGMT_OP_USER_CONFIRM_REPLY,
3189                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3190 }
3191
3192 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3193                                   void *data, u16 len)
3194 {
3195         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3196
3197         bt_dev_dbg(hdev, "sock %p", sk);
3198
3199         return user_pairing_resp(sk, hdev, &cp->addr,
3200                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3201                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3202 }
3203
3204 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3205                               u16 len)
3206 {
3207         struct mgmt_cp_user_passkey_reply *cp = data;
3208
3209         bt_dev_dbg(hdev, "sock %p", sk);
3210
3211         return user_pairing_resp(sk, hdev, &cp->addr,
3212                                  MGMT_OP_USER_PASSKEY_REPLY,
3213                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3214 }
3215
3216 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3217                                   void *data, u16 len)
3218 {
3219         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3220
3221         bt_dev_dbg(hdev, "sock %p", sk);
3222
3223         return user_pairing_resp(sk, hdev, &cp->addr,
3224                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3225                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3226 }
3227
3228 static void adv_expire(struct hci_dev *hdev, u32 flags)
3229 {
3230         struct adv_info *adv_instance;
3231         struct hci_request req;
3232         int err;
3233
3234         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3235         if (!adv_instance)
3236                 return;
3237
3238         /* stop if current instance doesn't need to be changed */
3239         if (!(adv_instance->flags & flags))
3240                 return;
3241
3242         cancel_adv_timeout(hdev);
3243
3244         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3245         if (!adv_instance)
3246                 return;
3247
3248         hci_req_init(&req, hdev);
3249         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3250                                               true);
3251         if (err)
3252                 return;
3253
3254         hci_req_run(&req, NULL);
3255 }
3256
3257 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3258 {
3259         struct mgmt_cp_set_local_name *cp;
3260         struct mgmt_pending_cmd *cmd;
3261
3262         bt_dev_dbg(hdev, "status 0x%02x", status);
3263
3264         hci_dev_lock(hdev);
3265
3266         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3267         if (!cmd)
3268                 goto unlock;
3269
3270         cp = cmd->param;
3271
3272         if (status) {
3273                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3274                                 mgmt_status(status));
3275         } else {
3276                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3277                                   cp, sizeof(*cp));
3278
3279                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3280                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3281         }
3282
3283         mgmt_pending_remove(cmd);
3284
3285 unlock:
3286         hci_dev_unlock(hdev);
3287 }
3288
3289 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3290                           u16 len)
3291 {
3292         struct mgmt_cp_set_local_name *cp = data;
3293         struct mgmt_pending_cmd *cmd;
3294         struct hci_request req;
3295         int err;
3296
3297         bt_dev_dbg(hdev, "sock %p", sk);
3298
3299         hci_dev_lock(hdev);
3300
3301         /* If the old values are the same as the new ones just return a
3302          * direct command complete event.
3303          */
3304         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3305             !memcmp(hdev->short_name, cp->short_name,
3306                     sizeof(hdev->short_name))) {
3307                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3308                                         data, len);
3309                 goto failed;
3310         }
3311
3312         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3313
3314         if (!hdev_is_powered(hdev)) {
3315                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3316
3317                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3318                                         data, len);
3319                 if (err < 0)
3320                         goto failed;
3321
3322                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3323                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3324                 ext_info_changed(hdev, sk);
3325
3326                 goto failed;
3327         }
3328
3329         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3330         if (!cmd) {
3331                 err = -ENOMEM;
3332                 goto failed;
3333         }
3334
3335         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3336
3337         hci_req_init(&req, hdev);
3338
3339         if (lmp_bredr_capable(hdev)) {
3340                 __hci_req_update_name(&req);
3341                 __hci_req_update_eir(&req);
3342         }
3343
3344         /* The name is stored in the scan response data and so
3345          * no need to udpate the advertising data here.
3346          */
3347         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3348                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3349
3350         err = hci_req_run(&req, set_name_complete);
3351         if (err < 0)
3352                 mgmt_pending_remove(cmd);
3353
3354 failed:
3355         hci_dev_unlock(hdev);
3356         return err;
3357 }
3358
3359 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3360                           u16 len)
3361 {
3362         struct mgmt_cp_set_appearance *cp = data;
3363         u16 appearance;
3364         int err;
3365
3366         bt_dev_dbg(hdev, "sock %p", sk);
3367
3368         if (!lmp_le_capable(hdev))
3369                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3370                                        MGMT_STATUS_NOT_SUPPORTED);
3371
3372         appearance = le16_to_cpu(cp->appearance);
3373
3374         hci_dev_lock(hdev);
3375
3376         if (hdev->appearance != appearance) {
3377                 hdev->appearance = appearance;
3378
3379                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3380                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3381
3382                 ext_info_changed(hdev, sk);
3383         }
3384
3385         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3386                                 0);
3387
3388         hci_dev_unlock(hdev);
3389
3390         return err;
3391 }
3392
3393 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3394                                  void *data, u16 len)
3395 {
3396         struct mgmt_rp_get_phy_confguration rp;
3397
3398         bt_dev_dbg(hdev, "sock %p", sk);
3399
3400         hci_dev_lock(hdev);
3401
3402         memset(&rp, 0, sizeof(rp));
3403
3404         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3405         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3406         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3407
3408         hci_dev_unlock(hdev);
3409
3410         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3411                                  &rp, sizeof(rp));
3412 }
3413
3414 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3415 {
3416         struct mgmt_ev_phy_configuration_changed ev;
3417
3418         memset(&ev, 0, sizeof(ev));
3419
3420         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3421
3422         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3423                           sizeof(ev), skip);
3424 }
3425
3426 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3427                                      u16 opcode, struct sk_buff *skb)
3428 {
3429         struct mgmt_pending_cmd *cmd;
3430
3431         bt_dev_dbg(hdev, "status 0x%02x", status);
3432
3433         hci_dev_lock(hdev);
3434
3435         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3436         if (!cmd)
3437                 goto unlock;
3438
3439         if (status) {
3440                 mgmt_cmd_status(cmd->sk, hdev->id,
3441                                 MGMT_OP_SET_PHY_CONFIGURATION,
3442                                 mgmt_status(status));
3443         } else {
3444                 mgmt_cmd_complete(cmd->sk, hdev->id,
3445                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3446                                   NULL, 0);
3447
3448                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3449         }
3450
3451         mgmt_pending_remove(cmd);
3452
3453 unlock:
3454         hci_dev_unlock(hdev);
3455 }
3456
3457 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3458                                  void *data, u16 len)
3459 {
3460         struct mgmt_cp_set_phy_confguration *cp = data;
3461         struct hci_cp_le_set_default_phy cp_phy;
3462         struct mgmt_pending_cmd *cmd;
3463         struct hci_request req;
3464         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3465         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3466         bool changed = false;
3467         int err;
3468
3469         bt_dev_dbg(hdev, "sock %p", sk);
3470
3471         configurable_phys = get_configurable_phys(hdev);
3472         supported_phys = get_supported_phys(hdev);
3473         selected_phys = __le32_to_cpu(cp->selected_phys);
3474
3475         if (selected_phys & ~supported_phys)
3476                 return mgmt_cmd_status(sk, hdev->id,
3477                                        MGMT_OP_SET_PHY_CONFIGURATION,
3478                                        MGMT_STATUS_INVALID_PARAMS);
3479
3480         unconfigure_phys = supported_phys & ~configurable_phys;
3481
3482         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3483                 return mgmt_cmd_status(sk, hdev->id,
3484                                        MGMT_OP_SET_PHY_CONFIGURATION,
3485                                        MGMT_STATUS_INVALID_PARAMS);
3486
3487         if (selected_phys == get_selected_phys(hdev))
3488                 return mgmt_cmd_complete(sk, hdev->id,
3489                                          MGMT_OP_SET_PHY_CONFIGURATION,
3490                                          0, NULL, 0);
3491
3492         hci_dev_lock(hdev);
3493
3494         if (!hdev_is_powered(hdev)) {
3495                 err = mgmt_cmd_status(sk, hdev->id,
3496                                       MGMT_OP_SET_PHY_CONFIGURATION,
3497                                       MGMT_STATUS_REJECTED);
3498                 goto unlock;
3499         }
3500
3501         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3502                 err = mgmt_cmd_status(sk, hdev->id,
3503                                       MGMT_OP_SET_PHY_CONFIGURATION,
3504                                       MGMT_STATUS_BUSY);
3505                 goto unlock;
3506         }
3507
3508         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3509                 pkt_type |= (HCI_DH3 | HCI_DM3);
3510         else
3511                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3512
3513         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3514                 pkt_type |= (HCI_DH5 | HCI_DM5);
3515         else
3516                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3517
3518         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3519                 pkt_type &= ~HCI_2DH1;
3520         else
3521                 pkt_type |= HCI_2DH1;
3522
3523         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3524                 pkt_type &= ~HCI_2DH3;
3525         else
3526                 pkt_type |= HCI_2DH3;
3527
3528         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3529                 pkt_type &= ~HCI_2DH5;
3530         else
3531                 pkt_type |= HCI_2DH5;
3532
3533         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3534                 pkt_type &= ~HCI_3DH1;
3535         else
3536                 pkt_type |= HCI_3DH1;
3537
3538         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3539                 pkt_type &= ~HCI_3DH3;
3540         else
3541                 pkt_type |= HCI_3DH3;
3542
3543         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3544                 pkt_type &= ~HCI_3DH5;
3545         else
3546                 pkt_type |= HCI_3DH5;
3547
3548         if (pkt_type != hdev->pkt_type) {
3549                 hdev->pkt_type = pkt_type;
3550                 changed = true;
3551         }
3552
3553         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3554             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3555                 if (changed)
3556                         mgmt_phy_configuration_changed(hdev, sk);
3557
3558                 err = mgmt_cmd_complete(sk, hdev->id,
3559                                         MGMT_OP_SET_PHY_CONFIGURATION,
3560                                         0, NULL, 0);
3561
3562                 goto unlock;
3563         }
3564
3565         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3566                                len);
3567         if (!cmd) {
3568                 err = -ENOMEM;
3569                 goto unlock;
3570         }
3571
3572         hci_req_init(&req, hdev);
3573
3574         memset(&cp_phy, 0, sizeof(cp_phy));
3575
3576         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3577                 cp_phy.all_phys |= 0x01;
3578
3579         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3580                 cp_phy.all_phys |= 0x02;
3581
3582         if (selected_phys & MGMT_PHY_LE_1M_TX)
3583                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3584
3585         if (selected_phys & MGMT_PHY_LE_2M_TX)
3586                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3587
3588         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3589                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3590
3591         if (selected_phys & MGMT_PHY_LE_1M_RX)
3592                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3593
3594         if (selected_phys & MGMT_PHY_LE_2M_RX)
3595                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3596
3597         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3598                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3599
3600         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3601
3602         err = hci_req_run_skb(&req, set_default_phy_complete);
3603         if (err < 0)
3604                 mgmt_pending_remove(cmd);
3605
3606 unlock:
3607         hci_dev_unlock(hdev);
3608
3609         return err;
3610 }
3611
3612 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3613                             u16 len)
3614 {
3615         int err = MGMT_STATUS_SUCCESS;
3616         struct mgmt_cp_set_blocked_keys *keys = data;
3617         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3618                                    sizeof(struct mgmt_blocked_key_info));
3619         u16 key_count, expected_len;
3620         int i;
3621
3622         bt_dev_dbg(hdev, "sock %p", sk);
3623
3624         key_count = __le16_to_cpu(keys->key_count);
3625         if (key_count > max_key_count) {
3626                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3627                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3628                                        MGMT_STATUS_INVALID_PARAMS);
3629         }
3630
3631         expected_len = struct_size(keys, keys, key_count);
3632         if (expected_len != len) {
3633                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3634                            expected_len, len);
3635                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3636                                        MGMT_STATUS_INVALID_PARAMS);
3637         }
3638
3639         hci_dev_lock(hdev);
3640
3641         hci_blocked_keys_clear(hdev);
3642
3643         for (i = 0; i < keys->key_count; ++i) {
3644                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3645
3646                 if (!b) {
3647                         err = MGMT_STATUS_NO_RESOURCES;
3648                         break;
3649                 }
3650
3651                 b->type = keys->keys[i].type;
3652                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3653                 list_add_rcu(&b->list, &hdev->blocked_keys);
3654         }
3655         hci_dev_unlock(hdev);
3656
3657         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3658                                 err, NULL, 0);
3659 }
3660
3661 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3662                                void *data, u16 len)
3663 {
3664         struct mgmt_mode *cp = data;
3665         int err;
3666         bool changed = false;
3667
3668         bt_dev_dbg(hdev, "sock %p", sk);
3669
3670         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3671                 return mgmt_cmd_status(sk, hdev->id,
3672                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3673                                        MGMT_STATUS_NOT_SUPPORTED);
3674
3675         if (cp->val != 0x00 && cp->val != 0x01)
3676                 return mgmt_cmd_status(sk, hdev->id,
3677                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3678                                        MGMT_STATUS_INVALID_PARAMS);
3679
3680         hci_dev_lock(hdev);
3681
3682         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3683                 err = mgmt_cmd_status(sk, hdev->id,
3684                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3685                                       MGMT_STATUS_BUSY);
3686                 goto unlock;
3687         }
3688
3689         if (hdev_is_powered(hdev) &&
3690             !!cp->val != hci_dev_test_flag(hdev,
3691                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3692                 err = mgmt_cmd_status(sk, hdev->id,
3693                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3694                                       MGMT_STATUS_REJECTED);
3695                 goto unlock;
3696         }
3697
3698         if (cp->val)
3699                 changed = !hci_dev_test_and_set_flag(hdev,
3700                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3701         else
3702                 changed = hci_dev_test_and_clear_flag(hdev,
3703                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3704
3705         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3706         if (err < 0)
3707                 goto unlock;
3708
3709         if (changed)
3710                 err = new_settings(hdev, sk);
3711
3712 unlock:
3713         hci_dev_unlock(hdev);
3714         return err;
3715 }
3716
3717 static int read_security_info(struct sock *sk, struct hci_dev *hdev,
3718                               void *data, u16 data_len)
3719 {
3720         char buf[16];
3721         struct mgmt_rp_read_security_info *rp = (void *)buf;
3722         u16 sec_len = 0;
3723         u8 flags = 0;
3724
3725         bt_dev_dbg(hdev, "sock %p", sk);
3726
3727         memset(&buf, 0, sizeof(buf));
3728
3729         hci_dev_lock(hdev);
3730
3731         /* When the Read Simple Pairing Options command is supported, then
3732          * the remote public key validation is supported.
3733          */
3734         if (hdev->commands[41] & 0x08)
3735                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3736
3737         flags |= 0x02;          /* Remote public key validation (LE) */
3738
3739         /* When the Read Encryption Key Size command is supported, then the
3740          * encryption key size is enforced.
3741          */
3742         if (hdev->commands[20] & 0x10)
3743                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3744
3745         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3746
3747         sec_len = eir_append_data(rp->sec, sec_len, 0x01, &flags, 1);
3748
3749         /* When the Read Simple Pairing Options command is supported, then
3750          * also max encryption key size information is provided.
3751          */
3752         if (hdev->commands[41] & 0x08)
3753                 sec_len = eir_append_le16(rp->sec, sec_len, 0x02,
3754                                           hdev->max_enc_key_size);
3755
3756         sec_len = eir_append_le16(rp->sec, sec_len, 0x03, SMP_MAX_ENC_KEY_SIZE);
3757
3758         rp->sec_len = cpu_to_le16(sec_len);
3759
3760         hci_dev_unlock(hdev);
3761
3762         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_SECURITY_INFO, 0,
3763                                  rp, sizeof(*rp) + sec_len);
3764 }
3765
3766 #ifdef CONFIG_BT_FEATURE_DEBUG
3767 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3768 static const u8 debug_uuid[16] = {
3769         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3770         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3771 };
3772 #endif
3773
3774 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3775 static const u8 simult_central_periph_uuid[16] = {
3776         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3777         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3778 };
3779
3780 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3781 static const u8 rpa_resolution_uuid[16] = {
3782         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3783         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3784 };
3785
3786 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3787                                   void *data, u16 data_len)
3788 {
3789         char buf[62];   /* Enough space for 3 features */
3790         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3791         u16 idx = 0;
3792         u32 flags;
3793
3794         bt_dev_dbg(hdev, "sock %p", sk);
3795
3796         memset(&buf, 0, sizeof(buf));
3797
3798 #ifdef CONFIG_BT_FEATURE_DEBUG
3799         if (!hdev) {
3800                 flags = bt_dbg_get() ? BIT(0) : 0;
3801
3802                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3803                 rp->features[idx].flags = cpu_to_le32(flags);
3804                 idx++;
3805         }
3806 #endif
3807
3808         if (hdev) {
3809                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3810                     (hdev->le_states[4] & 0x08) &&      /* Central */
3811                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3812                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3813                         flags = BIT(0);
3814                 else
3815                         flags = 0;
3816
3817                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3818                 rp->features[idx].flags = cpu_to_le32(flags);
3819                 idx++;
3820         }
3821
3822         if (hdev && use_ll_privacy(hdev)) {
3823                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3824                         flags = BIT(0) | BIT(1);
3825                 else
3826                         flags = BIT(1);
3827
3828                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3829                 rp->features[idx].flags = cpu_to_le32(flags);
3830                 idx++;
3831         }
3832
3833         rp->feature_count = cpu_to_le16(idx);
3834
3835         /* After reading the experimental features information, enable
3836          * the events to update client on any future change.
3837          */
3838         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3839
3840         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3841                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3842                                  0, rp, sizeof(*rp) + (20 * idx));
3843 }
3844
3845 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3846                                           struct sock *skip)
3847 {
3848         struct mgmt_ev_exp_feature_changed ev;
3849
3850         memset(&ev, 0, sizeof(ev));
3851         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3852         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3853
3854         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3855                                   &ev, sizeof(ev),
3856                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3857
3858 }
3859
3860 #ifdef CONFIG_BT_FEATURE_DEBUG
3861 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3862 {
3863         struct mgmt_ev_exp_feature_changed ev;
3864
3865         memset(&ev, 0, sizeof(ev));
3866         memcpy(ev.uuid, debug_uuid, 16);
3867         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3868
3869         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3870                                   &ev, sizeof(ev),
3871                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3872 }
3873 #endif
3874
3875 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
3876                            void *data, u16 data_len)
3877 {
3878         struct mgmt_cp_set_exp_feature *cp = data;
3879         struct mgmt_rp_set_exp_feature rp;
3880
3881         bt_dev_dbg(hdev, "sock %p", sk);
3882
3883         if (!memcmp(cp->uuid, ZERO_KEY, 16)) {
3884                 memset(rp.uuid, 0, 16);
3885                 rp.flags = cpu_to_le32(0);
3886
3887 #ifdef CONFIG_BT_FEATURE_DEBUG
3888                 if (!hdev) {
3889                         bool changed = bt_dbg_get();
3890
3891                         bt_dbg_set(false);
3892
3893                         if (changed)
3894                                 exp_debug_feature_changed(false, sk);
3895                 }
3896 #endif
3897
3898                 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3899                         bool changed = hci_dev_test_flag(hdev,
3900                                                          HCI_ENABLE_LL_PRIVACY);
3901
3902                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3903
3904                         if (changed)
3905                                 exp_ll_privacy_feature_changed(false, hdev, sk);
3906                 }
3907
3908                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3909
3910                 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3911                                          MGMT_OP_SET_EXP_FEATURE, 0,
3912                                          &rp, sizeof(rp));
3913         }
3914
3915 #ifdef CONFIG_BT_FEATURE_DEBUG
3916         if (!memcmp(cp->uuid, debug_uuid, 16)) {
3917                 bool val, changed;
3918                 int err;
3919
3920                 /* Command requires to use the non-controller index */
3921                 if (hdev)
3922                         return mgmt_cmd_status(sk, hdev->id,
3923                                                MGMT_OP_SET_EXP_FEATURE,
3924                                                MGMT_STATUS_INVALID_INDEX);
3925
3926                 /* Parameters are limited to a single octet */
3927                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3928                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3929                                                MGMT_OP_SET_EXP_FEATURE,
3930                                                MGMT_STATUS_INVALID_PARAMS);
3931
3932                 /* Only boolean on/off is supported */
3933                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3934                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3935                                                MGMT_OP_SET_EXP_FEATURE,
3936                                                MGMT_STATUS_INVALID_PARAMS);
3937
3938                 val = !!cp->param[0];
3939                 changed = val ? !bt_dbg_get() : bt_dbg_get();
3940                 bt_dbg_set(val);
3941
3942                 memcpy(rp.uuid, debug_uuid, 16);
3943                 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3944
3945                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3946
3947                 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3948                                         MGMT_OP_SET_EXP_FEATURE, 0,
3949                                         &rp, sizeof(rp));
3950
3951                 if (changed)
3952                         exp_debug_feature_changed(val, sk);
3953
3954                 return err;
3955         }
3956 #endif
3957
3958         if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) {
3959                 bool val, changed;
3960                 int err;
3961                 u32 flags;
3962
3963                 /* Command requires to use the controller index */
3964                 if (!hdev)
3965                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3966                                                MGMT_OP_SET_EXP_FEATURE,
3967                                                MGMT_STATUS_INVALID_INDEX);
3968
3969                 /* Changes can only be made when controller is powered down */
3970                 if (hdev_is_powered(hdev))
3971                         return mgmt_cmd_status(sk, hdev->id,
3972                                                MGMT_OP_SET_EXP_FEATURE,
3973                                                MGMT_STATUS_NOT_POWERED);
3974
3975                 /* Parameters are limited to a single octet */
3976                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3977                         return mgmt_cmd_status(sk, hdev->id,
3978                                                MGMT_OP_SET_EXP_FEATURE,
3979                                                MGMT_STATUS_INVALID_PARAMS);
3980
3981                 /* Only boolean on/off is supported */
3982                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3983                         return mgmt_cmd_status(sk, hdev->id,
3984                                                MGMT_OP_SET_EXP_FEATURE,
3985                                                MGMT_STATUS_INVALID_PARAMS);
3986
3987                 val = !!cp->param[0];
3988
3989                 if (val) {
3990                         changed = !hci_dev_test_flag(hdev,
3991                                                      HCI_ENABLE_LL_PRIVACY);
3992                         hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3993                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
3994
3995                         /* Enable LL privacy + supported settings changed */
3996                         flags = BIT(0) | BIT(1);
3997                 } else {
3998                         changed = hci_dev_test_flag(hdev,
3999                                                     HCI_ENABLE_LL_PRIVACY);
4000                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4001
4002                         /* Disable LL privacy + supported settings changed */
4003                         flags = BIT(1);
4004                 }
4005
4006                 memcpy(rp.uuid, rpa_resolution_uuid, 16);
4007                 rp.flags = cpu_to_le32(flags);
4008
4009                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4010
4011                 err = mgmt_cmd_complete(sk, hdev->id,
4012                                         MGMT_OP_SET_EXP_FEATURE, 0,
4013                                         &rp, sizeof(rp));
4014
4015                 if (changed)
4016                         exp_ll_privacy_feature_changed(val, hdev, sk);
4017
4018                 return err;
4019         }
4020
4021         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4022                                MGMT_OP_SET_EXP_FEATURE,
4023                                MGMT_STATUS_NOT_SUPPORTED);
4024 }
4025
4026 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4027
4028 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4029                             u16 data_len)
4030 {
4031         struct mgmt_cp_get_device_flags *cp = data;
4032         struct mgmt_rp_get_device_flags rp;
4033         struct bdaddr_list_with_flags *br_params;
4034         struct hci_conn_params *params;
4035         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4036         u32 current_flags = 0;
4037         u8 status = MGMT_STATUS_INVALID_PARAMS;
4038
4039         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4040                    &cp->addr.bdaddr, cp->addr.type);
4041
4042         hci_dev_lock(hdev);
4043
4044         memset(&rp, 0, sizeof(rp));
4045
4046         if (cp->addr.type == BDADDR_BREDR) {
4047                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4048                                                               &cp->addr.bdaddr,
4049                                                               cp->addr.type);
4050                 if (!br_params)
4051                         goto done;
4052
4053                 current_flags = br_params->current_flags;
4054         } else {
4055                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4056                                                 le_addr_type(cp->addr.type));
4057
4058                 if (!params)
4059                         goto done;
4060
4061                 current_flags = params->current_flags;
4062         }
4063
4064         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4065         rp.addr.type = cp->addr.type;
4066         rp.supported_flags = cpu_to_le32(supported_flags);
4067         rp.current_flags = cpu_to_le32(current_flags);
4068
4069         status = MGMT_STATUS_SUCCESS;
4070
4071 done:
4072         hci_dev_unlock(hdev);
4073
4074         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4075                                 &rp, sizeof(rp));
4076 }
4077
4078 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4079                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4080                                  u32 supported_flags, u32 current_flags)
4081 {
4082         struct mgmt_ev_device_flags_changed ev;
4083
4084         bacpy(&ev.addr.bdaddr, bdaddr);
4085         ev.addr.type = bdaddr_type;
4086         ev.supported_flags = cpu_to_le32(supported_flags);
4087         ev.current_flags = cpu_to_le32(current_flags);
4088
4089         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4090 }
4091
4092 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4093                             u16 len)
4094 {
4095         struct mgmt_cp_set_device_flags *cp = data;
4096         struct bdaddr_list_with_flags *br_params;
4097         struct hci_conn_params *params;
4098         u8 status = MGMT_STATUS_INVALID_PARAMS;
4099         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4100         u32 current_flags = __le32_to_cpu(cp->current_flags);
4101
4102         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4103                    &cp->addr.bdaddr, cp->addr.type,
4104                    __le32_to_cpu(current_flags));
4105
4106         if ((supported_flags | current_flags) != supported_flags) {
4107                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4108                             current_flags, supported_flags);
4109                 goto done;
4110         }
4111
4112         hci_dev_lock(hdev);
4113
4114         if (cp->addr.type == BDADDR_BREDR) {
4115                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4116                                                               &cp->addr.bdaddr,
4117                                                               cp->addr.type);
4118
4119                 if (br_params) {
4120                         br_params->current_flags = current_flags;
4121                         status = MGMT_STATUS_SUCCESS;
4122                 } else {
4123                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4124                                     &cp->addr.bdaddr, cp->addr.type);
4125                 }
4126         } else {
4127                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4128                                                 le_addr_type(cp->addr.type));
4129                 if (params) {
4130                         params->current_flags = current_flags;
4131                         status = MGMT_STATUS_SUCCESS;
4132                 } else {
4133                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4134                                     &cp->addr.bdaddr,
4135                                     le_addr_type(cp->addr.type));
4136                 }
4137         }
4138
4139 done:
4140         hci_dev_unlock(hdev);
4141
4142         if (status == MGMT_STATUS_SUCCESS)
4143                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4144                                      supported_flags, current_flags);
4145
4146         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4147                                  &cp->addr, sizeof(cp->addr));
4148 }
4149
4150 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4151                                    u16 handle)
4152 {
4153         struct mgmt_ev_adv_monitor_added ev;
4154
4155         ev.monitor_handle = cpu_to_le16(handle);
4156
4157         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4158 }
4159
4160 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev,
4161                                      u16 handle)
4162 {
4163         struct mgmt_ev_adv_monitor_added ev;
4164
4165         ev.monitor_handle = cpu_to_le16(handle);
4166
4167         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk);
4168 }
4169
4170 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4171                                  void *data, u16 len)
4172 {
4173         struct adv_monitor *monitor = NULL;
4174         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4175         int handle, err;
4176         size_t rp_size = 0;
4177         __u32 supported = 0;
4178         __u16 num_handles = 0;
4179         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4180
4181         BT_DBG("request for %s", hdev->name);
4182
4183         hci_dev_lock(hdev);
4184
4185         if (msft_get_features(hdev) & MSFT_FEATURE_MASK_LE_ADV_MONITOR)
4186                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4187
4188         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) {
4189                 handles[num_handles++] = monitor->handle;
4190         }
4191
4192         hci_dev_unlock(hdev);
4193
4194         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4195         rp = kmalloc(rp_size, GFP_KERNEL);
4196         if (!rp)
4197                 return -ENOMEM;
4198
4199         /* Once controller-based monitoring is in place, the enabled_features
4200          * should reflect the use.
4201          */
4202         rp->supported_features = cpu_to_le32(supported);
4203         rp->enabled_features = 0;
4204         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4205         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4206         rp->num_handles = cpu_to_le16(num_handles);
4207         if (num_handles)
4208                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4209
4210         err = mgmt_cmd_complete(sk, hdev->id,
4211                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4212                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4213
4214         kfree(rp);
4215
4216         return err;
4217 }
4218
4219 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4220                                     void *data, u16 len)
4221 {
4222         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4223         struct mgmt_rp_add_adv_patterns_monitor rp;
4224         struct adv_monitor *m = NULL;
4225         struct adv_pattern *p = NULL;
4226         unsigned int mp_cnt = 0, prev_adv_monitors_cnt;
4227         __u8 cp_ofst = 0, cp_len = 0;
4228         int err, i;
4229
4230         BT_DBG("request for %s", hdev->name);
4231
4232         if (len <= sizeof(*cp) || cp->pattern_count == 0) {
4233                 err = mgmt_cmd_status(sk, hdev->id,
4234                                       MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4235                                       MGMT_STATUS_INVALID_PARAMS);
4236                 goto failed;
4237         }
4238
4239         m = kmalloc(sizeof(*m), GFP_KERNEL);
4240         if (!m) {
4241                 err = -ENOMEM;
4242                 goto failed;
4243         }
4244
4245         INIT_LIST_HEAD(&m->patterns);
4246         m->active = false;
4247
4248         for (i = 0; i < cp->pattern_count; i++) {
4249                 if (++mp_cnt > HCI_MAX_ADV_MONITOR_NUM_PATTERNS) {
4250                         err = mgmt_cmd_status(sk, hdev->id,
4251                                               MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4252                                               MGMT_STATUS_INVALID_PARAMS);
4253                         goto failed;
4254                 }
4255
4256                 cp_ofst = cp->patterns[i].offset;
4257                 cp_len = cp->patterns[i].length;
4258                 if (cp_ofst >= HCI_MAX_AD_LENGTH ||
4259                     cp_len > HCI_MAX_AD_LENGTH ||
4260                     (cp_ofst + cp_len) > HCI_MAX_AD_LENGTH) {
4261                         err = mgmt_cmd_status(sk, hdev->id,
4262                                               MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4263                                               MGMT_STATUS_INVALID_PARAMS);
4264                         goto failed;
4265                 }
4266
4267                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4268                 if (!p) {
4269                         err = -ENOMEM;
4270                         goto failed;
4271                 }
4272
4273                 p->ad_type = cp->patterns[i].ad_type;
4274                 p->offset = cp->patterns[i].offset;
4275                 p->length = cp->patterns[i].length;
4276                 memcpy(p->value, cp->patterns[i].value, p->length);
4277
4278                 INIT_LIST_HEAD(&p->list);
4279                 list_add(&p->list, &m->patterns);
4280         }
4281
4282         if (mp_cnt != cp->pattern_count) {
4283                 err = mgmt_cmd_status(sk, hdev->id,
4284                                       MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4285                                       MGMT_STATUS_INVALID_PARAMS);
4286                 goto failed;
4287         }
4288
4289         hci_dev_lock(hdev);
4290
4291         prev_adv_monitors_cnt = hdev->adv_monitors_cnt;
4292
4293         err = hci_add_adv_monitor(hdev, m);
4294         if (err) {
4295                 if (err == -ENOSPC) {
4296                         mgmt_cmd_status(sk, hdev->id,
4297                                         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4298                                         MGMT_STATUS_NO_RESOURCES);
4299                 }
4300                 goto unlock;
4301         }
4302
4303         if (hdev->adv_monitors_cnt > prev_adv_monitors_cnt)
4304                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4305
4306         hci_dev_unlock(hdev);
4307
4308         rp.monitor_handle = cpu_to_le16(m->handle);
4309
4310         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4311                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4312
4313 unlock:
4314         hci_dev_unlock(hdev);
4315
4316 failed:
4317         hci_free_adv_monitor(m);
4318         return err;
4319 }
4320
4321 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4322                               void *data, u16 len)
4323 {
4324         struct mgmt_cp_remove_adv_monitor *cp = data;
4325         struct mgmt_rp_remove_adv_monitor rp;
4326         unsigned int prev_adv_monitors_cnt;
4327         u16 handle;
4328         int err;
4329
4330         BT_DBG("request for %s", hdev->name);
4331
4332         hci_dev_lock(hdev);
4333
4334         handle = __le16_to_cpu(cp->monitor_handle);
4335         prev_adv_monitors_cnt = hdev->adv_monitors_cnt;
4336
4337         err = hci_remove_adv_monitor(hdev, handle);
4338         if (err == -ENOENT) {
4339                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4340                                       MGMT_STATUS_INVALID_INDEX);
4341                 goto unlock;
4342         }
4343
4344         if (hdev->adv_monitors_cnt < prev_adv_monitors_cnt)
4345                 mgmt_adv_monitor_removed(sk, hdev, handle);
4346
4347         hci_dev_unlock(hdev);
4348
4349         rp.monitor_handle = cp->monitor_handle;
4350
4351         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4352                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4353
4354 unlock:
4355         hci_dev_unlock(hdev);
4356         return err;
4357 }
4358
4359 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4360                                          u16 opcode, struct sk_buff *skb)
4361 {
4362         struct mgmt_rp_read_local_oob_data mgmt_rp;
4363         size_t rp_size = sizeof(mgmt_rp);
4364         struct mgmt_pending_cmd *cmd;
4365
4366         bt_dev_dbg(hdev, "status %u", status);
4367
4368         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4369         if (!cmd)
4370                 return;
4371
4372         if (status || !skb) {
4373                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4374                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4375                 goto remove;
4376         }
4377
4378         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4379
4380         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4381                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4382
4383                 if (skb->len < sizeof(*rp)) {
4384                         mgmt_cmd_status(cmd->sk, hdev->id,
4385                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4386                                         MGMT_STATUS_FAILED);
4387                         goto remove;
4388                 }
4389
4390                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4391                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4392
4393                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4394         } else {
4395                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4396
4397                 if (skb->len < sizeof(*rp)) {
4398                         mgmt_cmd_status(cmd->sk, hdev->id,
4399                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4400                                         MGMT_STATUS_FAILED);
4401                         goto remove;
4402                 }
4403
4404                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4405                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4406
4407                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4408                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4409         }
4410
4411         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4412                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4413
4414 remove:
4415         mgmt_pending_remove(cmd);
4416 }
4417
4418 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4419                                void *data, u16 data_len)
4420 {
4421         struct mgmt_pending_cmd *cmd;
4422         struct hci_request req;
4423         int err;
4424
4425         bt_dev_dbg(hdev, "sock %p", sk);
4426
4427         hci_dev_lock(hdev);
4428
4429         if (!hdev_is_powered(hdev)) {
4430                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4431                                       MGMT_STATUS_NOT_POWERED);
4432                 goto unlock;
4433         }
4434
4435         if (!lmp_ssp_capable(hdev)) {
4436                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4437                                       MGMT_STATUS_NOT_SUPPORTED);
4438                 goto unlock;
4439         }
4440
4441         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4442                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4443                                       MGMT_STATUS_BUSY);
4444                 goto unlock;
4445         }
4446
4447         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4448         if (!cmd) {
4449                 err = -ENOMEM;
4450                 goto unlock;
4451         }
4452
4453         hci_req_init(&req, hdev);
4454
4455         if (bredr_sc_enabled(hdev))
4456                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4457         else
4458                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4459
4460         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4461         if (err < 0)
4462                 mgmt_pending_remove(cmd);
4463
4464 unlock:
4465         hci_dev_unlock(hdev);
4466         return err;
4467 }
4468
4469 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4470                                void *data, u16 len)
4471 {
4472         struct mgmt_addr_info *addr = data;
4473         int err;
4474
4475         bt_dev_dbg(hdev, "sock %p", sk);
4476
4477         if (!bdaddr_type_is_valid(addr->type))
4478                 return mgmt_cmd_complete(sk, hdev->id,
4479                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4480                                          MGMT_STATUS_INVALID_PARAMS,
4481                                          addr, sizeof(*addr));
4482
4483         hci_dev_lock(hdev);
4484
4485         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4486                 struct mgmt_cp_add_remote_oob_data *cp = data;
4487                 u8 status;
4488
4489                 if (cp->addr.type != BDADDR_BREDR) {
4490                         err = mgmt_cmd_complete(sk, hdev->id,
4491                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4492                                                 MGMT_STATUS_INVALID_PARAMS,
4493                                                 &cp->addr, sizeof(cp->addr));
4494                         goto unlock;
4495                 }
4496
4497                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4498                                               cp->addr.type, cp->hash,
4499                                               cp->rand, NULL, NULL);
4500                 if (err < 0)
4501                         status = MGMT_STATUS_FAILED;
4502                 else
4503                         status = MGMT_STATUS_SUCCESS;
4504
4505                 err = mgmt_cmd_complete(sk, hdev->id,
4506                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4507                                         &cp->addr, sizeof(cp->addr));
4508         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4509                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4510                 u8 *rand192, *hash192, *rand256, *hash256;
4511                 u8 status;
4512
4513                 if (bdaddr_type_is_le(cp->addr.type)) {
4514                         /* Enforce zero-valued 192-bit parameters as
4515                          * long as legacy SMP OOB isn't implemented.
4516                          */
4517                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4518                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4519                                 err = mgmt_cmd_complete(sk, hdev->id,
4520                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4521                                                         MGMT_STATUS_INVALID_PARAMS,
4522                                                         addr, sizeof(*addr));
4523                                 goto unlock;
4524                         }
4525
4526                         rand192 = NULL;
4527                         hash192 = NULL;
4528                 } else {
4529                         /* In case one of the P-192 values is set to zero,
4530                          * then just disable OOB data for P-192.
4531                          */
4532                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4533                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4534                                 rand192 = NULL;
4535                                 hash192 = NULL;
4536                         } else {
4537                                 rand192 = cp->rand192;
4538                                 hash192 = cp->hash192;
4539                         }
4540                 }
4541
4542                 /* In case one of the P-256 values is set to zero, then just
4543                  * disable OOB data for P-256.
4544                  */
4545                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4546                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4547                         rand256 = NULL;
4548                         hash256 = NULL;
4549                 } else {
4550                         rand256 = cp->rand256;
4551                         hash256 = cp->hash256;
4552                 }
4553
4554                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4555                                               cp->addr.type, hash192, rand192,
4556                                               hash256, rand256);
4557                 if (err < 0)
4558                         status = MGMT_STATUS_FAILED;
4559                 else
4560                         status = MGMT_STATUS_SUCCESS;
4561
4562                 err = mgmt_cmd_complete(sk, hdev->id,
4563                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4564                                         status, &cp->addr, sizeof(cp->addr));
4565         } else {
4566                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4567                            len);
4568                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4569                                       MGMT_STATUS_INVALID_PARAMS);
4570         }
4571
4572 unlock:
4573         hci_dev_unlock(hdev);
4574         return err;
4575 }
4576
4577 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4578                                   void *data, u16 len)
4579 {
4580         struct mgmt_cp_remove_remote_oob_data *cp = data;
4581         u8 status;
4582         int err;
4583
4584         bt_dev_dbg(hdev, "sock %p", sk);
4585
4586         if (cp->addr.type != BDADDR_BREDR)
4587                 return mgmt_cmd_complete(sk, hdev->id,
4588                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4589                                          MGMT_STATUS_INVALID_PARAMS,
4590                                          &cp->addr, sizeof(cp->addr));
4591
4592         hci_dev_lock(hdev);
4593
4594         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4595                 hci_remote_oob_data_clear(hdev);
4596                 status = MGMT_STATUS_SUCCESS;
4597                 goto done;
4598         }
4599
4600         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4601         if (err < 0)
4602                 status = MGMT_STATUS_INVALID_PARAMS;
4603         else
4604                 status = MGMT_STATUS_SUCCESS;
4605
4606 done:
4607         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4608                                 status, &cp->addr, sizeof(cp->addr));
4609
4610         hci_dev_unlock(hdev);
4611         return err;
4612 }
4613
4614 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4615 {
4616         struct mgmt_pending_cmd *cmd;
4617
4618         bt_dev_dbg(hdev, "status %d", status);
4619
4620         hci_dev_lock(hdev);
4621
4622         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4623         if (!cmd)
4624                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4625
4626         if (!cmd)
4627                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4628
4629         if (cmd) {
4630                 cmd->cmd_complete(cmd, mgmt_status(status));
4631                 mgmt_pending_remove(cmd);
4632         }
4633
4634         hci_dev_unlock(hdev);
4635
4636         /* Handle suspend notifier */
4637         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4638                                hdev->suspend_tasks)) {
4639                 bt_dev_dbg(hdev, "Unpaused discovery");
4640                 wake_up(&hdev->suspend_wait_q);
4641         }
4642 }
4643
4644 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4645                                     uint8_t *mgmt_status)
4646 {
4647         switch (type) {
4648         case DISCOV_TYPE_LE:
4649                 *mgmt_status = mgmt_le_support(hdev);
4650                 if (*mgmt_status)
4651                         return false;
4652                 break;
4653         case DISCOV_TYPE_INTERLEAVED:
4654                 *mgmt_status = mgmt_le_support(hdev);
4655                 if (*mgmt_status)
4656                         return false;
4657                 fallthrough;
4658         case DISCOV_TYPE_BREDR:
4659                 *mgmt_status = mgmt_bredr_support(hdev);
4660                 if (*mgmt_status)
4661                         return false;
4662                 break;
4663         default:
4664                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4665                 return false;
4666         }
4667
4668         return true;
4669 }
4670
4671 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4672                                     u16 op, void *data, u16 len)
4673 {
4674         struct mgmt_cp_start_discovery *cp = data;
4675         struct mgmt_pending_cmd *cmd;
4676         u8 status;
4677         int err;
4678
4679         bt_dev_dbg(hdev, "sock %p", sk);
4680
4681         hci_dev_lock(hdev);
4682
4683         if (!hdev_is_powered(hdev)) {
4684                 err = mgmt_cmd_complete(sk, hdev->id, op,
4685                                         MGMT_STATUS_NOT_POWERED,
4686                                         &cp->type, sizeof(cp->type));
4687                 goto failed;
4688         }
4689
4690         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4691             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4692                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4693                                         &cp->type, sizeof(cp->type));
4694                 goto failed;
4695         }
4696
4697         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4698                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4699                                         &cp->type, sizeof(cp->type));
4700                 goto failed;
4701         }
4702
4703         /* Can't start discovery when it is paused */
4704         if (hdev->discovery_paused) {
4705                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4706                                         &cp->type, sizeof(cp->type));
4707                 goto failed;
4708         }
4709
4710         /* Clear the discovery filter first to free any previously
4711          * allocated memory for the UUID list.
4712          */
4713         hci_discovery_filter_clear(hdev);
4714
4715         hdev->discovery.type = cp->type;
4716         hdev->discovery.report_invalid_rssi = false;
4717         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4718                 hdev->discovery.limited = true;
4719         else
4720                 hdev->discovery.limited = false;
4721
4722         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4723         if (!cmd) {
4724                 err = -ENOMEM;
4725                 goto failed;
4726         }
4727
4728         cmd->cmd_complete = generic_cmd_complete;
4729
4730         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4731         queue_work(hdev->req_workqueue, &hdev->discov_update);
4732         err = 0;
4733
4734 failed:
4735         hci_dev_unlock(hdev);
4736         return err;
4737 }
4738
4739 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4740                            void *data, u16 len)
4741 {
4742         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4743                                         data, len);
4744 }
4745
4746 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
4747                                    void *data, u16 len)
4748 {
4749         return start_discovery_internal(sk, hdev,
4750                                         MGMT_OP_START_LIMITED_DISCOVERY,
4751                                         data, len);
4752 }
4753
4754 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4755                                           u8 status)
4756 {
4757         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4758                                  cmd->param, 1);
4759 }
4760
4761 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4762                                    void *data, u16 len)
4763 {
4764         struct mgmt_cp_start_service_discovery *cp = data;
4765         struct mgmt_pending_cmd *cmd;
4766         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4767         u16 uuid_count, expected_len;
4768         u8 status;
4769         int err;
4770
4771         bt_dev_dbg(hdev, "sock %p", sk);
4772
4773         hci_dev_lock(hdev);
4774
4775         if (!hdev_is_powered(hdev)) {
4776                 err = mgmt_cmd_complete(sk, hdev->id,
4777                                         MGMT_OP_START_SERVICE_DISCOVERY,
4778                                         MGMT_STATUS_NOT_POWERED,
4779                                         &cp->type, sizeof(cp->type));
4780                 goto failed;
4781         }
4782
4783         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4784             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4785                 err = mgmt_cmd_complete(sk, hdev->id,
4786                                         MGMT_OP_START_SERVICE_DISCOVERY,
4787                                         MGMT_STATUS_BUSY, &cp->type,
4788                                         sizeof(cp->type));
4789                 goto failed;
4790         }
4791
4792         uuid_count = __le16_to_cpu(cp->uuid_count);
4793         if (uuid_count > max_uuid_count) {
4794                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
4795                            uuid_count);
4796                 err = mgmt_cmd_complete(sk, hdev->id,
4797                                         MGMT_OP_START_SERVICE_DISCOVERY,
4798                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4799                                         sizeof(cp->type));
4800                 goto failed;
4801         }
4802
4803         expected_len = sizeof(*cp) + uuid_count * 16;
4804         if (expected_len != len) {
4805                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
4806                            expected_len, len);
4807                 err = mgmt_cmd_complete(sk, hdev->id,
4808                                         MGMT_OP_START_SERVICE_DISCOVERY,
4809                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
4810                                         sizeof(cp->type));
4811                 goto failed;
4812         }
4813
4814         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4815                 err = mgmt_cmd_complete(sk, hdev->id,
4816                                         MGMT_OP_START_SERVICE_DISCOVERY,
4817                                         status, &cp->type, sizeof(cp->type));
4818                 goto failed;
4819         }
4820
4821         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4822                                hdev, data, len);
4823         if (!cmd) {
4824                 err = -ENOMEM;
4825                 goto failed;
4826         }
4827
4828         cmd->cmd_complete = service_discovery_cmd_complete;
4829
4830         /* Clear the discovery filter first to free any previously
4831          * allocated memory for the UUID list.
4832          */
4833         hci_discovery_filter_clear(hdev);
4834
4835         hdev->discovery.result_filtering = true;
4836         hdev->discovery.type = cp->type;
4837         hdev->discovery.rssi = cp->rssi;
4838         hdev->discovery.uuid_count = uuid_count;
4839
4840         if (uuid_count > 0) {
4841                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4842                                                 GFP_KERNEL);
4843                 if (!hdev->discovery.uuids) {
4844                         err = mgmt_cmd_complete(sk, hdev->id,
4845                                                 MGMT_OP_START_SERVICE_DISCOVERY,
4846                                                 MGMT_STATUS_FAILED,
4847                                                 &cp->type, sizeof(cp->type));
4848                         mgmt_pending_remove(cmd);
4849                         goto failed;
4850                 }
4851         }
4852
4853         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4854         queue_work(hdev->req_workqueue, &hdev->discov_update);
4855         err = 0;
4856
4857 failed:
4858         hci_dev_unlock(hdev);
4859         return err;
4860 }
4861
4862 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4863 {
4864         struct mgmt_pending_cmd *cmd;
4865
4866         bt_dev_dbg(hdev, "status %d", status);
4867
4868         hci_dev_lock(hdev);
4869
4870         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4871         if (cmd) {
4872                 cmd->cmd_complete(cmd, mgmt_status(status));
4873                 mgmt_pending_remove(cmd);
4874         }
4875
4876         hci_dev_unlock(hdev);
4877
4878         /* Handle suspend notifier */
4879         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
4880                 bt_dev_dbg(hdev, "Paused discovery");
4881                 wake_up(&hdev->suspend_wait_q);
4882         }
4883 }
4884
4885 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4886                           u16 len)
4887 {
4888         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4889         struct mgmt_pending_cmd *cmd;
4890         int err;
4891
4892         bt_dev_dbg(hdev, "sock %p", sk);
4893
4894         hci_dev_lock(hdev);
4895
4896         if (!hci_discovery_active(hdev)) {
4897                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4898                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
4899                                         sizeof(mgmt_cp->type));
4900                 goto unlock;
4901         }
4902
4903         if (hdev->discovery.type != mgmt_cp->type) {
4904                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4905                                         MGMT_STATUS_INVALID_PARAMS,
4906                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
4907                 goto unlock;
4908         }
4909
4910         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4911         if (!cmd) {
4912                 err = -ENOMEM;
4913                 goto unlock;
4914         }
4915
4916         cmd->cmd_complete = generic_cmd_complete;
4917
4918         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4919         queue_work(hdev->req_workqueue, &hdev->discov_update);
4920         err = 0;
4921
4922 unlock:
4923         hci_dev_unlock(hdev);
4924         return err;
4925 }
4926
4927 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4928                         u16 len)
4929 {
4930         struct mgmt_cp_confirm_name *cp = data;
4931         struct inquiry_entry *e;
4932         int err;
4933
4934         bt_dev_dbg(hdev, "sock %p", sk);
4935
4936         hci_dev_lock(hdev);
4937
4938         if (!hci_discovery_active(hdev)) {
4939                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4940                                         MGMT_STATUS_FAILED, &cp->addr,
4941                                         sizeof(cp->addr));
4942                 goto failed;
4943         }
4944
4945         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4946         if (!e) {
4947                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4948                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4949                                         sizeof(cp->addr));
4950                 goto failed;
4951         }
4952
4953         if (cp->name_known) {
4954                 e->name_state = NAME_KNOWN;
4955                 list_del(&e->list);
4956         } else {
4957                 e->name_state = NAME_NEEDED;
4958                 hci_inquiry_cache_update_resolve(hdev, e);
4959         }
4960
4961         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4962                                 &cp->addr, sizeof(cp->addr));
4963
4964 failed:
4965         hci_dev_unlock(hdev);
4966         return err;
4967 }
4968
4969 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4970                         u16 len)
4971 {
4972         struct mgmt_cp_block_device *cp = data;
4973         u8 status;
4974         int err;
4975
4976         bt_dev_dbg(hdev, "sock %p", sk);
4977
4978         if (!bdaddr_type_is_valid(cp->addr.type))
4979                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4980                                          MGMT_STATUS_INVALID_PARAMS,
4981                                          &cp->addr, sizeof(cp->addr));
4982
4983         hci_dev_lock(hdev);
4984
4985         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4986                                   cp->addr.type);
4987         if (err < 0) {
4988                 status = MGMT_STATUS_FAILED;
4989                 goto done;
4990         }
4991
4992         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4993                    sk);
4994         status = MGMT_STATUS_SUCCESS;
4995
4996 done:
4997         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4998                                 &cp->addr, sizeof(cp->addr));
4999
5000         hci_dev_unlock(hdev);
5001
5002         return err;
5003 }
5004
5005 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5006                           u16 len)
5007 {
5008         struct mgmt_cp_unblock_device *cp = data;
5009         u8 status;
5010         int err;
5011
5012         bt_dev_dbg(hdev, "sock %p", sk);
5013
5014         if (!bdaddr_type_is_valid(cp->addr.type))
5015                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5016                                          MGMT_STATUS_INVALID_PARAMS,
5017                                          &cp->addr, sizeof(cp->addr));
5018
5019         hci_dev_lock(hdev);
5020
5021         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
5022                                   cp->addr.type);
5023         if (err < 0) {
5024                 status = MGMT_STATUS_INVALID_PARAMS;
5025                 goto done;
5026         }
5027
5028         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5029                    sk);
5030         status = MGMT_STATUS_SUCCESS;
5031
5032 done:
5033         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5034                                 &cp->addr, sizeof(cp->addr));
5035
5036         hci_dev_unlock(hdev);
5037
5038         return err;
5039 }
5040
5041 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5042                          u16 len)
5043 {
5044         struct mgmt_cp_set_device_id *cp = data;
5045         struct hci_request req;
5046         int err;
5047         __u16 source;
5048
5049         bt_dev_dbg(hdev, "sock %p", sk);
5050
5051         source = __le16_to_cpu(cp->source);
5052
5053         if (source > 0x0002)
5054                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5055                                        MGMT_STATUS_INVALID_PARAMS);
5056
5057         hci_dev_lock(hdev);
5058
5059         hdev->devid_source = source;
5060         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5061         hdev->devid_product = __le16_to_cpu(cp->product);
5062         hdev->devid_version = __le16_to_cpu(cp->version);
5063
5064         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5065                                 NULL, 0);
5066
5067         hci_req_init(&req, hdev);
5068         __hci_req_update_eir(&req);
5069         hci_req_run(&req, NULL);
5070
5071         hci_dev_unlock(hdev);
5072
5073         return err;
5074 }
5075
5076 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5077                                         u16 opcode)
5078 {
5079         bt_dev_dbg(hdev, "status %d", status);
5080 }
5081
5082 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5083                                      u16 opcode)
5084 {
5085         struct cmd_lookup match = { NULL, hdev };
5086         struct hci_request req;
5087         u8 instance;
5088         struct adv_info *adv_instance;
5089         int err;
5090
5091         hci_dev_lock(hdev);
5092
5093         if (status) {
5094                 u8 mgmt_err = mgmt_status(status);
5095
5096                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5097                                      cmd_status_rsp, &mgmt_err);
5098                 goto unlock;
5099         }
5100
5101         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5102                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5103         else
5104                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5105
5106         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5107                              &match);
5108
5109         new_settings(hdev, match.sk);
5110
5111         if (match.sk)
5112                 sock_put(match.sk);
5113
5114         /* Handle suspend notifier */
5115         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5116                                hdev->suspend_tasks)) {
5117                 bt_dev_dbg(hdev, "Paused advertising");
5118                 wake_up(&hdev->suspend_wait_q);
5119         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5120                                       hdev->suspend_tasks)) {
5121                 bt_dev_dbg(hdev, "Unpaused advertising");
5122                 wake_up(&hdev->suspend_wait_q);
5123         }
5124
5125         /* If "Set Advertising" was just disabled and instance advertising was
5126          * set up earlier, then re-enable multi-instance advertising.
5127          */
5128         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5129             list_empty(&hdev->adv_instances))
5130                 goto unlock;
5131
5132         instance = hdev->cur_adv_instance;
5133         if (!instance) {
5134                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5135                                                         struct adv_info, list);
5136                 if (!adv_instance)
5137                         goto unlock;
5138
5139                 instance = adv_instance->instance;
5140         }
5141
5142         hci_req_init(&req, hdev);
5143
5144         err = __hci_req_schedule_adv_instance(&req, instance, true);
5145
5146         if (!err)
5147                 err = hci_req_run(&req, enable_advertising_instance);
5148
5149         if (err)
5150                 bt_dev_err(hdev, "failed to re-configure advertising");
5151
5152 unlock:
5153         hci_dev_unlock(hdev);
5154 }
5155
5156 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5157                            u16 len)
5158 {
5159         struct mgmt_mode *cp = data;
5160         struct mgmt_pending_cmd *cmd;
5161         struct hci_request req;
5162         u8 val, status;
5163         int err;
5164
5165         bt_dev_dbg(hdev, "sock %p", sk);
5166
5167         status = mgmt_le_support(hdev);
5168         if (status)
5169                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5170                                        status);
5171
5172         /* Enabling the experimental LL Privay support disables support for
5173          * advertising.
5174          */
5175         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5176                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5177                                        MGMT_STATUS_NOT_SUPPORTED);
5178
5179         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5180                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5181                                        MGMT_STATUS_INVALID_PARAMS);
5182
5183         if (hdev->advertising_paused)
5184                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5185                                        MGMT_STATUS_BUSY);
5186
5187         hci_dev_lock(hdev);
5188
5189         val = !!cp->val;
5190
5191         /* The following conditions are ones which mean that we should
5192          * not do any HCI communication but directly send a mgmt
5193          * response to user space (after toggling the flag if
5194          * necessary).
5195          */
5196         if (!hdev_is_powered(hdev) ||
5197             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5198              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5199             hci_conn_num(hdev, LE_LINK) > 0 ||
5200             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5201              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5202                 bool changed;
5203
5204                 if (cp->val) {
5205                         hdev->cur_adv_instance = 0x00;
5206                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5207                         if (cp->val == 0x02)
5208                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5209                         else
5210                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5211                 } else {
5212                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5213                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5214                 }
5215
5216                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5217                 if (err < 0)
5218                         goto unlock;
5219
5220                 if (changed)
5221                         err = new_settings(hdev, sk);
5222
5223                 goto unlock;
5224         }
5225
5226         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5227             pending_find(MGMT_OP_SET_LE, hdev)) {
5228                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5229                                       MGMT_STATUS_BUSY);
5230                 goto unlock;
5231         }
5232
5233         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5234         if (!cmd) {
5235                 err = -ENOMEM;
5236                 goto unlock;
5237         }
5238
5239         hci_req_init(&req, hdev);
5240
5241         if (cp->val == 0x02)
5242                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5243         else
5244                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5245
5246         cancel_adv_timeout(hdev);
5247
5248         if (val) {
5249                 /* Switch to instance "0" for the Set Advertising setting.
5250                  * We cannot use update_[adv|scan_rsp]_data() here as the
5251                  * HCI_ADVERTISING flag is not yet set.
5252                  */
5253                 hdev->cur_adv_instance = 0x00;
5254
5255                 if (ext_adv_capable(hdev)) {
5256                         __hci_req_start_ext_adv(&req, 0x00);
5257                 } else {
5258                         __hci_req_update_adv_data(&req, 0x00);
5259                         __hci_req_update_scan_rsp_data(&req, 0x00);
5260                         __hci_req_enable_advertising(&req);
5261                 }
5262         } else {
5263                 __hci_req_disable_advertising(&req);
5264         }
5265
5266         err = hci_req_run(&req, set_advertising_complete);
5267         if (err < 0)
5268                 mgmt_pending_remove(cmd);
5269
5270 unlock:
5271         hci_dev_unlock(hdev);
5272         return err;
5273 }
5274
5275 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5276                               void *data, u16 len)
5277 {
5278         struct mgmt_cp_set_static_address *cp = data;
5279         int err;
5280
5281         bt_dev_dbg(hdev, "sock %p", sk);
5282
5283         if (!lmp_le_capable(hdev))
5284                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5285                                        MGMT_STATUS_NOT_SUPPORTED);
5286
5287         if (hdev_is_powered(hdev))
5288                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5289                                        MGMT_STATUS_REJECTED);
5290
5291         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5292                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5293                         return mgmt_cmd_status(sk, hdev->id,
5294                                                MGMT_OP_SET_STATIC_ADDRESS,
5295                                                MGMT_STATUS_INVALID_PARAMS);
5296
5297                 /* Two most significant bits shall be set */
5298                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5299                         return mgmt_cmd_status(sk, hdev->id,
5300                                                MGMT_OP_SET_STATIC_ADDRESS,
5301                                                MGMT_STATUS_INVALID_PARAMS);
5302         }
5303
5304         hci_dev_lock(hdev);
5305
5306         bacpy(&hdev->static_addr, &cp->bdaddr);
5307
5308         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5309         if (err < 0)
5310                 goto unlock;
5311
5312         err = new_settings(hdev, sk);
5313
5314 unlock:
5315         hci_dev_unlock(hdev);
5316         return err;
5317 }
5318
5319 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5320                            void *data, u16 len)
5321 {
5322         struct mgmt_cp_set_scan_params *cp = data;
5323         __u16 interval, window;
5324         int err;
5325
5326         bt_dev_dbg(hdev, "sock %p", sk);
5327
5328         if (!lmp_le_capable(hdev))
5329                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5330                                        MGMT_STATUS_NOT_SUPPORTED);
5331
5332         interval = __le16_to_cpu(cp->interval);
5333
5334         if (interval < 0x0004 || interval > 0x4000)
5335                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5336                                        MGMT_STATUS_INVALID_PARAMS);
5337
5338         window = __le16_to_cpu(cp->window);
5339
5340         if (window < 0x0004 || window > 0x4000)
5341                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5342                                        MGMT_STATUS_INVALID_PARAMS);
5343
5344         if (window > interval)
5345                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5346                                        MGMT_STATUS_INVALID_PARAMS);
5347
5348         hci_dev_lock(hdev);
5349
5350         hdev->le_scan_interval = interval;
5351         hdev->le_scan_window = window;
5352
5353         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5354                                 NULL, 0);
5355
5356         /* If background scan is running, restart it so new parameters are
5357          * loaded.
5358          */
5359         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5360             hdev->discovery.state == DISCOVERY_STOPPED) {
5361                 struct hci_request req;
5362
5363                 hci_req_init(&req, hdev);
5364
5365                 hci_req_add_le_scan_disable(&req, false);
5366                 hci_req_add_le_passive_scan(&req);
5367
5368                 hci_req_run(&req, NULL);
5369         }
5370
5371         hci_dev_unlock(hdev);
5372
5373         return err;
5374 }
5375
5376 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5377                                       u16 opcode)
5378 {
5379         struct mgmt_pending_cmd *cmd;
5380
5381         bt_dev_dbg(hdev, "status 0x%02x", status);
5382
5383         hci_dev_lock(hdev);
5384
5385         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5386         if (!cmd)
5387                 goto unlock;
5388
5389         if (status) {
5390                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5391                                 mgmt_status(status));
5392         } else {
5393                 struct mgmt_mode *cp = cmd->param;
5394
5395                 if (cp->val)
5396                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5397                 else
5398                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5399
5400                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5401                 new_settings(hdev, cmd->sk);
5402         }
5403
5404         mgmt_pending_remove(cmd);
5405
5406 unlock:
5407         hci_dev_unlock(hdev);
5408 }
5409
5410 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5411                                 void *data, u16 len)
5412 {
5413         struct mgmt_mode *cp = data;
5414         struct mgmt_pending_cmd *cmd;
5415         struct hci_request req;
5416         int err;
5417
5418         bt_dev_dbg(hdev, "sock %p", sk);
5419
5420         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5421             hdev->hci_ver < BLUETOOTH_VER_1_2)
5422                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5423                                        MGMT_STATUS_NOT_SUPPORTED);
5424
5425         if (cp->val != 0x00 && cp->val != 0x01)
5426                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5427                                        MGMT_STATUS_INVALID_PARAMS);
5428
5429         hci_dev_lock(hdev);
5430
5431         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5432                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5433                                       MGMT_STATUS_BUSY);
5434                 goto unlock;
5435         }
5436
5437         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5438                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5439                                         hdev);
5440                 goto unlock;
5441         }
5442
5443         if (!hdev_is_powered(hdev)) {
5444                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5445                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5446                                         hdev);
5447                 new_settings(hdev, sk);
5448                 goto unlock;
5449         }
5450
5451         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5452                                data, len);
5453         if (!cmd) {
5454                 err = -ENOMEM;
5455                 goto unlock;
5456         }
5457
5458         hci_req_init(&req, hdev);
5459
5460         __hci_req_write_fast_connectable(&req, cp->val);
5461
5462         err = hci_req_run(&req, fast_connectable_complete);
5463         if (err < 0) {
5464                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5465                                       MGMT_STATUS_FAILED);
5466                 mgmt_pending_remove(cmd);
5467         }
5468
5469 unlock:
5470         hci_dev_unlock(hdev);
5471
5472         return err;
5473 }
5474
5475 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5476 {
5477         struct mgmt_pending_cmd *cmd;
5478
5479         bt_dev_dbg(hdev, "status 0x%02x", status);
5480
5481         hci_dev_lock(hdev);
5482
5483         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5484         if (!cmd)
5485                 goto unlock;
5486
5487         if (status) {
5488                 u8 mgmt_err = mgmt_status(status);
5489
5490                 /* We need to restore the flag if related HCI commands
5491                  * failed.
5492                  */
5493                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5494
5495                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5496         } else {
5497                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5498                 new_settings(hdev, cmd->sk);
5499         }
5500
5501         mgmt_pending_remove(cmd);
5502
5503 unlock:
5504         hci_dev_unlock(hdev);
5505 }
5506
5507 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5508 {
5509         struct mgmt_mode *cp = data;
5510         struct mgmt_pending_cmd *cmd;
5511         struct hci_request req;
5512         int err;
5513
5514         bt_dev_dbg(hdev, "sock %p", sk);
5515
5516         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5517                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5518                                        MGMT_STATUS_NOT_SUPPORTED);
5519
5520         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5521                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5522                                        MGMT_STATUS_REJECTED);
5523
5524         if (cp->val != 0x00 && cp->val != 0x01)
5525                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5526                                        MGMT_STATUS_INVALID_PARAMS);
5527
5528         hci_dev_lock(hdev);
5529
5530         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5531                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5532                 goto unlock;
5533         }
5534
5535         if (!hdev_is_powered(hdev)) {
5536                 if (!cp->val) {
5537                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5538                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5539                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5540                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5541                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5542                 }
5543
5544                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5545
5546                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5547                 if (err < 0)
5548                         goto unlock;
5549
5550                 err = new_settings(hdev, sk);
5551                 goto unlock;
5552         }
5553
5554         /* Reject disabling when powered on */
5555         if (!cp->val) {
5556                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5557                                       MGMT_STATUS_REJECTED);
5558                 goto unlock;
5559         } else {
5560                 /* When configuring a dual-mode controller to operate
5561                  * with LE only and using a static address, then switching
5562                  * BR/EDR back on is not allowed.
5563                  *
5564                  * Dual-mode controllers shall operate with the public
5565                  * address as its identity address for BR/EDR and LE. So
5566                  * reject the attempt to create an invalid configuration.
5567                  *
5568                  * The same restrictions applies when secure connections
5569                  * has been enabled. For BR/EDR this is a controller feature
5570                  * while for LE it is a host stack feature. This means that
5571                  * switching BR/EDR back on when secure connections has been
5572                  * enabled is not a supported transaction.
5573                  */
5574                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5575                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5576                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5577                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5578                                               MGMT_STATUS_REJECTED);
5579                         goto unlock;
5580                 }
5581         }
5582
5583         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5584                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5585                                       MGMT_STATUS_BUSY);
5586                 goto unlock;
5587         }
5588
5589         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5590         if (!cmd) {
5591                 err = -ENOMEM;
5592                 goto unlock;
5593         }
5594
5595         /* We need to flip the bit already here so that
5596          * hci_req_update_adv_data generates the correct flags.
5597          */
5598         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5599
5600         hci_req_init(&req, hdev);
5601
5602         __hci_req_write_fast_connectable(&req, false);
5603         __hci_req_update_scan(&req);
5604
5605         /* Since only the advertising data flags will change, there
5606          * is no need to update the scan response data.
5607          */
5608         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5609
5610         err = hci_req_run(&req, set_bredr_complete);
5611         if (err < 0)
5612                 mgmt_pending_remove(cmd);
5613
5614 unlock:
5615         hci_dev_unlock(hdev);
5616         return err;
5617 }
5618
5619 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5620 {
5621         struct mgmt_pending_cmd *cmd;
5622         struct mgmt_mode *cp;
5623
5624         bt_dev_dbg(hdev, "status %u", status);
5625
5626         hci_dev_lock(hdev);
5627
5628         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5629         if (!cmd)
5630                 goto unlock;
5631
5632         if (status) {
5633                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5634                                 mgmt_status(status));
5635                 goto remove;
5636         }
5637
5638         cp = cmd->param;
5639
5640         switch (cp->val) {
5641         case 0x00:
5642                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5643                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5644                 break;
5645         case 0x01:
5646                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5647                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5648                 break;
5649         case 0x02:
5650                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5651                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5652                 break;
5653         }
5654
5655         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5656         new_settings(hdev, cmd->sk);
5657
5658 remove:
5659         mgmt_pending_remove(cmd);
5660 unlock:
5661         hci_dev_unlock(hdev);
5662 }
5663
5664 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5665                            void *data, u16 len)
5666 {
5667         struct mgmt_mode *cp = data;
5668         struct mgmt_pending_cmd *cmd;
5669         struct hci_request req;
5670         u8 val;
5671         int err;
5672
5673         bt_dev_dbg(hdev, "sock %p", sk);
5674
5675         if (!lmp_sc_capable(hdev) &&
5676             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5677                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5678                                        MGMT_STATUS_NOT_SUPPORTED);
5679
5680         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5681             lmp_sc_capable(hdev) &&
5682             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5683                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5684                                        MGMT_STATUS_REJECTED);
5685
5686         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5687                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5688                                   MGMT_STATUS_INVALID_PARAMS);
5689
5690         hci_dev_lock(hdev);
5691
5692         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5693             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5694                 bool changed;
5695
5696                 if (cp->val) {
5697                         changed = !hci_dev_test_and_set_flag(hdev,
5698                                                              HCI_SC_ENABLED);
5699                         if (cp->val == 0x02)
5700                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5701                         else
5702                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5703                 } else {
5704                         changed = hci_dev_test_and_clear_flag(hdev,
5705                                                               HCI_SC_ENABLED);
5706                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5707                 }
5708
5709                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5710                 if (err < 0)
5711                         goto failed;
5712
5713                 if (changed)
5714                         err = new_settings(hdev, sk);
5715
5716                 goto failed;
5717         }
5718
5719         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5720                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5721                                       MGMT_STATUS_BUSY);
5722                 goto failed;
5723         }
5724
5725         val = !!cp->val;
5726
5727         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5728             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5729                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5730                 goto failed;
5731         }
5732
5733         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5734         if (!cmd) {
5735                 err = -ENOMEM;
5736                 goto failed;
5737         }
5738
5739         hci_req_init(&req, hdev);
5740         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5741         err = hci_req_run(&req, sc_enable_complete);
5742         if (err < 0) {
5743                 mgmt_pending_remove(cmd);
5744                 goto failed;
5745         }
5746
5747 failed:
5748         hci_dev_unlock(hdev);
5749         return err;
5750 }
5751
5752 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5753                           void *data, u16 len)
5754 {
5755         struct mgmt_mode *cp = data;
5756         bool changed, use_changed;
5757         int err;
5758
5759         bt_dev_dbg(hdev, "sock %p", sk);
5760
5761         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5762                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5763                                        MGMT_STATUS_INVALID_PARAMS);
5764
5765         hci_dev_lock(hdev);
5766
5767         if (cp->val)
5768                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5769         else
5770                 changed = hci_dev_test_and_clear_flag(hdev,
5771                                                       HCI_KEEP_DEBUG_KEYS);
5772
5773         if (cp->val == 0x02)
5774                 use_changed = !hci_dev_test_and_set_flag(hdev,
5775                                                          HCI_USE_DEBUG_KEYS);
5776         else
5777                 use_changed = hci_dev_test_and_clear_flag(hdev,
5778                                                           HCI_USE_DEBUG_KEYS);
5779
5780         if (hdev_is_powered(hdev) && use_changed &&
5781             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5782                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5783                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5784                              sizeof(mode), &mode);
5785         }
5786
5787         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5788         if (err < 0)
5789                 goto unlock;
5790
5791         if (changed)
5792                 err = new_settings(hdev, sk);
5793
5794 unlock:
5795         hci_dev_unlock(hdev);
5796         return err;
5797 }
5798
5799 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5800                        u16 len)
5801 {
5802         struct mgmt_cp_set_privacy *cp = cp_data;
5803         bool changed;
5804         int err;
5805
5806         bt_dev_dbg(hdev, "sock %p", sk);
5807
5808         if (!lmp_le_capable(hdev))
5809                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5810                                        MGMT_STATUS_NOT_SUPPORTED);
5811
5812         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
5813                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5814                                        MGMT_STATUS_INVALID_PARAMS);
5815
5816         if (hdev_is_powered(hdev))
5817                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5818                                        MGMT_STATUS_REJECTED);
5819
5820         hci_dev_lock(hdev);
5821
5822         /* If user space supports this command it is also expected to
5823          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5824          */
5825         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5826
5827         if (cp->privacy) {
5828                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5829                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5830                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5831                 hci_adv_instances_set_rpa_expired(hdev, true);
5832                 if (cp->privacy == 0x02)
5833                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
5834                 else
5835                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
5836         } else {
5837                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5838                 memset(hdev->irk, 0, sizeof(hdev->irk));
5839                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5840                 hci_adv_instances_set_rpa_expired(hdev, false);
5841                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
5842         }
5843
5844         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5845         if (err < 0)
5846                 goto unlock;
5847
5848         if (changed)
5849                 err = new_settings(hdev, sk);
5850
5851 unlock:
5852         hci_dev_unlock(hdev);
5853         return err;
5854 }
5855
5856 static bool irk_is_valid(struct mgmt_irk_info *irk)
5857 {
5858         switch (irk->addr.type) {
5859         case BDADDR_LE_PUBLIC:
5860                 return true;
5861
5862         case BDADDR_LE_RANDOM:
5863                 /* Two most significant bits shall be set */
5864                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5865                         return false;
5866                 return true;
5867         }
5868
5869         return false;
5870 }
5871
5872 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5873                      u16 len)
5874 {
5875         struct mgmt_cp_load_irks *cp = cp_data;
5876         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5877                                    sizeof(struct mgmt_irk_info));
5878         u16 irk_count, expected_len;
5879         int i, err;
5880
5881         bt_dev_dbg(hdev, "sock %p", sk);
5882
5883         if (!lmp_le_capable(hdev))
5884                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5885                                        MGMT_STATUS_NOT_SUPPORTED);
5886
5887         irk_count = __le16_to_cpu(cp->irk_count);
5888         if (irk_count > max_irk_count) {
5889                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5890                            irk_count);
5891                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5892                                        MGMT_STATUS_INVALID_PARAMS);
5893         }
5894
5895         expected_len = struct_size(cp, irks, irk_count);
5896         if (expected_len != len) {
5897                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5898                            expected_len, len);
5899                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5900                                        MGMT_STATUS_INVALID_PARAMS);
5901         }
5902
5903         bt_dev_dbg(hdev, "irk_count %u", irk_count);
5904
5905         for (i = 0; i < irk_count; i++) {
5906                 struct mgmt_irk_info *key = &cp->irks[i];
5907
5908                 if (!irk_is_valid(key))
5909                         return mgmt_cmd_status(sk, hdev->id,
5910                                                MGMT_OP_LOAD_IRKS,
5911                                                MGMT_STATUS_INVALID_PARAMS);
5912         }
5913
5914         hci_dev_lock(hdev);
5915
5916         hci_smp_irks_clear(hdev);
5917
5918         for (i = 0; i < irk_count; i++) {
5919                 struct mgmt_irk_info *irk = &cp->irks[i];
5920
5921                 if (hci_is_blocked_key(hdev,
5922                                        HCI_BLOCKED_KEY_TYPE_IRK,
5923                                        irk->val)) {
5924                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
5925                                     &irk->addr.bdaddr);
5926                         continue;
5927                 }
5928
5929                 hci_add_irk(hdev, &irk->addr.bdaddr,
5930                             le_addr_type(irk->addr.type), irk->val,
5931                             BDADDR_ANY);
5932         }
5933
5934         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5935
5936         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5937
5938         hci_dev_unlock(hdev);
5939
5940         return err;
5941 }
5942
5943 #ifdef TIZEN_BT
5944 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
5945                         void *data, u16 len)
5946 {
5947         struct mgmt_cp_set_advertising_params *cp = data;
5948         __u16 min_interval;
5949         __u16 max_interval;
5950         int err;
5951
5952         BT_DBG("%s", hdev->name);
5953
5954         if (!lmp_le_capable(hdev))
5955                 return mgmt_cmd_status(sk, hdev->id,
5956                                 MGMT_OP_SET_ADVERTISING_PARAMS,
5957                                 MGMT_STATUS_NOT_SUPPORTED);
5958
5959         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
5960                 return mgmt_cmd_status(sk, hdev->id,
5961                                 MGMT_OP_SET_ADVERTISING_PARAMS,
5962                                 MGMT_STATUS_BUSY);
5963
5964         min_interval = __le16_to_cpu(cp->interval_min);
5965         max_interval = __le16_to_cpu(cp->interval_max);
5966
5967         if (min_interval > max_interval ||
5968             min_interval < 0x0020 || max_interval > 0x4000)
5969                 return mgmt_cmd_status(sk, hdev->id,
5970                                 MGMT_OP_SET_ADVERTISING_PARAMS,
5971                                 MGMT_STATUS_INVALID_PARAMS);
5972
5973         hci_dev_lock(hdev);
5974
5975         hdev->le_adv_min_interval = min_interval;
5976         hdev->le_adv_max_interval = max_interval;
5977         hdev->adv_filter_policy = cp->filter_policy;
5978         hdev->adv_type = cp->type;
5979
5980         err = mgmt_cmd_complete(sk, hdev->id,
5981                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
5982
5983         hci_dev_unlock(hdev);
5984
5985         return err;
5986 }
5987
5988 static void set_advertising_data_complete(struct hci_dev *hdev,
5989                         u8 status, u16 opcode)
5990 {
5991         struct mgmt_cp_set_advertising_data *cp;
5992         struct mgmt_pending_cmd *cmd;
5993
5994         BT_DBG("status 0x%02x", status);
5995
5996         hci_dev_lock(hdev);
5997
5998         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
5999         if (!cmd)
6000                 goto unlock;
6001
6002         cp = cmd->param;
6003
6004         if (status)
6005                 mgmt_cmd_status(cmd->sk, hdev->id,
6006                                 MGMT_OP_SET_ADVERTISING_DATA,
6007                                 mgmt_status(status));
6008         else
6009                 mgmt_cmd_complete(cmd->sk, hdev->id,
6010                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
6011                                 cp, sizeof(*cp));
6012
6013         mgmt_pending_remove(cmd);
6014
6015 unlock:
6016         hci_dev_unlock(hdev);
6017 }
6018
6019 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
6020                         void *data, u16 len)
6021 {
6022         struct mgmt_pending_cmd *cmd;
6023         struct hci_request req;
6024         struct mgmt_cp_set_advertising_data *cp = data;
6025         struct hci_cp_le_set_adv_data adv;
6026         int err;
6027
6028         BT_DBG("%s", hdev->name);
6029
6030         if (!lmp_le_capable(hdev)) {
6031                 return mgmt_cmd_status(sk, hdev->id,
6032                                 MGMT_OP_SET_ADVERTISING_DATA,
6033                                 MGMT_STATUS_NOT_SUPPORTED);
6034         }
6035
6036         hci_dev_lock(hdev);
6037
6038         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
6039                 err = mgmt_cmd_status(sk, hdev->id,
6040                                 MGMT_OP_SET_ADVERTISING_DATA,
6041                                 MGMT_STATUS_BUSY);
6042                 goto unlocked;
6043         }
6044
6045         if (len > HCI_MAX_AD_LENGTH) {
6046                 err = mgmt_cmd_status(sk, hdev->id,
6047                                 MGMT_OP_SET_ADVERTISING_DATA,
6048                                 MGMT_STATUS_INVALID_PARAMS);
6049                 goto unlocked;
6050         }
6051
6052         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
6053                                hdev, data, len);
6054         if (!cmd) {
6055                 err = -ENOMEM;
6056                 goto unlocked;
6057         }
6058
6059         hci_req_init(&req, hdev);
6060
6061         memset(&adv, 0, sizeof(adv));
6062         memcpy(adv.data, cp->data, len);
6063         adv.length = len;
6064
6065         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
6066
6067         err = hci_req_run(&req, set_advertising_data_complete);
6068         if (err < 0)
6069                 mgmt_pending_remove(cmd);
6070
6071 unlocked:
6072         hci_dev_unlock(hdev);
6073
6074         return err;
6075 }
6076
6077 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
6078                         u16 opcode)
6079 {
6080         struct mgmt_cp_set_scan_rsp_data *cp;
6081         struct mgmt_pending_cmd *cmd;
6082
6083         BT_DBG("status 0x%02x", status);
6084
6085         hci_dev_lock(hdev);
6086
6087         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
6088         if (!cmd)
6089                 goto unlock;
6090
6091         cp = cmd->param;
6092
6093         if (status)
6094                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6095                                 mgmt_status(status));
6096         else
6097                 mgmt_cmd_complete(cmd->sk, hdev->id,
6098                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
6099                                 cp, sizeof(*cp));
6100
6101         mgmt_pending_remove(cmd);
6102
6103 unlock:
6104         hci_dev_unlock(hdev);
6105 }
6106
6107 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
6108                         u16 len)
6109 {
6110         struct mgmt_pending_cmd *cmd;
6111         struct hci_request req;
6112         struct mgmt_cp_set_scan_rsp_data *cp = data;
6113         struct hci_cp_le_set_scan_rsp_data rsp;
6114         int err;
6115
6116         BT_DBG("%s", hdev->name);
6117
6118         if (!lmp_le_capable(hdev))
6119                 return mgmt_cmd_status(sk, hdev->id,
6120                                 MGMT_OP_SET_SCAN_RSP_DATA,
6121                                 MGMT_STATUS_NOT_SUPPORTED);
6122
6123         hci_dev_lock(hdev);
6124
6125         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
6126                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6127                                 MGMT_STATUS_BUSY);
6128                 goto unlocked;
6129         }
6130
6131         if (len > HCI_MAX_AD_LENGTH) {
6132                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6133                                 MGMT_STATUS_INVALID_PARAMS);
6134                 goto unlocked;
6135         }
6136
6137         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
6138         if (!cmd) {
6139                 err = -ENOMEM;
6140                 goto unlocked;
6141         }
6142
6143         hci_req_init(&req, hdev);
6144
6145         memset(&rsp, 0, sizeof(rsp));
6146         memcpy(rsp.data, cp->data, len);
6147         rsp.length = len;
6148
6149         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
6150
6151         err = hci_req_run(&req, set_scan_rsp_data_complete);
6152         if (err < 0)
6153                 mgmt_pending_remove(cmd);
6154
6155 unlocked:
6156         hci_dev_unlock(hdev);
6157
6158         return err;
6159 }
6160
6161 /* Adv White List feature */
6162 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6163 {
6164         struct mgmt_cp_add_dev_white_list *cp;
6165         struct mgmt_pending_cmd *cmd;
6166
6167         BT_DBG("status 0x%02x", status);
6168
6169         hci_dev_lock(hdev);
6170
6171         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
6172         if (!cmd)
6173                 goto unlock;
6174
6175         cp = cmd->param;
6176
6177         if (status)
6178                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6179                            mgmt_status(status));
6180         else
6181                 mgmt_cmd_complete(cmd->sk, hdev->id,
6182                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
6183
6184         mgmt_pending_remove(cmd);
6185
6186 unlock:
6187         hci_dev_unlock(hdev);
6188 }
6189
6190 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
6191                            void *data, u16 len)
6192 {
6193         struct mgmt_pending_cmd *cmd;
6194         struct mgmt_cp_add_dev_white_list *cp = data;
6195         struct hci_request req;
6196         int err;
6197
6198         BT_DBG("%s", hdev->name);
6199
6200         if (!lmp_le_capable(hdev))
6201                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6202                                   MGMT_STATUS_NOT_SUPPORTED);
6203
6204         if (!hdev_is_powered(hdev))
6205                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6206                                   MGMT_STATUS_REJECTED);
6207
6208         hci_dev_lock(hdev);
6209
6210         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
6211                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6212                                 MGMT_STATUS_BUSY);
6213                 goto unlocked;
6214         }
6215
6216         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
6217         if (!cmd) {
6218                 err = -ENOMEM;
6219                 goto unlocked;
6220         }
6221
6222         hci_req_init(&req, hdev);
6223
6224         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
6225
6226         err = hci_req_run(&req, add_white_list_complete);
6227         if (err < 0) {
6228                 mgmt_pending_remove(cmd);
6229                 goto unlocked;
6230         }
6231
6232 unlocked:
6233         hci_dev_unlock(hdev);
6234
6235         return err;
6236 }
6237
6238 static void remove_from_white_list_complete(struct hci_dev *hdev,
6239                         u8 status, u16 opcode)
6240 {
6241         struct mgmt_cp_remove_dev_from_white_list *cp;
6242         struct mgmt_pending_cmd *cmd;
6243
6244         BT_DBG("status 0x%02x", status);
6245
6246         hci_dev_lock(hdev);
6247
6248         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
6249         if (!cmd)
6250                 goto unlock;
6251
6252         cp = cmd->param;
6253
6254         if (status)
6255                 mgmt_cmd_status(cmd->sk, hdev->id,
6256                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6257                         mgmt_status(status));
6258         else
6259                 mgmt_cmd_complete(cmd->sk, hdev->id,
6260                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
6261                         cp, sizeof(*cp));
6262
6263         mgmt_pending_remove(cmd);
6264
6265 unlock:
6266         hci_dev_unlock(hdev);
6267 }
6268
6269 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
6270                            void *data, u16 len)
6271 {
6272         struct mgmt_pending_cmd *cmd;
6273         struct mgmt_cp_remove_dev_from_white_list *cp = data;
6274         struct hci_request req;
6275         int err;
6276
6277         BT_DBG("%s", hdev->name);
6278
6279         if (!lmp_le_capable(hdev))
6280                 return mgmt_cmd_status(sk, hdev->id,
6281                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6282                                 MGMT_STATUS_NOT_SUPPORTED);
6283
6284         if (!hdev_is_powered(hdev))
6285                 return mgmt_cmd_status(sk, hdev->id,
6286                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6287                                 MGMT_STATUS_REJECTED);
6288
6289         hci_dev_lock(hdev);
6290
6291         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
6292                 err = mgmt_cmd_status(sk, hdev->id,
6293                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6294                                 MGMT_STATUS_BUSY);
6295                 goto unlocked;
6296         }
6297
6298         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6299                                 hdev, data, len);
6300         if (!cmd) {
6301                 err = -ENOMEM;
6302                 goto unlocked;
6303         }
6304
6305         hci_req_init(&req, hdev);
6306
6307         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
6308
6309         err = hci_req_run(&req, remove_from_white_list_complete);
6310         if (err < 0) {
6311                 mgmt_pending_remove(cmd);
6312                 goto unlocked;
6313         }
6314
6315 unlocked:
6316         hci_dev_unlock(hdev);
6317
6318         return err;
6319 }
6320
6321 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
6322                         u16 opcode)
6323 {
6324         struct mgmt_pending_cmd *cmd;
6325
6326         BT_DBG("status 0x%02x", status);
6327
6328         hci_dev_lock(hdev);
6329
6330         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
6331         if (!cmd)
6332                 goto unlock;
6333
6334         if (status)
6335                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6336                            mgmt_status(status));
6337         else
6338                 mgmt_cmd_complete(cmd->sk, hdev->id,
6339                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6340                                 0, NULL, 0);
6341
6342         mgmt_pending_remove(cmd);
6343
6344 unlock:
6345         hci_dev_unlock(hdev);
6346 }
6347
6348 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
6349                            void *data, u16 len)
6350 {
6351         struct mgmt_pending_cmd *cmd;
6352         struct hci_request req;
6353         int err;
6354
6355         BT_DBG("%s", hdev->name);
6356
6357         if (!lmp_le_capable(hdev))
6358                 return mgmt_cmd_status(sk, hdev->id,
6359                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6360                                 MGMT_STATUS_NOT_SUPPORTED);
6361
6362         if (!hdev_is_powered(hdev))
6363                 return mgmt_cmd_status(sk, hdev->id,
6364                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6365                                 MGMT_STATUS_REJECTED);
6366
6367         hci_dev_lock(hdev);
6368
6369         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
6370                 err = mgmt_cmd_status(sk, hdev->id,
6371                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6372                                 MGMT_STATUS_BUSY);
6373                 goto unlocked;
6374         }
6375
6376         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6377                                 hdev, NULL, 0);
6378         if (!cmd) {
6379                 err = -ENOMEM;
6380                 goto unlocked;
6381         }
6382
6383         hci_req_init(&req, hdev);
6384
6385         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
6386
6387         err = hci_req_run(&req, clear_white_list_complete);
6388         if (err < 0) {
6389                 mgmt_pending_remove(cmd);
6390                 goto unlocked;
6391         }
6392
6393 unlocked:
6394         hci_dev_unlock(hdev);
6395
6396         return err;
6397 }
6398
6399 static void set_rssi_threshold_complete(struct hci_dev *hdev,
6400                         u8 status, u16 opcode)
6401 {
6402         struct mgmt_pending_cmd *cmd;
6403
6404         BT_DBG("status 0x%02x", status);
6405
6406         hci_dev_lock(hdev);
6407
6408         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6409         if (!cmd)
6410                 goto unlock;
6411
6412         if (status)
6413                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6414                                 mgmt_status(status));
6415         else
6416                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6417                                 NULL, 0);
6418
6419         mgmt_pending_remove(cmd);
6420
6421 unlock:
6422         hci_dev_unlock(hdev);
6423 }
6424
6425 static void set_rssi_disable_complete(struct hci_dev *hdev,
6426                         u8 status, u16 opcode)
6427 {
6428         struct mgmt_pending_cmd *cmd;
6429
6430         BT_DBG("status 0x%02x", status);
6431
6432         hci_dev_lock(hdev);
6433
6434         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6435         if (!cmd)
6436                 goto unlock;
6437
6438         if (status)
6439                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6440                                 mgmt_status(status));
6441         else
6442                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6443                                 0, NULL, 0);
6444
6445         mgmt_pending_remove(cmd);
6446
6447 unlock:
6448         hci_dev_unlock(hdev);
6449 }
6450
6451 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6452                 void *data, u16 len)
6453 {
6454         int err = 0;
6455         struct hci_cp_set_rssi_threshold th = { 0, };
6456         struct mgmt_cp_set_enable_rssi *cp = data;
6457         struct hci_conn *conn;
6458         struct mgmt_pending_cmd *cmd;
6459         struct hci_request req;
6460         __u8 dest_type;
6461
6462         hci_dev_lock(hdev);
6463
6464         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6465         if (!cmd) {
6466                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6467                                 MGMT_STATUS_FAILED);
6468                 goto unlocked;
6469         }
6470
6471         if (!lmp_le_capable(hdev)) {
6472                 mgmt_pending_remove(cmd);
6473                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6474                                 MGMT_STATUS_NOT_SUPPORTED);
6475                 goto unlocked;
6476         }
6477
6478         if (!hdev_is_powered(hdev)) {
6479                 BT_DBG("%s", hdev->name);
6480                 mgmt_pending_remove(cmd);
6481                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6482                                 MGMT_STATUS_NOT_POWERED);
6483                 goto unlocked;
6484         }
6485
6486         if (cp->link_type == 0x01)
6487                 dest_type = LE_LINK;
6488         else
6489                 dest_type = ACL_LINK;
6490
6491         /* Get LE/ACL link handle info */
6492         conn = hci_conn_hash_lookup_ba(hdev,
6493                         dest_type, &cp->bdaddr);
6494
6495         if (!conn) {
6496                 err = mgmt_cmd_complete(sk, hdev->id,
6497                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6498                 mgmt_pending_remove(cmd);
6499                 goto unlocked;
6500         }
6501
6502         hci_req_init(&req, hdev);
6503
6504         th.hci_le_ext_opcode = 0x0B;
6505         th.mode = 0x01;
6506         th.conn_handle = conn->handle;
6507         th.alert_mask = 0x07;
6508         th.low_th = cp->low_th;
6509         th.in_range_th = cp->in_range_th;
6510         th.high_th = cp->high_th;
6511
6512         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6513         err = hci_req_run(&req, set_rssi_threshold_complete);
6514
6515         if (err < 0) {
6516                 mgmt_pending_remove(cmd);
6517                 BT_ERR("Error in requesting hci_req_run");
6518                 goto unlocked;
6519         }
6520
6521 unlocked:
6522         hci_dev_unlock(hdev);
6523         return err;
6524 }
6525
6526 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6527                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6528 {
6529         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6530         struct mgmt_cp_set_enable_rssi *cp = data;
6531         struct mgmt_pending_cmd *cmd;
6532
6533         if (!cp || !rp)
6534                 goto remove_cmd;
6535
6536         mgmt_rp.status = rp->status;
6537         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6538         mgmt_rp.bt_address = cp->bdaddr;
6539         mgmt_rp.link_type = cp->link_type;
6540
6541         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6542                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6543                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6544
6545         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6546                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6547
6548         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6549         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6550                         &mgmt_rp.bt_address, true);
6551
6552 remove_cmd:
6553         hci_dev_lock(hdev);
6554         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6555         if (cmd)
6556                 mgmt_pending_remove(cmd);
6557
6558         hci_dev_unlock(hdev);
6559 }
6560
6561 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6562                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6563 {
6564         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6565         struct mgmt_cp_disable_rssi *cp = data;
6566         struct mgmt_pending_cmd *cmd;
6567
6568         if (!cp || !rp)
6569                 goto remove_cmd;
6570
6571         mgmt_rp.status = rp->status;
6572         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6573         mgmt_rp.bt_address = cp->bdaddr;
6574         mgmt_rp.link_type = cp->link_type;
6575
6576         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6577                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6578                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6579
6580         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6581                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6582
6583         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6584                         &mgmt_rp.bt_address, false);
6585
6586 remove_cmd:
6587         hci_dev_lock(hdev);
6588         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6589         if (cmd)
6590                 mgmt_pending_remove(cmd);
6591
6592         hci_dev_unlock(hdev);
6593 }
6594
6595 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6596                 void *data, u16 len)
6597 {
6598         struct mgmt_pending_cmd *cmd;
6599         struct hci_request req;
6600         struct hci_cp_set_enable_rssi cp_en = { 0, };
6601         int err;
6602
6603         BT_DBG("Set Disable RSSI.");
6604
6605         cp_en.hci_le_ext_opcode = 0x01;
6606         cp_en.le_enable_cs_Features = 0x00;
6607         cp_en.data[0] = 0x00;
6608         cp_en.data[1] = 0x00;
6609         cp_en.data[2] = 0x00;
6610
6611         hci_dev_lock(hdev);
6612
6613         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6614         if (!cmd) {
6615                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6616                                 MGMT_STATUS_FAILED);
6617                 goto unlocked;
6618         }
6619
6620         if (!lmp_le_capable(hdev)) {
6621                 mgmt_pending_remove(cmd);
6622                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6623                                 MGMT_STATUS_NOT_SUPPORTED);
6624                 goto unlocked;
6625         }
6626
6627         if (!hdev_is_powered(hdev)) {
6628                 BT_DBG("%s", hdev->name);
6629                 mgmt_pending_remove(cmd);
6630                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6631                                 MGMT_STATUS_NOT_POWERED);
6632                 goto unlocked;
6633         }
6634
6635         hci_req_init(&req, hdev);
6636
6637         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6638                         sizeof(struct hci_cp_set_enable_rssi),
6639                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6640                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6641
6642         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6643         err = hci_req_run(&req, set_rssi_disable_complete);
6644
6645         if (err < 0) {
6646                 mgmt_pending_remove(cmd);
6647                 BT_ERR("Error in requesting hci_req_run");
6648                 goto unlocked;
6649         }
6650
6651 unlocked:
6652         hci_dev_unlock(hdev);
6653         return err;
6654 }
6655
6656 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6657 {
6658         struct hci_cc_rsp_enable_rssi *rp = response;
6659         struct mgmt_pending_cmd *cmd_enable = NULL;
6660         struct mgmt_pending_cmd *cmd_disable = NULL;
6661         struct mgmt_cp_set_enable_rssi *cp_en;
6662         struct mgmt_cp_disable_rssi *cp_dis;
6663
6664         hci_dev_lock(hdev);
6665         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6666         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6667         hci_dev_unlock(hdev);
6668
6669         if (cmd_enable)
6670                 BT_DBG("Enable Request");
6671
6672         if (cmd_disable)
6673                 BT_DBG("Disable Request");
6674
6675         if (cmd_enable) {
6676                 cp_en = cmd_enable->param;
6677
6678                 if (status != 0x00)
6679                         return;
6680
6681                 switch (rp->le_ext_opcode) {
6682                 case 0x01:
6683                         BT_DBG("RSSI enabled.. Setting Threshold...");
6684                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6685                                         cp_en, sizeof(*cp_en));
6686                         break;
6687
6688                 case 0x0B:
6689                         BT_DBG("Sending RSSI enable success");
6690                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6691                                         cp_en, rp, rp->status);
6692                         break;
6693                 }
6694
6695         } else if (cmd_disable) {
6696                 cp_dis = cmd_disable->param;
6697
6698                 if (status != 0x00)
6699                         return;
6700
6701                 switch (rp->le_ext_opcode) {
6702                 case 0x01:
6703                         BT_DBG("Sending RSSI disable success");
6704                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6705                                         cp_dis, rp, rp->status);
6706                         break;
6707
6708                 case 0x0B:
6709                         /*
6710                          * Only unset RSSI Threshold values for the Link if
6711                          * RSSI is monitored for other BREDR or LE Links
6712                          */
6713                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6714                                 BT_DBG("Unset Threshold. Other links being monitored");
6715                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6716                                                 cp_dis, rp, rp->status);
6717                         } else {
6718                                 BT_DBG("Unset Threshold. Disabling...");
6719                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6720                                                 cp_dis, sizeof(*cp_dis));
6721                         }
6722                         break;
6723                 }
6724         }
6725 }
6726
6727 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
6728                 u16 opcode)
6729 {
6730         struct mgmt_pending_cmd *cmd;
6731
6732         BT_DBG("status 0x%02x", status);
6733
6734         hci_dev_lock(hdev);
6735
6736         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6737         if (!cmd)
6738                 goto unlock;
6739
6740         if (status)
6741                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6742                                 mgmt_status(status));
6743         else
6744                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6745                                 NULL, 0);
6746
6747         mgmt_pending_remove(cmd);
6748
6749 unlock:
6750         hci_dev_unlock(hdev);
6751 }
6752
6753 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
6754                 void *data, u16 len)
6755 {
6756         struct mgmt_pending_cmd *cmd;
6757         struct hci_request req;
6758         struct mgmt_cp_set_enable_rssi *cp = data;
6759         struct hci_cp_set_enable_rssi cp_en = { 0, };
6760         int err;
6761
6762         BT_DBG("Set Enable RSSI.");
6763
6764         cp_en.hci_le_ext_opcode = 0x01;
6765         cp_en.le_enable_cs_Features = 0x04;
6766         cp_en.data[0] = 0x00;
6767         cp_en.data[1] = 0x00;
6768         cp_en.data[2] = 0x00;
6769
6770         hci_dev_lock(hdev);
6771
6772         if (!lmp_le_capable(hdev)) {
6773                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6774                                 MGMT_STATUS_NOT_SUPPORTED);
6775                 goto unlocked;
6776         }
6777
6778         if (!hdev_is_powered(hdev)) {
6779                 BT_DBG("%s", hdev->name);
6780                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6781                                 MGMT_STATUS_NOT_POWERED);
6782                 goto unlocked;
6783         }
6784
6785         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
6786                 BT_DBG("%s", hdev->name);
6787                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6788                                 MGMT_STATUS_BUSY);
6789                 goto unlocked;
6790         }
6791
6792         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
6793                         sizeof(*cp));
6794         if (!cmd) {
6795                 BT_DBG("%s", hdev->name);
6796                 err = -ENOMEM;
6797                 goto unlocked;
6798         }
6799
6800         /* If RSSI is already enabled directly set Threshold values */
6801         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
6802                 hci_dev_unlock(hdev);
6803                 BT_DBG("RSSI Enabled. Directly set Threshold");
6804                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
6805                 return err;
6806         }
6807
6808         hci_req_init(&req, hdev);
6809
6810         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6811                         sizeof(struct hci_cp_set_enable_rssi),
6812                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6813                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6814
6815         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6816         err = hci_req_run(&req, set_rssi_enable_complete);
6817
6818         if (err < 0) {
6819                 mgmt_pending_remove(cmd);
6820                 BT_ERR("Error in requesting hci_req_run");
6821                 goto unlocked;
6822         }
6823
6824 unlocked:
6825         hci_dev_unlock(hdev);
6826
6827         return err;
6828 }
6829
6830 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6831 {
6832         struct mgmt_pending_cmd *cmd;
6833
6834         BT_DBG("status 0x%02x", status);
6835
6836         hci_dev_lock(hdev);
6837
6838         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
6839         if (!cmd)
6840                 goto unlock;
6841
6842         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6843                         MGMT_STATUS_SUCCESS, &status, 1);
6844
6845         mgmt_pending_remove(cmd);
6846
6847 unlock:
6848         hci_dev_unlock(hdev);
6849 }
6850
6851 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
6852                         u16 len)
6853 {
6854         struct mgmt_pending_cmd *cmd;
6855         struct hci_request req;
6856         struct mgmt_cp_get_raw_rssi *cp = data;
6857         struct hci_cp_get_raw_rssi hci_cp;
6858
6859         struct hci_conn *conn;
6860         int err;
6861         __u8 dest_type;
6862
6863         BT_DBG("Get Raw RSSI.");
6864
6865         hci_dev_lock(hdev);
6866
6867         if (!lmp_le_capable(hdev)) {
6868                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6869                                 MGMT_STATUS_NOT_SUPPORTED);
6870                 goto unlocked;
6871         }
6872
6873         if (cp->link_type == 0x01)
6874                 dest_type = LE_LINK;
6875         else
6876                 dest_type = ACL_LINK;
6877
6878         /* Get LE/BREDR link handle info */
6879         conn = hci_conn_hash_lookup_ba(hdev,
6880                         dest_type, &cp->bt_address);
6881         if (!conn) {
6882                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6883                                                    MGMT_STATUS_NOT_CONNECTED);
6884                 goto unlocked;
6885         }
6886         hci_cp.conn_handle = conn->handle;
6887
6888         if (!hdev_is_powered(hdev)) {
6889                 BT_DBG("%s", hdev->name);
6890                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6891                                 MGMT_STATUS_NOT_POWERED);
6892                 goto unlocked;
6893         }
6894
6895         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
6896                 BT_DBG("%s", hdev->name);
6897                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6898                                 MGMT_STATUS_BUSY);
6899                 goto unlocked;
6900         }
6901
6902         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
6903         if (!cmd) {
6904                 BT_DBG("%s", hdev->name);
6905                 err = -ENOMEM;
6906                 goto unlocked;
6907         }
6908
6909         hci_req_init(&req, hdev);
6910
6911         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
6912         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
6913         err = hci_req_run(&req, get_raw_rssi_complete);
6914
6915         if (err < 0) {
6916                 mgmt_pending_remove(cmd);
6917                 BT_ERR("Error in requesting hci_req_run");
6918         }
6919
6920 unlocked:
6921         hci_dev_unlock(hdev);
6922
6923         return err;
6924 }
6925
6926 void mgmt_raw_rssi_response(struct hci_dev *hdev,
6927                 struct hci_cc_rp_get_raw_rssi *rp, int success)
6928 {
6929         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
6930         struct hci_conn *conn;
6931
6932         mgmt_rp.status = rp->status;
6933         mgmt_rp.rssi_dbm = rp->rssi_dbm;
6934
6935         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
6936         if (!conn)
6937                 return;
6938
6939         bacpy(&mgmt_rp.bt_address, &conn->dst);
6940         if (conn->type == LE_LINK)
6941                 mgmt_rp.link_type = 0x01;
6942         else
6943                 mgmt_rp.link_type = 0x00;
6944
6945         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
6946                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
6947 }
6948
6949 static void set_disable_threshold_complete(struct hci_dev *hdev,
6950                         u8 status, u16 opcode)
6951 {
6952         struct mgmt_pending_cmd *cmd;
6953
6954         BT_DBG("status 0x%02x", status);
6955
6956         hci_dev_lock(hdev);
6957
6958         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6959         if (!cmd)
6960                 goto unlock;
6961
6962         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6963                         MGMT_STATUS_SUCCESS, &status, 1);
6964
6965         mgmt_pending_remove(cmd);
6966
6967 unlock:
6968         hci_dev_unlock(hdev);
6969 }
6970
6971 /** Removes monitoring for a link*/
6972 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
6973                 void *data, u16 len)
6974 {
6975         int err = 0;
6976         struct hci_cp_set_rssi_threshold th = { 0, };
6977         struct mgmt_cp_disable_rssi *cp = data;
6978         struct hci_conn *conn;
6979         struct mgmt_pending_cmd *cmd;
6980         struct hci_request req;
6981         __u8 dest_type;
6982
6983         BT_DBG("Set Disable RSSI.");
6984
6985         hci_dev_lock(hdev);
6986
6987         if (!lmp_le_capable(hdev)) {
6988                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6989                                 MGMT_STATUS_NOT_SUPPORTED);
6990                 goto unlocked;
6991         }
6992
6993         /* Get LE/ACL link handle info*/
6994         if (cp->link_type == 0x01)
6995                 dest_type = LE_LINK;
6996         else
6997                 dest_type = ACL_LINK;
6998
6999         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
7000         if (!conn) {
7001                 err = mgmt_cmd_complete(sk, hdev->id,
7002                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
7003                 goto unlocked;
7004         }
7005
7006         th.hci_le_ext_opcode = 0x0B;
7007         th.mode = 0x01;
7008         th.conn_handle = conn->handle;
7009         th.alert_mask = 0x00;
7010         th.low_th = 0x00;
7011         th.in_range_th = 0x00;
7012         th.high_th = 0x00;
7013
7014         if (!hdev_is_powered(hdev)) {
7015                 BT_DBG("%s", hdev->name);
7016                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7017                                 0, data, len);
7018                 goto unlocked;
7019         }
7020
7021         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
7022                 BT_DBG("%s", hdev->name);
7023                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7024                                 MGMT_STATUS_BUSY);
7025                 goto unlocked;
7026         }
7027
7028         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
7029                         sizeof(*cp));
7030         if (!cmd) {
7031                 BT_DBG("%s", hdev->name);
7032                 err = -ENOMEM;
7033                 goto unlocked;
7034         }
7035
7036         hci_req_init(&req, hdev);
7037
7038         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7039         err = hci_req_run(&req, set_disable_threshold_complete);
7040         if (err < 0) {
7041                 mgmt_pending_remove(cmd);
7042                 BT_ERR("Error in requesting hci_req_run");
7043                 goto unlocked;
7044         }
7045
7046 unlocked:
7047         hci_dev_unlock(hdev);
7048
7049         return err;
7050 }
7051
7052 void mgmt_rssi_alert_evt(struct hci_dev *hdev, struct sk_buff *skb)
7053 {
7054         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
7055         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
7056         struct hci_conn *conn;
7057
7058         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
7059                         ev->conn_handle, ev->alert_type, ev->rssi_dbm);
7060
7061         conn = hci_conn_hash_lookup_handle(hdev, ev->conn_handle);
7062
7063         if (!conn) {
7064                 BT_ERR("RSSI alert Error: Device not found for handle");
7065                 return;
7066         }
7067         bacpy(&mgmt_ev.bdaddr, &conn->dst);
7068
7069         if (conn->type == LE_LINK)
7070                 mgmt_ev.link_type = 0x01;
7071         else
7072                 mgmt_ev.link_type = 0x00;
7073
7074         mgmt_ev.alert_type = ev->alert_type;
7075         mgmt_ev.rssi_dbm = ev->rssi_dbm;
7076
7077         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
7078                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
7079                         NULL);
7080 }
7081
7082 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
7083 {
7084         struct mgmt_pending_cmd *cmd;
7085         u8 type;
7086         int err;
7087
7088         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7089
7090         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7091         if (!cmd)
7092                 return -ENOENT;
7093
7094         type = hdev->le_discovery.type;
7095
7096         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7097                                 mgmt_status(status), &type, sizeof(type));
7098         mgmt_pending_remove(cmd);
7099
7100         return err;
7101 }
7102
7103 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
7104                 u16 opcode)
7105 {
7106         unsigned long timeout = 0;
7107
7108         BT_DBG("status %d", status);
7109
7110         if (status) {
7111                 hci_dev_lock(hdev);
7112                 mgmt_start_le_discovery_failed(hdev, status);
7113                 hci_dev_unlock(hdev);
7114                 return;
7115         }
7116
7117         hci_dev_lock(hdev);
7118         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
7119         hci_dev_unlock(hdev);
7120
7121         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
7122                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
7123
7124         if (!timeout)
7125                 return;
7126
7127         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
7128 }
7129
7130 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
7131                 void *data, u16 len)
7132 {
7133         struct mgmt_cp_start_le_discovery *cp = data;
7134         struct mgmt_pending_cmd *cmd;
7135         struct hci_cp_le_set_scan_param param_cp;
7136         struct hci_cp_le_set_scan_enable enable_cp;
7137         struct hci_request req;
7138         u8 status, own_addr_type;
7139         int err;
7140
7141         BT_DBG("%s", hdev->name);
7142
7143         hci_dev_lock(hdev);
7144
7145         if (!hdev_is_powered(hdev)) {
7146                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7147                                 MGMT_STATUS_NOT_POWERED);
7148                 goto unlock;
7149         }
7150
7151         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
7152                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7153                                 MGMT_STATUS_BUSY);
7154                 goto unlock;
7155         }
7156
7157         if (cp->type != DISCOV_TYPE_LE) {
7158                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7159                                 MGMT_STATUS_INVALID_PARAMS);
7160                 goto unlock;
7161         }
7162
7163         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
7164         if (!cmd) {
7165                 err = -ENOMEM;
7166                 goto unlock;
7167         }
7168
7169         hdev->le_discovery.type = cp->type;
7170
7171         hci_req_init(&req, hdev);
7172
7173         status = mgmt_le_support(hdev);
7174         if (status) {
7175                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7176                                 status);
7177                 mgmt_pending_remove(cmd);
7178                 goto unlock;
7179         }
7180
7181         /* If controller is scanning, it means the background scanning
7182          * is running. Thus, we should temporarily stop it in order to
7183          * set the discovery scanning parameters.
7184          */
7185         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
7186                 hci_req_add_le_scan_disable(&req, false);
7187
7188         memset(&param_cp, 0, sizeof(param_cp));
7189
7190         /* All active scans will be done with either a resolvable
7191          * private address (when privacy feature has been enabled)
7192          * or unresolvable private address.
7193          */
7194         err = hci_update_random_address(&req, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
7195         if (err < 0) {
7196                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7197                                 MGMT_STATUS_FAILED);
7198                 mgmt_pending_remove(cmd);
7199                 goto unlock;
7200         }
7201
7202         param_cp.type = hdev->le_scan_type;
7203         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
7204         param_cp.window = cpu_to_le16(hdev->le_scan_window);
7205         param_cp.own_address_type = own_addr_type;
7206         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
7207                     &param_cp);
7208
7209         memset(&enable_cp, 0, sizeof(enable_cp));
7210         enable_cp.enable = LE_SCAN_ENABLE;
7211         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
7212
7213         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
7214                     &enable_cp);
7215
7216         err = hci_req_run(&req, start_le_discovery_complete);
7217         if (err < 0)
7218                 mgmt_pending_remove(cmd);
7219         else
7220                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
7221
7222 unlock:
7223         hci_dev_unlock(hdev);
7224         return err;
7225 }
7226
7227 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
7228 {
7229         struct mgmt_pending_cmd *cmd;
7230         int err;
7231
7232         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7233         if (!cmd)
7234                 return -ENOENT;
7235
7236         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7237                                 mgmt_status(status), &hdev->le_discovery.type,
7238                                 sizeof(hdev->le_discovery.type));
7239         mgmt_pending_remove(cmd);
7240
7241         return err;
7242 }
7243
7244 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
7245                 u16 opcode)
7246 {
7247         BT_DBG("status %d", status);
7248
7249         hci_dev_lock(hdev);
7250
7251         if (status) {
7252                 mgmt_stop_le_discovery_failed(hdev, status);
7253                 goto unlock;
7254         }
7255
7256         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7257
7258 unlock:
7259         hci_dev_unlock(hdev);
7260 }
7261
7262 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
7263                 void *data, u16 len)
7264 {
7265         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
7266         struct mgmt_pending_cmd *cmd;
7267         struct hci_request req;
7268         int err;
7269
7270         BT_DBG("%s", hdev->name);
7271
7272         hci_dev_lock(hdev);
7273
7274         if (!hci_le_discovery_active(hdev)) {
7275                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7276                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
7277                                         sizeof(mgmt_cp->type));
7278                 goto unlock;
7279         }
7280
7281         if (hdev->le_discovery.type != mgmt_cp->type) {
7282                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7283                                         MGMT_STATUS_INVALID_PARAMS,
7284                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
7285                 goto unlock;
7286         }
7287
7288         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
7289         if (!cmd) {
7290                 err = -ENOMEM;
7291                 goto unlock;
7292         }
7293
7294         hci_req_init(&req, hdev);
7295
7296         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
7297                 BT_DBG("unknown le discovery state %u",
7298                                         hdev->le_discovery.state);
7299
7300                 mgmt_pending_remove(cmd);
7301                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7302                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
7303                                         sizeof(mgmt_cp->type));
7304                 goto unlock;
7305         }
7306
7307         cancel_delayed_work(&hdev->le_scan_disable);
7308         hci_req_add_le_scan_disable(&req, false);
7309
7310         err = hci_req_run(&req, stop_le_discovery_complete);
7311         if (err < 0)
7312                 mgmt_pending_remove(cmd);
7313         else
7314                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
7315
7316 unlock:
7317         hci_dev_unlock(hdev);
7318         return err;
7319 }
7320
7321 /* Separate LE discovery */
7322 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
7323 {
7324         struct mgmt_ev_discovering ev;
7325         struct mgmt_pending_cmd *cmd;
7326
7327         BT_DBG("%s le discovering %u", hdev->name, discovering);
7328
7329         if (discovering)
7330                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7331         else
7332                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7333
7334         if (cmd) {
7335                 u8 type = hdev->le_discovery.type;
7336
7337                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
7338                                   sizeof(type));
7339                 mgmt_pending_remove(cmd);
7340         }
7341
7342         memset(&ev, 0, sizeof(ev));
7343         ev.type = hdev->le_discovery.type;
7344         ev.discovering = discovering;
7345
7346         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7347 }
7348
7349 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
7350                         void *data, u16 len)
7351 {
7352         int err;
7353
7354         BT_DBG("%s", hdev->name);
7355
7356         hci_dev_lock(hdev);
7357
7358         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
7359         if (err < 0)
7360                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
7361
7362         hci_dev_unlock(hdev);
7363
7364         return err;
7365 }
7366
7367 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
7368                 u16 to_multiplier)
7369 {
7370         u16 max_latency;
7371
7372         if (min > max || min < 6 || max > 3200)
7373                 return -EINVAL;
7374
7375         if (to_multiplier < 10 || to_multiplier > 3200)
7376                 return -EINVAL;
7377
7378         if (max >= to_multiplier * 8)
7379                 return -EINVAL;
7380
7381         max_latency = (to_multiplier * 8 / max) - 1;
7382
7383         if (latency > 499 || latency > max_latency)
7384                 return -EINVAL;
7385
7386         return 0;
7387 }
7388
7389 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
7390                 u16 len)
7391 {
7392         struct mgmt_cp_le_conn_update *cp = data;
7393
7394         struct hci_conn *conn;
7395         u16 min, max, latency, supervision_timeout;
7396         int err = -1;
7397
7398         if (!hdev_is_powered(hdev))
7399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7400                                 MGMT_STATUS_NOT_POWERED);
7401
7402         min = __le16_to_cpu(cp->conn_interval_min);
7403         max = __le16_to_cpu(cp->conn_interval_max);
7404         latency = __le16_to_cpu(cp->conn_latency);
7405         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
7406
7407         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
7408                         min, max, latency, supervision_timeout);
7409
7410         err = check_le_conn_update_param(min, max, latency,
7411                         supervision_timeout);
7412
7413         if (err < 0)
7414                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7415                                 MGMT_STATUS_INVALID_PARAMS);
7416
7417         hci_dev_lock(hdev);
7418
7419         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
7420         if (!conn) {
7421                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7422                                 MGMT_STATUS_NOT_CONNECTED);
7423                 hci_dev_unlock(hdev);
7424                 return err;
7425         }
7426
7427         hci_dev_unlock(hdev);
7428
7429         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
7430
7431         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
7432                                  NULL, 0);
7433 }
7434
7435 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
7436                 u16 opcode)
7437 {
7438         struct mgmt_cp_set_manufacturer_data *cp;
7439         struct mgmt_pending_cmd *cmd;
7440
7441         BT_DBG("status 0x%02x", status);
7442
7443         hci_dev_lock(hdev);
7444
7445         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
7446         if (!cmd)
7447                 goto unlock;
7448
7449         cp = cmd->param;
7450
7451         if (status)
7452                 mgmt_cmd_status(cmd->sk, hdev->id,
7453                                 MGMT_OP_SET_MANUFACTURER_DATA,
7454                                 mgmt_status(status));
7455         else
7456                 mgmt_cmd_complete(cmd->sk, hdev->id,
7457                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
7458                                   cp, sizeof(*cp));
7459
7460         mgmt_pending_remove(cmd);
7461
7462 unlock:
7463         hci_dev_unlock(hdev);
7464 }
7465
7466 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
7467                 void *data, u16 len)
7468 {
7469         struct mgmt_pending_cmd *cmd;
7470         struct hci_request req;
7471         struct mgmt_cp_set_manufacturer_data *cp = data;
7472         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
7473         u8 old_len;
7474         int err;
7475
7476         BT_DBG("%s", hdev->name);
7477
7478         if (!lmp_bredr_capable(hdev))
7479                 return mgmt_cmd_status(sk, hdev->id,
7480                                 MGMT_OP_SET_MANUFACTURER_DATA,
7481                                 MGMT_STATUS_NOT_SUPPORTED);
7482
7483         if (cp->data[0] == 0 ||
7484                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
7485                 return mgmt_cmd_status(sk, hdev->id,
7486                                 MGMT_OP_SET_MANUFACTURER_DATA,
7487                                 MGMT_STATUS_INVALID_PARAMS);
7488
7489         if (cp->data[1] != 0xFF)
7490                 return mgmt_cmd_status(sk, hdev->id,
7491                                 MGMT_OP_SET_MANUFACTURER_DATA,
7492                                 MGMT_STATUS_NOT_SUPPORTED);
7493
7494         hci_dev_lock(hdev);
7495
7496         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
7497                 err = mgmt_cmd_status(sk, hdev->id,
7498                                 MGMT_OP_SET_MANUFACTURER_DATA,
7499                                 MGMT_STATUS_BUSY);
7500                 goto unlocked;
7501         }
7502
7503         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
7504                         len);
7505         if (!cmd) {
7506                 err = -ENOMEM;
7507                 goto unlocked;
7508         }
7509
7510         hci_req_init(&req, hdev);
7511
7512         /* if new data is same as previous data then return command
7513          * complete event
7514          */
7515         if (hdev->manufacturer_len == cp->data[0] - 1 &&
7516             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
7517                 mgmt_pending_remove(cmd);
7518                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
7519                                   0, cp, sizeof(*cp));
7520                 err = 0;
7521                 goto unlocked;
7522         }
7523
7524         old_len = hdev->manufacturer_len;
7525         if (old_len > 0)
7526                 memcpy(old_data, hdev->manufacturer_data, old_len);
7527
7528         hdev->manufacturer_len = cp->data[0] - 1;
7529         if (hdev->manufacturer_len > 0)
7530                 memcpy(hdev->manufacturer_data, cp->data + 2,
7531                                 hdev->manufacturer_len);
7532
7533         __hci_req_update_eir(&req);
7534
7535         err = hci_req_run(&req, set_manufacturer_data_complete);
7536         if (err < 0) {
7537                 mgmt_pending_remove(cmd);
7538                 goto failed;
7539         }
7540
7541 unlocked:
7542         hci_dev_unlock(hdev);
7543
7544         return err;
7545
7546 failed:
7547         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
7548         hdev->manufacturer_len = old_len;
7549         if (hdev->manufacturer_len > 0)
7550                 memcpy(hdev->manufacturer_data, old_data,
7551                        hdev->manufacturer_len);
7552         hci_dev_unlock(hdev);
7553         return err;
7554 }
7555
7556 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
7557                 void *data, u16 len)
7558 {
7559         struct mgmt_cp_le_set_scan_params *cp = data;
7560         __u16 interval, window;
7561         int err;
7562
7563         BT_DBG("%s", hdev->name);
7564
7565         if (!lmp_le_capable(hdev))
7566                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7567                                 MGMT_STATUS_NOT_SUPPORTED);
7568
7569         interval = __le16_to_cpu(cp->interval);
7570
7571         if (interval < 0x0004 || interval > 0x4000)
7572                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7573                                 MGMT_STATUS_INVALID_PARAMS);
7574
7575         window = __le16_to_cpu(cp->window);
7576
7577         if (window < 0x0004 || window > 0x4000)
7578                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7579                                 MGMT_STATUS_INVALID_PARAMS);
7580
7581         if (window > interval)
7582                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7583                                 MGMT_STATUS_INVALID_PARAMS);
7584
7585         hci_dev_lock(hdev);
7586
7587         hdev->le_scan_type = cp->type;
7588         hdev->le_scan_interval = interval;
7589         hdev->le_scan_window = window;
7590
7591         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
7592                                 NULL, 0);
7593
7594         /* If background scan is running, restart it so new parameters are
7595          * loaded.
7596          */
7597         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
7598             hdev->discovery.state == DISCOVERY_STOPPED) {
7599                 struct hci_request req;
7600
7601                 hci_req_init(&req, hdev);
7602
7603                 hci_req_add_le_scan_disable(&req, false);
7604                 hci_req_add_le_passive_scan(&req);
7605
7606                 hci_req_run(&req, NULL);
7607         }
7608
7609         hci_dev_unlock(hdev);
7610
7611         return err;
7612 }
7613
7614 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
7615 {
7616         struct mgmt_ev_hardware_error ev;
7617
7618         ev.error_code = err_code;
7619         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
7620 }
7621 #endif /* TIZEN_BT */
7622
7623 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7624 {
7625         if (key->master != 0x00 && key->master != 0x01)
7626                 return false;
7627
7628         switch (key->addr.type) {
7629         case BDADDR_LE_PUBLIC:
7630                 return true;
7631
7632         case BDADDR_LE_RANDOM:
7633                 /* Two most significant bits shall be set */
7634                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7635                         return false;
7636                 return true;
7637         }
7638
7639         return false;
7640 }
7641
7642 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7643                                void *cp_data, u16 len)
7644 {
7645         struct mgmt_cp_load_long_term_keys *cp = cp_data;
7646         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7647                                    sizeof(struct mgmt_ltk_info));
7648         u16 key_count, expected_len;
7649         int i, err;
7650
7651         bt_dev_dbg(hdev, "sock %p", sk);
7652
7653         if (!lmp_le_capable(hdev))
7654                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7655                                        MGMT_STATUS_NOT_SUPPORTED);
7656
7657         key_count = __le16_to_cpu(cp->key_count);
7658         if (key_count > max_key_count) {
7659                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7660                            key_count);
7661                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7662                                        MGMT_STATUS_INVALID_PARAMS);
7663         }
7664
7665         expected_len = struct_size(cp, keys, key_count);
7666         if (expected_len != len) {
7667                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7668                            expected_len, len);
7669                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7670                                        MGMT_STATUS_INVALID_PARAMS);
7671         }
7672
7673         bt_dev_dbg(hdev, "key_count %u", key_count);
7674
7675         for (i = 0; i < key_count; i++) {
7676                 struct mgmt_ltk_info *key = &cp->keys[i];
7677
7678                 if (!ltk_is_valid(key))
7679                         return mgmt_cmd_status(sk, hdev->id,
7680                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
7681                                                MGMT_STATUS_INVALID_PARAMS);
7682         }
7683
7684         hci_dev_lock(hdev);
7685
7686         hci_smp_ltks_clear(hdev);
7687
7688         for (i = 0; i < key_count; i++) {
7689                 struct mgmt_ltk_info *key = &cp->keys[i];
7690                 u8 type, authenticated;
7691
7692                 if (hci_is_blocked_key(hdev,
7693                                        HCI_BLOCKED_KEY_TYPE_LTK,
7694                                        key->val)) {
7695                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7696                                     &key->addr.bdaddr);
7697                         continue;
7698                 }
7699
7700                 switch (key->type) {
7701                 case MGMT_LTK_UNAUTHENTICATED:
7702                         authenticated = 0x00;
7703                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
7704                         break;
7705                 case MGMT_LTK_AUTHENTICATED:
7706                         authenticated = 0x01;
7707                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
7708                         break;
7709                 case MGMT_LTK_P256_UNAUTH:
7710                         authenticated = 0x00;
7711                         type = SMP_LTK_P256;
7712                         break;
7713                 case MGMT_LTK_P256_AUTH:
7714                         authenticated = 0x01;
7715                         type = SMP_LTK_P256;
7716                         break;
7717                 case MGMT_LTK_P256_DEBUG:
7718                         authenticated = 0x00;
7719                         type = SMP_LTK_P256_DEBUG;
7720                         fallthrough;
7721                 default:
7722                         continue;
7723                 }
7724
7725                 hci_add_ltk(hdev, &key->addr.bdaddr,
7726                             le_addr_type(key->addr.type), type, authenticated,
7727                             key->val, key->enc_size, key->ediv, key->rand);
7728         }
7729
7730         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7731                            NULL, 0);
7732
7733         hci_dev_unlock(hdev);
7734
7735         return err;
7736 }
7737
7738 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7739 {
7740         struct hci_conn *conn = cmd->user_data;
7741         struct mgmt_rp_get_conn_info rp;
7742         int err;
7743
7744         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
7745
7746         if (status == MGMT_STATUS_SUCCESS) {
7747                 rp.rssi = conn->rssi;
7748                 rp.tx_power = conn->tx_power;
7749                 rp.max_tx_power = conn->max_tx_power;
7750         } else {
7751                 rp.rssi = HCI_RSSI_INVALID;
7752                 rp.tx_power = HCI_TX_POWER_INVALID;
7753                 rp.max_tx_power = HCI_TX_POWER_INVALID;
7754         }
7755
7756         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
7757                                 status, &rp, sizeof(rp));
7758
7759         hci_conn_drop(conn);
7760         hci_conn_put(conn);
7761
7762         return err;
7763 }
7764
7765 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
7766                                        u16 opcode)
7767 {
7768         struct hci_cp_read_rssi *cp;
7769         struct mgmt_pending_cmd *cmd;
7770         struct hci_conn *conn;
7771         u16 handle;
7772         u8 status;
7773
7774         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
7775
7776         hci_dev_lock(hdev);
7777
7778         /* Commands sent in request are either Read RSSI or Read Transmit Power
7779          * Level so we check which one was last sent to retrieve connection
7780          * handle.  Both commands have handle as first parameter so it's safe to
7781          * cast data on the same command struct.
7782          *
7783          * First command sent is always Read RSSI and we fail only if it fails.
7784          * In other case we simply override error to indicate success as we
7785          * already remembered if TX power value is actually valid.
7786          */
7787         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
7788         if (!cp) {
7789                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
7790                 status = MGMT_STATUS_SUCCESS;
7791         } else {
7792                 status = mgmt_status(hci_status);
7793         }
7794
7795         if (!cp) {
7796                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
7797                 goto unlock;
7798         }
7799
7800         handle = __le16_to_cpu(cp->handle);
7801         conn = hci_conn_hash_lookup_handle(hdev, handle);
7802         if (!conn) {
7803                 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
7804                            handle);
7805                 goto unlock;
7806         }
7807
7808         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
7809         if (!cmd)
7810                 goto unlock;
7811
7812         cmd->cmd_complete(cmd, status);
7813         mgmt_pending_remove(cmd);
7814
7815 unlock:
7816         hci_dev_unlock(hdev);
7817 }
7818
7819 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7820                          u16 len)
7821 {
7822         struct mgmt_cp_get_conn_info *cp = data;
7823         struct mgmt_rp_get_conn_info rp;
7824         struct hci_conn *conn;
7825         unsigned long conn_info_age;
7826         int err = 0;
7827
7828         bt_dev_dbg(hdev, "sock %p", sk);
7829
7830         memset(&rp, 0, sizeof(rp));
7831         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7832         rp.addr.type = cp->addr.type;
7833
7834         if (!bdaddr_type_is_valid(cp->addr.type))
7835                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7836                                          MGMT_STATUS_INVALID_PARAMS,
7837                                          &rp, sizeof(rp));
7838
7839         hci_dev_lock(hdev);
7840
7841         if (!hdev_is_powered(hdev)) {
7842                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7843                                         MGMT_STATUS_NOT_POWERED, &rp,
7844                                         sizeof(rp));
7845                 goto unlock;
7846         }
7847
7848         if (cp->addr.type == BDADDR_BREDR)
7849                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7850                                                &cp->addr.bdaddr);
7851         else
7852                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7853
7854         if (!conn || conn->state != BT_CONNECTED) {
7855                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7856                                         MGMT_STATUS_NOT_CONNECTED, &rp,
7857                                         sizeof(rp));
7858                 goto unlock;
7859         }
7860
7861         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
7862                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7863                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
7864                 goto unlock;
7865         }
7866
7867         /* To avoid client trying to guess when to poll again for information we
7868          * calculate conn info age as random value between min/max set in hdev.
7869          */
7870         conn_info_age = hdev->conn_info_min_age +
7871                         prandom_u32_max(hdev->conn_info_max_age -
7872                                         hdev->conn_info_min_age);
7873
7874         /* Query controller to refresh cached values if they are too old or were
7875          * never read.
7876          */
7877         if (time_after(jiffies, conn->conn_info_timestamp +
7878                        msecs_to_jiffies(conn_info_age)) ||
7879             !conn->conn_info_timestamp) {
7880                 struct hci_request req;
7881                 struct hci_cp_read_tx_power req_txp_cp;
7882                 struct hci_cp_read_rssi req_rssi_cp;
7883                 struct mgmt_pending_cmd *cmd;
7884
7885                 hci_req_init(&req, hdev);
7886                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
7887                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
7888                             &req_rssi_cp);
7889
7890                 /* For LE links TX power does not change thus we don't need to
7891                  * query for it once value is known.
7892                  */
7893                 if (!bdaddr_type_is_le(cp->addr.type) ||
7894                     conn->tx_power == HCI_TX_POWER_INVALID) {
7895                         req_txp_cp.handle = cpu_to_le16(conn->handle);
7896                         req_txp_cp.type = 0x00;
7897                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
7898                                     sizeof(req_txp_cp), &req_txp_cp);
7899                 }
7900
7901                 /* Max TX power needs to be read only once per connection */
7902                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
7903                         req_txp_cp.handle = cpu_to_le16(conn->handle);
7904                         req_txp_cp.type = 0x01;
7905                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
7906                                     sizeof(req_txp_cp), &req_txp_cp);
7907                 }
7908
7909                 err = hci_req_run(&req, conn_info_refresh_complete);
7910                 if (err < 0)
7911                         goto unlock;
7912
7913                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
7914                                        data, len);
7915                 if (!cmd) {
7916                         err = -ENOMEM;
7917                         goto unlock;
7918                 }
7919
7920                 hci_conn_hold(conn);
7921                 cmd->user_data = hci_conn_get(conn);
7922                 cmd->cmd_complete = conn_info_cmd_complete;
7923
7924                 conn->conn_info_timestamp = jiffies;
7925         } else {
7926                 /* Cache is valid, just reply with values cached in hci_conn */
7927                 rp.rssi = conn->rssi;
7928                 rp.tx_power = conn->tx_power;
7929                 rp.max_tx_power = conn->max_tx_power;
7930
7931                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7932                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7933         }
7934
7935 unlock:
7936         hci_dev_unlock(hdev);
7937         return err;
7938 }
7939
7940 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7941 {
7942         struct hci_conn *conn = cmd->user_data;
7943         struct mgmt_rp_get_clock_info rp;
7944         struct hci_dev *hdev;
7945         int err;
7946
7947         memset(&rp, 0, sizeof(rp));
7948         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
7949
7950         if (status)
7951                 goto complete;
7952
7953         hdev = hci_dev_get(cmd->index);
7954         if (hdev) {
7955                 rp.local_clock = cpu_to_le32(hdev->clock);
7956                 hci_dev_put(hdev);
7957         }
7958
7959         if (conn) {
7960                 rp.piconet_clock = cpu_to_le32(conn->clock);
7961                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7962         }
7963
7964 complete:
7965         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
7966                                 sizeof(rp));
7967
7968         if (conn) {
7969                 hci_conn_drop(conn);
7970                 hci_conn_put(conn);
7971         }
7972
7973         return err;
7974 }
7975
7976 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7977 {
7978         struct hci_cp_read_clock *hci_cp;
7979         struct mgmt_pending_cmd *cmd;
7980         struct hci_conn *conn;
7981
7982         bt_dev_dbg(hdev, "status %u", status);
7983
7984         hci_dev_lock(hdev);
7985
7986         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
7987         if (!hci_cp)
7988                 goto unlock;
7989
7990         if (hci_cp->which) {
7991                 u16 handle = __le16_to_cpu(hci_cp->handle);
7992                 conn = hci_conn_hash_lookup_handle(hdev, handle);
7993         } else {
7994                 conn = NULL;
7995         }
7996
7997         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
7998         if (!cmd)
7999                 goto unlock;
8000
8001         cmd->cmd_complete(cmd, mgmt_status(status));
8002         mgmt_pending_remove(cmd);
8003
8004 unlock:
8005         hci_dev_unlock(hdev);
8006 }
8007
8008 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8009                          u16 len)
8010 {
8011         struct mgmt_cp_get_clock_info *cp = data;
8012         struct mgmt_rp_get_clock_info rp;
8013         struct hci_cp_read_clock hci_cp;
8014         struct mgmt_pending_cmd *cmd;
8015         struct hci_request req;
8016         struct hci_conn *conn;
8017         int err;
8018
8019         bt_dev_dbg(hdev, "sock %p", sk);
8020
8021         memset(&rp, 0, sizeof(rp));
8022         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8023         rp.addr.type = cp->addr.type;
8024
8025         if (cp->addr.type != BDADDR_BREDR)
8026                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8027                                          MGMT_STATUS_INVALID_PARAMS,
8028                                          &rp, sizeof(rp));
8029
8030         hci_dev_lock(hdev);
8031
8032         if (!hdev_is_powered(hdev)) {
8033                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8034                                         MGMT_STATUS_NOT_POWERED, &rp,
8035                                         sizeof(rp));
8036                 goto unlock;
8037         }
8038
8039         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8040                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8041                                                &cp->addr.bdaddr);
8042                 if (!conn || conn->state != BT_CONNECTED) {
8043                         err = mgmt_cmd_complete(sk, hdev->id,
8044                                                 MGMT_OP_GET_CLOCK_INFO,
8045                                                 MGMT_STATUS_NOT_CONNECTED,
8046                                                 &rp, sizeof(rp));
8047                         goto unlock;
8048                 }
8049         } else {
8050                 conn = NULL;
8051         }
8052
8053         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8054         if (!cmd) {
8055                 err = -ENOMEM;
8056                 goto unlock;
8057         }
8058
8059         cmd->cmd_complete = clock_info_cmd_complete;
8060
8061         hci_req_init(&req, hdev);
8062
8063         memset(&hci_cp, 0, sizeof(hci_cp));
8064         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8065
8066         if (conn) {
8067                 hci_conn_hold(conn);
8068                 cmd->user_data = hci_conn_get(conn);
8069
8070                 hci_cp.handle = cpu_to_le16(conn->handle);
8071                 hci_cp.which = 0x01; /* Piconet clock */
8072                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8073         }
8074
8075         err = hci_req_run(&req, get_clock_info_complete);
8076         if (err < 0)
8077                 mgmt_pending_remove(cmd);
8078
8079 unlock:
8080         hci_dev_unlock(hdev);
8081         return err;
8082 }
8083
8084 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8085 {
8086         struct hci_conn *conn;
8087
8088         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8089         if (!conn)
8090                 return false;
8091
8092         if (conn->dst_type != type)
8093                 return false;
8094
8095         if (conn->state != BT_CONNECTED)
8096                 return false;
8097
8098         return true;
8099 }
8100
8101 /* This function requires the caller holds hdev->lock */
8102 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
8103                                u8 addr_type, u8 auto_connect)
8104 {
8105         struct hci_conn_params *params;
8106
8107         params = hci_conn_params_add(hdev, addr, addr_type);
8108         if (!params)
8109                 return -EIO;
8110
8111         if (params->auto_connect == auto_connect)
8112                 return 0;
8113
8114         list_del_init(&params->action);
8115
8116         switch (auto_connect) {
8117         case HCI_AUTO_CONN_DISABLED:
8118         case HCI_AUTO_CONN_LINK_LOSS:
8119                 /* If auto connect is being disabled when we're trying to
8120                  * connect to device, keep connecting.
8121                  */
8122                 if (params->explicit_connect)
8123                         list_add(&params->action, &hdev->pend_le_conns);
8124                 break;
8125         case HCI_AUTO_CONN_REPORT:
8126                 if (params->explicit_connect)
8127                         list_add(&params->action, &hdev->pend_le_conns);
8128                 else
8129                         list_add(&params->action, &hdev->pend_le_reports);
8130                 break;
8131         case HCI_AUTO_CONN_DIRECT:
8132         case HCI_AUTO_CONN_ALWAYS:
8133                 if (!is_connected(hdev, addr, addr_type))
8134                         list_add(&params->action, &hdev->pend_le_conns);
8135                 break;
8136         }
8137
8138         params->auto_connect = auto_connect;
8139
8140         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
8141                    addr, addr_type, auto_connect);
8142
8143         return 0;
8144 }
8145
8146 static void device_added(struct sock *sk, struct hci_dev *hdev,
8147                          bdaddr_t *bdaddr, u8 type, u8 action)
8148 {
8149         struct mgmt_ev_device_added ev;
8150
8151         bacpy(&ev.addr.bdaddr, bdaddr);
8152         ev.addr.type = type;
8153         ev.action = action;
8154
8155         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
8156 }
8157
8158 static int add_device(struct sock *sk, struct hci_dev *hdev,
8159                       void *data, u16 len)
8160 {
8161         struct mgmt_cp_add_device *cp = data;
8162         u8 auto_conn, addr_type;
8163         struct hci_conn_params *params;
8164         int err;
8165         u32 current_flags = 0;
8166
8167         bt_dev_dbg(hdev, "sock %p", sk);
8168
8169         if (!bdaddr_type_is_valid(cp->addr.type) ||
8170             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
8171                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8172                                          MGMT_STATUS_INVALID_PARAMS,
8173                                          &cp->addr, sizeof(cp->addr));
8174
8175         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
8176                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8177                                          MGMT_STATUS_INVALID_PARAMS,
8178                                          &cp->addr, sizeof(cp->addr));
8179
8180         hci_dev_lock(hdev);
8181
8182         if (cp->addr.type == BDADDR_BREDR) {
8183                 /* Only incoming connections action is supported for now */
8184                 if (cp->action != 0x01) {
8185                         err = mgmt_cmd_complete(sk, hdev->id,
8186                                                 MGMT_OP_ADD_DEVICE,
8187                                                 MGMT_STATUS_INVALID_PARAMS,
8188                                                 &cp->addr, sizeof(cp->addr));
8189                         goto unlock;
8190                 }
8191
8192                 err = hci_bdaddr_list_add_with_flags(&hdev->whitelist,
8193                                                      &cp->addr.bdaddr,
8194                                                      cp->addr.type, 0);
8195                 if (err)
8196                         goto unlock;
8197
8198                 hci_req_update_scan(hdev);
8199
8200                 goto added;
8201         }
8202
8203         addr_type = le_addr_type(cp->addr.type);
8204
8205         if (cp->action == 0x02)
8206                 auto_conn = HCI_AUTO_CONN_ALWAYS;
8207         else if (cp->action == 0x01)
8208                 auto_conn = HCI_AUTO_CONN_DIRECT;
8209         else
8210                 auto_conn = HCI_AUTO_CONN_REPORT;
8211
8212         /* Kernel internally uses conn_params with resolvable private
8213          * address, but Add Device allows only identity addresses.
8214          * Make sure it is enforced before calling
8215          * hci_conn_params_lookup.
8216          */
8217         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8218                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8219                                         MGMT_STATUS_INVALID_PARAMS,
8220                                         &cp->addr, sizeof(cp->addr));
8221                 goto unlock;
8222         }
8223
8224         /* If the connection parameters don't exist for this device,
8225          * they will be created and configured with defaults.
8226          */
8227         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
8228                                 auto_conn) < 0) {
8229                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8230                                         MGMT_STATUS_FAILED, &cp->addr,
8231                                         sizeof(cp->addr));
8232                 goto unlock;
8233         } else {
8234                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8235                                                 addr_type);
8236                 if (params)
8237                         current_flags = params->current_flags;
8238         }
8239
8240         hci_update_background_scan(hdev);
8241
8242 added:
8243         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
8244         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
8245                              SUPPORTED_DEVICE_FLAGS(), current_flags);
8246
8247         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8248                                 MGMT_STATUS_SUCCESS, &cp->addr,
8249                                 sizeof(cp->addr));
8250
8251 unlock:
8252         hci_dev_unlock(hdev);
8253         return err;
8254 }
8255
8256 static void device_removed(struct sock *sk, struct hci_dev *hdev,
8257                            bdaddr_t *bdaddr, u8 type)
8258 {
8259         struct mgmt_ev_device_removed ev;
8260
8261         bacpy(&ev.addr.bdaddr, bdaddr);
8262         ev.addr.type = type;
8263
8264         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
8265 }
8266
8267 static int remove_device(struct sock *sk, struct hci_dev *hdev,
8268                          void *data, u16 len)
8269 {
8270         struct mgmt_cp_remove_device *cp = data;
8271         int err;
8272
8273         bt_dev_dbg(hdev, "sock %p", sk);
8274
8275         hci_dev_lock(hdev);
8276
8277         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8278                 struct hci_conn_params *params;
8279                 u8 addr_type;
8280
8281                 if (!bdaddr_type_is_valid(cp->addr.type)) {
8282                         err = mgmt_cmd_complete(sk, hdev->id,
8283                                                 MGMT_OP_REMOVE_DEVICE,
8284                                                 MGMT_STATUS_INVALID_PARAMS,
8285                                                 &cp->addr, sizeof(cp->addr));
8286                         goto unlock;
8287                 }
8288
8289                 if (cp->addr.type == BDADDR_BREDR) {
8290                         err = hci_bdaddr_list_del(&hdev->whitelist,
8291                                                   &cp->addr.bdaddr,
8292                                                   cp->addr.type);
8293                         if (err) {
8294                                 err = mgmt_cmd_complete(sk, hdev->id,
8295                                                         MGMT_OP_REMOVE_DEVICE,
8296                                                         MGMT_STATUS_INVALID_PARAMS,
8297                                                         &cp->addr,
8298                                                         sizeof(cp->addr));
8299                                 goto unlock;
8300                         }
8301
8302                         hci_req_update_scan(hdev);
8303
8304                         device_removed(sk, hdev, &cp->addr.bdaddr,
8305                                        cp->addr.type);
8306                         goto complete;
8307                 }
8308
8309                 addr_type = le_addr_type(cp->addr.type);
8310
8311                 /* Kernel internally uses conn_params with resolvable private
8312                  * address, but Remove Device allows only identity addresses.
8313                  * Make sure it is enforced before calling
8314                  * hci_conn_params_lookup.
8315                  */
8316                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8317                         err = mgmt_cmd_complete(sk, hdev->id,
8318                                                 MGMT_OP_REMOVE_DEVICE,
8319                                                 MGMT_STATUS_INVALID_PARAMS,
8320                                                 &cp->addr, sizeof(cp->addr));
8321                         goto unlock;
8322                 }
8323
8324                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8325                                                 addr_type);
8326                 if (!params) {
8327                         err = mgmt_cmd_complete(sk, hdev->id,
8328                                                 MGMT_OP_REMOVE_DEVICE,
8329                                                 MGMT_STATUS_INVALID_PARAMS,
8330                                                 &cp->addr, sizeof(cp->addr));
8331                         goto unlock;
8332                 }
8333
8334                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
8335                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
8336                         err = mgmt_cmd_complete(sk, hdev->id,
8337                                                 MGMT_OP_REMOVE_DEVICE,
8338                                                 MGMT_STATUS_INVALID_PARAMS,
8339                                                 &cp->addr, sizeof(cp->addr));
8340                         goto unlock;
8341                 }
8342
8343                 list_del(&params->action);
8344                 list_del(&params->list);
8345                 kfree(params);
8346                 hci_update_background_scan(hdev);
8347
8348                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8349         } else {
8350                 struct hci_conn_params *p, *tmp;
8351                 struct bdaddr_list *b, *btmp;
8352
8353                 if (cp->addr.type) {
8354                         err = mgmt_cmd_complete(sk, hdev->id,
8355                                                 MGMT_OP_REMOVE_DEVICE,
8356                                                 MGMT_STATUS_INVALID_PARAMS,
8357                                                 &cp->addr, sizeof(cp->addr));
8358                         goto unlock;
8359                 }
8360
8361                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
8362                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8363                         list_del(&b->list);
8364                         kfree(b);
8365                 }
8366
8367                 hci_req_update_scan(hdev);
8368
8369                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8370                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8371                                 continue;
8372                         device_removed(sk, hdev, &p->addr, p->addr_type);
8373                         if (p->explicit_connect) {
8374                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8375                                 continue;
8376                         }
8377                         list_del(&p->action);
8378                         list_del(&p->list);
8379                         kfree(p);
8380                 }
8381
8382                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8383
8384                 hci_update_background_scan(hdev);
8385         }
8386
8387 complete:
8388         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
8389                                 MGMT_STATUS_SUCCESS, &cp->addr,
8390                                 sizeof(cp->addr));
8391 unlock:
8392         hci_dev_unlock(hdev);
8393         return err;
8394 }
8395
8396 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
8397                            u16 len)
8398 {
8399         struct mgmt_cp_load_conn_param *cp = data;
8400         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8401                                      sizeof(struct mgmt_conn_param));
8402         u16 param_count, expected_len;
8403         int i;
8404
8405         if (!lmp_le_capable(hdev))
8406                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8407                                        MGMT_STATUS_NOT_SUPPORTED);
8408
8409         param_count = __le16_to_cpu(cp->param_count);
8410         if (param_count > max_param_count) {
8411                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
8412                            param_count);
8413                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8414                                        MGMT_STATUS_INVALID_PARAMS);
8415         }
8416
8417         expected_len = struct_size(cp, params, param_count);
8418         if (expected_len != len) {
8419                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
8420                            expected_len, len);
8421                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8422                                        MGMT_STATUS_INVALID_PARAMS);
8423         }
8424
8425         bt_dev_dbg(hdev, "param_count %u", param_count);
8426
8427         hci_dev_lock(hdev);
8428
8429         hci_conn_params_clear_disabled(hdev);
8430
8431         for (i = 0; i < param_count; i++) {
8432                 struct mgmt_conn_param *param = &cp->params[i];
8433                 struct hci_conn_params *hci_param;
8434                 u16 min, max, latency, timeout;
8435                 u8 addr_type;
8436
8437                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
8438                            param->addr.type);
8439
8440                 if (param->addr.type == BDADDR_LE_PUBLIC) {
8441                         addr_type = ADDR_LE_DEV_PUBLIC;
8442                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8443                         addr_type = ADDR_LE_DEV_RANDOM;
8444                 } else {
8445                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8446                         continue;
8447                 }
8448
8449                 min = le16_to_cpu(param->min_interval);
8450                 max = le16_to_cpu(param->max_interval);
8451                 latency = le16_to_cpu(param->latency);
8452                 timeout = le16_to_cpu(param->timeout);
8453
8454                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
8455                            min, max, latency, timeout);
8456
8457                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
8458                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8459                         continue;
8460                 }
8461
8462                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
8463                                                 addr_type);
8464                 if (!hci_param) {
8465                         bt_dev_err(hdev, "failed to add connection parameters");
8466                         continue;
8467                 }
8468
8469                 hci_param->conn_min_interval = min;
8470                 hci_param->conn_max_interval = max;
8471                 hci_param->conn_latency = latency;
8472                 hci_param->supervision_timeout = timeout;
8473         }
8474
8475         hci_dev_unlock(hdev);
8476
8477         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
8478                                  NULL, 0);
8479 }
8480
8481 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
8482                                void *data, u16 len)
8483 {
8484         struct mgmt_cp_set_external_config *cp = data;
8485         bool changed;
8486         int err;
8487
8488         bt_dev_dbg(hdev, "sock %p", sk);
8489
8490         if (hdev_is_powered(hdev))
8491                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8492                                        MGMT_STATUS_REJECTED);
8493
8494         if (cp->config != 0x00 && cp->config != 0x01)
8495                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8496                                          MGMT_STATUS_INVALID_PARAMS);
8497
8498         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
8499                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8500                                        MGMT_STATUS_NOT_SUPPORTED);
8501
8502         hci_dev_lock(hdev);
8503
8504         if (cp->config)
8505                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
8506         else
8507                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
8508
8509         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
8510         if (err < 0)
8511                 goto unlock;
8512
8513         if (!changed)
8514                 goto unlock;
8515
8516         err = new_options(hdev, sk);
8517
8518         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
8519                 mgmt_index_removed(hdev);
8520
8521                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
8522                         hci_dev_set_flag(hdev, HCI_CONFIG);
8523                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8524
8525                         queue_work(hdev->req_workqueue, &hdev->power_on);
8526                 } else {
8527                         set_bit(HCI_RAW, &hdev->flags);
8528                         mgmt_index_added(hdev);
8529                 }
8530         }
8531
8532 unlock:
8533         hci_dev_unlock(hdev);
8534         return err;
8535 }
8536
8537 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8538                               void *data, u16 len)
8539 {
8540         struct mgmt_cp_set_public_address *cp = data;
8541         bool changed;
8542         int err;
8543
8544         bt_dev_dbg(hdev, "sock %p", sk);
8545
8546         if (hdev_is_powered(hdev))
8547                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8548                                        MGMT_STATUS_REJECTED);
8549
8550         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8551                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8552                                        MGMT_STATUS_INVALID_PARAMS);
8553
8554         if (!hdev->set_bdaddr)
8555                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8556                                        MGMT_STATUS_NOT_SUPPORTED);
8557
8558         hci_dev_lock(hdev);
8559
8560         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8561         bacpy(&hdev->public_addr, &cp->bdaddr);
8562
8563         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8564         if (err < 0)
8565                 goto unlock;
8566
8567         if (!changed)
8568                 goto unlock;
8569
8570         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8571                 err = new_options(hdev, sk);
8572
8573         if (is_configured(hdev)) {
8574                 mgmt_index_removed(hdev);
8575
8576                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8577
8578                 hci_dev_set_flag(hdev, HCI_CONFIG);
8579                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8580
8581                 queue_work(hdev->req_workqueue, &hdev->power_on);
8582         }
8583
8584 unlock:
8585         hci_dev_unlock(hdev);
8586         return err;
8587 }
8588
8589 #ifdef TIZEN_BT
8590 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
8591                             u8 name_len)
8592 {
8593         char buf[512];
8594         struct mgmt_ev_device_name_update *ev = (void *)buf;
8595         u16 eir_len = 0;
8596
8597         if (name_len <= 0)
8598                 return -EINVAL;
8599
8600         bacpy(&ev->addr.bdaddr, bdaddr);
8601         ev->addr.type = BDADDR_BREDR;
8602
8603         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8604                                   name_len);
8605
8606         ev->eir_len = cpu_to_le16(eir_len);
8607
8608         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
8609                           sizeof(*ev) + eir_len, NULL);
8610 }
8611
8612 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8613                                u8 link_type, u8 addr_type, u8 status)
8614 {
8615         struct mgmt_ev_conn_update_failed ev;
8616
8617         bacpy(&ev.addr.bdaddr, bdaddr);
8618         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8619         ev.status = status;
8620
8621         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
8622                                 &ev, sizeof(ev), NULL);
8623 }
8624
8625 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
8626                          u8 link_type, u8 addr_type, u16 conn_interval,
8627                          u16 conn_latency, u16 supervision_timeout)
8628 {
8629         struct mgmt_ev_conn_updated ev;
8630
8631         bacpy(&ev.addr.bdaddr, bdaddr);
8632         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8633         ev.conn_interval = cpu_to_le16(conn_interval);
8634         ev.conn_latency = cpu_to_le16(conn_latency);
8635         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
8636
8637         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
8638                                 &ev, sizeof(ev), NULL);
8639 }
8640 #endif
8641
8642 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
8643                                              u16 opcode, struct sk_buff *skb)
8644 {
8645         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8646         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8647         u8 *h192, *r192, *h256, *r256;
8648         struct mgmt_pending_cmd *cmd;
8649         u16 eir_len;
8650         int err;
8651
8652         bt_dev_dbg(hdev, "status %u", status);
8653
8654         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
8655         if (!cmd)
8656                 return;
8657
8658         mgmt_cp = cmd->param;
8659
8660         if (status) {
8661                 status = mgmt_status(status);
8662                 eir_len = 0;
8663
8664                 h192 = NULL;
8665                 r192 = NULL;
8666                 h256 = NULL;
8667                 r256 = NULL;
8668         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
8669                 struct hci_rp_read_local_oob_data *rp;
8670
8671                 if (skb->len != sizeof(*rp)) {
8672                         status = MGMT_STATUS_FAILED;
8673                         eir_len = 0;
8674                 } else {
8675                         status = MGMT_STATUS_SUCCESS;
8676                         rp = (void *)skb->data;
8677
8678                         eir_len = 5 + 18 + 18;
8679                         h192 = rp->hash;
8680                         r192 = rp->rand;
8681                         h256 = NULL;
8682                         r256 = NULL;
8683                 }
8684         } else {
8685                 struct hci_rp_read_local_oob_ext_data *rp;
8686
8687                 if (skb->len != sizeof(*rp)) {
8688                         status = MGMT_STATUS_FAILED;
8689                         eir_len = 0;
8690                 } else {
8691                         status = MGMT_STATUS_SUCCESS;
8692                         rp = (void *)skb->data;
8693
8694                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8695                                 eir_len = 5 + 18 + 18;
8696                                 h192 = NULL;
8697                                 r192 = NULL;
8698                         } else {
8699                                 eir_len = 5 + 18 + 18 + 18 + 18;
8700                                 h192 = rp->hash192;
8701                                 r192 = rp->rand192;
8702                         }
8703
8704                         h256 = rp->hash256;
8705                         r256 = rp->rand256;
8706                 }
8707         }
8708
8709         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8710         if (!mgmt_rp)
8711                 goto done;
8712
8713         if (status)
8714                 goto send_rsp;
8715
8716         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8717                                   hdev->dev_class, 3);
8718
8719         if (h192 && r192) {
8720                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8721                                           EIR_SSP_HASH_C192, h192, 16);
8722                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8723                                           EIR_SSP_RAND_R192, r192, 16);
8724         }
8725
8726         if (h256 && r256) {
8727                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8728                                           EIR_SSP_HASH_C256, h256, 16);
8729                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8730                                           EIR_SSP_RAND_R256, r256, 16);
8731         }
8732
8733 send_rsp:
8734         mgmt_rp->type = mgmt_cp->type;
8735         mgmt_rp->eir_len = cpu_to_le16(eir_len);
8736
8737         err = mgmt_cmd_complete(cmd->sk, hdev->id,
8738                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
8739                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
8740         if (err < 0 || status)
8741                 goto done;
8742
8743         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
8744
8745         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8746                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
8747                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
8748 done:
8749         kfree(mgmt_rp);
8750         mgmt_pending_remove(cmd);
8751 }
8752
8753 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
8754                                   struct mgmt_cp_read_local_oob_ext_data *cp)
8755 {
8756         struct mgmt_pending_cmd *cmd;
8757         struct hci_request req;
8758         int err;
8759
8760         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
8761                                cp, sizeof(*cp));
8762         if (!cmd)
8763                 return -ENOMEM;
8764
8765         hci_req_init(&req, hdev);
8766
8767         if (bredr_sc_enabled(hdev))
8768                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
8769         else
8770                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
8771
8772         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
8773         if (err < 0) {
8774                 mgmt_pending_remove(cmd);
8775                 return err;
8776         }
8777
8778         return 0;
8779 }
8780
8781 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
8782                                    void *data, u16 data_len)
8783 {
8784         struct mgmt_cp_read_local_oob_ext_data *cp = data;
8785         struct mgmt_rp_read_local_oob_ext_data *rp;
8786         size_t rp_len;
8787         u16 eir_len;
8788         u8 status, flags, role, addr[7], hash[16], rand[16];
8789         int err;
8790
8791         bt_dev_dbg(hdev, "sock %p", sk);
8792
8793         if (hdev_is_powered(hdev)) {
8794                 switch (cp->type) {
8795                 case BIT(BDADDR_BREDR):
8796                         status = mgmt_bredr_support(hdev);
8797                         if (status)
8798                                 eir_len = 0;
8799                         else
8800                                 eir_len = 5;
8801                         break;
8802                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8803                         status = mgmt_le_support(hdev);
8804                         if (status)
8805                                 eir_len = 0;
8806                         else
8807                                 eir_len = 9 + 3 + 18 + 18 + 3;
8808                         break;
8809                 default:
8810                         status = MGMT_STATUS_INVALID_PARAMS;
8811                         eir_len = 0;
8812                         break;
8813                 }
8814         } else {
8815                 status = MGMT_STATUS_NOT_POWERED;
8816                 eir_len = 0;
8817         }
8818
8819         rp_len = sizeof(*rp) + eir_len;
8820         rp = kmalloc(rp_len, GFP_ATOMIC);
8821         if (!rp)
8822                 return -ENOMEM;
8823
8824         if (status)
8825                 goto complete;
8826
8827         hci_dev_lock(hdev);
8828
8829         eir_len = 0;
8830         switch (cp->type) {
8831         case BIT(BDADDR_BREDR):
8832                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8833                         err = read_local_ssp_oob_req(hdev, sk, cp);
8834                         hci_dev_unlock(hdev);
8835                         if (!err)
8836                                 goto done;
8837
8838                         status = MGMT_STATUS_FAILED;
8839                         goto complete;
8840                 } else {
8841                         eir_len = eir_append_data(rp->eir, eir_len,
8842                                                   EIR_CLASS_OF_DEV,
8843                                                   hdev->dev_class, 3);
8844                 }
8845                 break;
8846         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8847                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
8848                     smp_generate_oob(hdev, hash, rand) < 0) {
8849                         hci_dev_unlock(hdev);
8850                         status = MGMT_STATUS_FAILED;
8851                         goto complete;
8852                 }
8853
8854                 /* This should return the active RPA, but since the RPA
8855                  * is only programmed on demand, it is really hard to fill
8856                  * this in at the moment. For now disallow retrieving
8857                  * local out-of-band data when privacy is in use.
8858                  *
8859                  * Returning the identity address will not help here since
8860                  * pairing happens before the identity resolving key is
8861                  * known and thus the connection establishment happens
8862                  * based on the RPA and not the identity address.
8863                  */
8864                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
8865                         hci_dev_unlock(hdev);
8866                         status = MGMT_STATUS_REJECTED;
8867                         goto complete;
8868                 }
8869
8870                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
8871                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
8872                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
8873                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
8874                         memcpy(addr, &hdev->static_addr, 6);
8875                         addr[6] = 0x01;
8876                 } else {
8877                         memcpy(addr, &hdev->bdaddr, 6);
8878                         addr[6] = 0x00;
8879                 }
8880
8881                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
8882                                           addr, sizeof(addr));
8883
8884                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
8885                         role = 0x02;
8886                 else
8887                         role = 0x01;
8888
8889                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
8890                                           &role, sizeof(role));
8891
8892                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
8893                         eir_len = eir_append_data(rp->eir, eir_len,
8894                                                   EIR_LE_SC_CONFIRM,
8895                                                   hash, sizeof(hash));
8896
8897                         eir_len = eir_append_data(rp->eir, eir_len,
8898                                                   EIR_LE_SC_RANDOM,
8899                                                   rand, sizeof(rand));
8900                 }
8901
8902                 flags = mgmt_get_adv_discov_flags(hdev);
8903
8904                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
8905                         flags |= LE_AD_NO_BREDR;
8906
8907                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
8908                                           &flags, sizeof(flags));
8909                 break;
8910         }
8911
8912         hci_dev_unlock(hdev);
8913
8914         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
8915
8916         status = MGMT_STATUS_SUCCESS;
8917
8918 complete:
8919         rp->type = cp->type;
8920         rp->eir_len = cpu_to_le16(eir_len);
8921
8922         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
8923                                 status, rp, sizeof(*rp) + eir_len);
8924         if (err < 0 || status)
8925                 goto done;
8926
8927         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8928                                  rp, sizeof(*rp) + eir_len,
8929                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
8930
8931 done:
8932         kfree(rp);
8933
8934         return err;
8935 }
8936
8937 static u32 get_supported_adv_flags(struct hci_dev *hdev)
8938 {
8939         u32 flags = 0;
8940
8941         flags |= MGMT_ADV_FLAG_CONNECTABLE;
8942         flags |= MGMT_ADV_FLAG_DISCOV;
8943         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
8944         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
8945         flags |= MGMT_ADV_FLAG_APPEARANCE;
8946         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
8947
8948         /* In extended adv TX_POWER returned from Set Adv Param
8949          * will be always valid.
8950          */
8951         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
8952             ext_adv_capable(hdev))
8953                 flags |= MGMT_ADV_FLAG_TX_POWER;
8954
8955         if (ext_adv_capable(hdev)) {
8956                 flags |= MGMT_ADV_FLAG_SEC_1M;
8957                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
8958                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
8959
8960                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
8961                         flags |= MGMT_ADV_FLAG_SEC_2M;
8962
8963                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
8964                         flags |= MGMT_ADV_FLAG_SEC_CODED;
8965         }
8966
8967         return flags;
8968 }
8969
8970 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
8971                              void *data, u16 data_len)
8972 {
8973         struct mgmt_rp_read_adv_features *rp;
8974         size_t rp_len;
8975         int err;
8976         struct adv_info *adv_instance;
8977         u32 supported_flags;
8978         u8 *instance;
8979
8980         bt_dev_dbg(hdev, "sock %p", sk);
8981
8982         if (!lmp_le_capable(hdev))
8983                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8984                                        MGMT_STATUS_REJECTED);
8985
8986         /* Enabling the experimental LL Privay support disables support for
8987          * advertising.
8988          */
8989         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
8990                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
8991                                        MGMT_STATUS_NOT_SUPPORTED);
8992
8993         hci_dev_lock(hdev);
8994
8995         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
8996         rp = kmalloc(rp_len, GFP_ATOMIC);
8997         if (!rp) {
8998                 hci_dev_unlock(hdev);
8999                 return -ENOMEM;
9000         }
9001
9002         supported_flags = get_supported_adv_flags(hdev);
9003
9004         rp->supported_flags = cpu_to_le32(supported_flags);
9005         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
9006         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
9007         rp->max_instances = hdev->le_num_of_adv_sets;
9008         rp->num_instances = hdev->adv_instance_cnt;
9009
9010         instance = rp->instance;
9011         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9012                 *instance = adv_instance->instance;
9013                 instance++;
9014         }
9015
9016         hci_dev_unlock(hdev);
9017
9018         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9019                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9020
9021         kfree(rp);
9022
9023         return err;
9024 }
9025
9026 static u8 calculate_name_len(struct hci_dev *hdev)
9027 {
9028         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9029
9030         return append_local_name(hdev, buf, 0);
9031 }
9032
9033 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9034                            bool is_adv_data)
9035 {
9036         u8 max_len = HCI_MAX_AD_LENGTH;
9037
9038         if (is_adv_data) {
9039                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9040                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9041                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9042                         max_len -= 3;
9043
9044                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9045                         max_len -= 3;
9046         } else {
9047                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9048                         max_len -= calculate_name_len(hdev);
9049
9050                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9051                         max_len -= 4;
9052         }
9053
9054         return max_len;
9055 }
9056
9057 static bool flags_managed(u32 adv_flags)
9058 {
9059         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
9060                             MGMT_ADV_FLAG_LIMITED_DISCOV |
9061                             MGMT_ADV_FLAG_MANAGED_FLAGS);
9062 }
9063
9064 static bool tx_power_managed(u32 adv_flags)
9065 {
9066         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
9067 }
9068
9069 static bool name_managed(u32 adv_flags)
9070 {
9071         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
9072 }
9073
9074 static bool appearance_managed(u32 adv_flags)
9075 {
9076         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
9077 }
9078
9079 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
9080                               u8 len, bool is_adv_data)
9081 {
9082         int i, cur_len;
9083         u8 max_len;
9084
9085         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
9086
9087         if (len > max_len)
9088                 return false;
9089
9090         /* Make sure that the data is correctly formatted. */
9091         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
9092                 cur_len = data[i];
9093
9094                 if (!cur_len)
9095                         continue;
9096
9097                 if (data[i + 1] == EIR_FLAGS &&
9098                     (!is_adv_data || flags_managed(adv_flags)))
9099                         return false;
9100
9101                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
9102                         return false;
9103
9104                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
9105                         return false;
9106
9107                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
9108                         return false;
9109
9110                 if (data[i + 1] == EIR_APPEARANCE &&
9111                     appearance_managed(adv_flags))
9112                         return false;
9113
9114                 /* If the current field length would exceed the total data
9115                  * length, then it's invalid.
9116                  */
9117                 if (i + cur_len >= len)
9118                         return false;
9119         }
9120
9121         return true;
9122 }
9123
9124 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
9125                                      u16 opcode)
9126 {
9127         struct mgmt_pending_cmd *cmd;
9128         struct mgmt_cp_add_advertising *cp;
9129         struct mgmt_rp_add_advertising rp;
9130         struct adv_info *adv_instance, *n;
9131         u8 instance;
9132
9133         bt_dev_dbg(hdev, "status %d", status);
9134
9135         hci_dev_lock(hdev);
9136
9137         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
9138
9139         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
9140                 if (!adv_instance->pending)
9141                         continue;
9142
9143                 if (!status) {
9144                         adv_instance->pending = false;
9145                         continue;
9146                 }
9147
9148                 instance = adv_instance->instance;
9149
9150                 if (hdev->cur_adv_instance == instance)
9151                         cancel_adv_timeout(hdev);
9152
9153                 hci_remove_adv_instance(hdev, instance);
9154                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
9155         }
9156
9157         if (!cmd)
9158                 goto unlock;
9159
9160         cp = cmd->param;
9161         rp.instance = cp->instance;
9162
9163         if (status)
9164                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9165                                 mgmt_status(status));
9166         else
9167                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9168                                   mgmt_status(status), &rp, sizeof(rp));
9169
9170         mgmt_pending_remove(cmd);
9171
9172 unlock:
9173         hci_dev_unlock(hdev);
9174 }
9175
9176 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
9177                            void *data, u16 data_len)
9178 {
9179         struct mgmt_cp_add_advertising *cp = data;
9180         struct mgmt_rp_add_advertising rp;
9181         u32 flags;
9182         u32 supported_flags, phy_flags;
9183         u8 status;
9184         u16 timeout, duration;
9185         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
9186         u8 schedule_instance = 0;
9187         struct adv_info *next_instance;
9188         int err;
9189         struct mgmt_pending_cmd *cmd;
9190         struct hci_request req;
9191
9192         bt_dev_dbg(hdev, "sock %p", sk);
9193
9194         status = mgmt_le_support(hdev);
9195         if (status)
9196                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9197                                        status);
9198
9199         /* Enabling the experimental LL Privay support disables support for
9200          * advertising.
9201          */
9202         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9203                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9204                                        MGMT_STATUS_NOT_SUPPORTED);
9205
9206         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9207                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9208                                        MGMT_STATUS_INVALID_PARAMS);
9209
9210         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9211                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9212                                        MGMT_STATUS_INVALID_PARAMS);
9213
9214         flags = __le32_to_cpu(cp->flags);
9215         timeout = __le16_to_cpu(cp->timeout);
9216         duration = __le16_to_cpu(cp->duration);
9217
9218         /* The current implementation only supports a subset of the specified
9219          * flags. Also need to check mutual exclusiveness of sec flags.
9220          */
9221         supported_flags = get_supported_adv_flags(hdev);
9222         phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
9223         if (flags & ~supported_flags ||
9224             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
9225                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9226                                        MGMT_STATUS_INVALID_PARAMS);
9227
9228         hci_dev_lock(hdev);
9229
9230         if (timeout && !hdev_is_powered(hdev)) {
9231                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9232                                       MGMT_STATUS_REJECTED);
9233                 goto unlock;
9234         }
9235
9236         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
9237             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
9238             pending_find(MGMT_OP_SET_LE, hdev)) {
9239                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9240                                       MGMT_STATUS_BUSY);
9241                 goto unlock;
9242         }
9243
9244         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9245             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9246                                cp->scan_rsp_len, false)) {
9247                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9248                                       MGMT_STATUS_INVALID_PARAMS);
9249                 goto unlock;
9250         }
9251
9252         err = hci_add_adv_instance(hdev, cp->instance, flags,
9253                                    cp->adv_data_len, cp->data,
9254                                    cp->scan_rsp_len,
9255                                    cp->data + cp->adv_data_len,
9256                                    timeout, duration);
9257         if (err < 0) {
9258                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9259                                       MGMT_STATUS_FAILED);
9260                 goto unlock;
9261         }
9262
9263         /* Only trigger an advertising added event if a new instance was
9264          * actually added.
9265          */
9266         if (hdev->adv_instance_cnt > prev_instance_cnt)
9267                 mgmt_advertising_added(sk, hdev, cp->instance);
9268
9269         if (hdev->cur_adv_instance == cp->instance) {
9270                 /* If the currently advertised instance is being changed then
9271                  * cancel the current advertising and schedule the next
9272                  * instance. If there is only one instance then the overridden
9273                  * advertising data will be visible right away.
9274                  */
9275                 cancel_adv_timeout(hdev);
9276
9277                 next_instance = hci_get_next_instance(hdev, cp->instance);
9278                 if (next_instance)
9279                         schedule_instance = next_instance->instance;
9280         } else if (!hdev->adv_instance_timeout) {
9281                 /* Immediately advertise the new instance if no other
9282                  * instance is currently being advertised.
9283                  */
9284                 schedule_instance = cp->instance;
9285         }
9286
9287         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9288          * there is no instance to be advertised then we have no HCI
9289          * communication to make. Simply return.
9290          */
9291         if (!hdev_is_powered(hdev) ||
9292             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9293             !schedule_instance) {
9294                 rp.instance = cp->instance;
9295                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9296                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9297                 goto unlock;
9298         }
9299
9300         /* We're good to go, update advertising data, parameters, and start
9301          * advertising.
9302          */
9303         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9304                                data_len);
9305         if (!cmd) {
9306                 err = -ENOMEM;
9307                 goto unlock;
9308         }
9309
9310         hci_req_init(&req, hdev);
9311
9312         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
9313
9314         if (!err)
9315                 err = hci_req_run(&req, add_advertising_complete);
9316
9317         if (err < 0) {
9318                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9319                                       MGMT_STATUS_FAILED);
9320                 mgmt_pending_remove(cmd);
9321         }
9322
9323 unlock:
9324         hci_dev_unlock(hdev);
9325
9326         return err;
9327 }
9328
9329 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
9330                                         u16 opcode)
9331 {
9332         struct mgmt_pending_cmd *cmd;
9333         struct mgmt_cp_remove_advertising *cp;
9334         struct mgmt_rp_remove_advertising rp;
9335
9336         bt_dev_dbg(hdev, "status %d", status);
9337
9338         hci_dev_lock(hdev);
9339
9340         /* A failure status here only means that we failed to disable
9341          * advertising. Otherwise, the advertising instance has been removed,
9342          * so report success.
9343          */
9344         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
9345         if (!cmd)
9346                 goto unlock;
9347
9348         cp = cmd->param;
9349         rp.instance = cp->instance;
9350
9351         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
9352                           &rp, sizeof(rp));
9353         mgmt_pending_remove(cmd);
9354
9355 unlock:
9356         hci_dev_unlock(hdev);
9357 }
9358
9359 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9360                               void *data, u16 data_len)
9361 {
9362         struct mgmt_cp_remove_advertising *cp = data;
9363         struct mgmt_rp_remove_advertising rp;
9364         struct mgmt_pending_cmd *cmd;
9365         struct hci_request req;
9366         int err;
9367
9368         bt_dev_dbg(hdev, "sock %p", sk);
9369
9370         /* Enabling the experimental LL Privay support disables support for
9371          * advertising.
9372          */
9373         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9374                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
9375                                        MGMT_STATUS_NOT_SUPPORTED);
9376
9377         hci_dev_lock(hdev);
9378
9379         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
9380                 err = mgmt_cmd_status(sk, hdev->id,
9381                                       MGMT_OP_REMOVE_ADVERTISING,
9382                                       MGMT_STATUS_INVALID_PARAMS);
9383                 goto unlock;
9384         }
9385
9386         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
9387             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
9388             pending_find(MGMT_OP_SET_LE, hdev)) {
9389                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9390                                       MGMT_STATUS_BUSY);
9391                 goto unlock;
9392         }
9393
9394         if (list_empty(&hdev->adv_instances)) {
9395                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9396                                       MGMT_STATUS_INVALID_PARAMS);
9397                 goto unlock;
9398         }
9399
9400         hci_req_init(&req, hdev);
9401
9402         /* If we use extended advertising, instance is disabled and removed */
9403         if (ext_adv_capable(hdev)) {
9404                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
9405                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
9406         }
9407
9408         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
9409
9410         if (list_empty(&hdev->adv_instances))
9411                 __hci_req_disable_advertising(&req);
9412
9413         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
9414          * flag is set or the device isn't powered then we have no HCI
9415          * communication to make. Simply return.
9416          */
9417         if (skb_queue_empty(&req.cmd_q) ||
9418             !hdev_is_powered(hdev) ||
9419             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
9420                 hci_req_purge(&req);
9421                 rp.instance = cp->instance;
9422                 err = mgmt_cmd_complete(sk, hdev->id,
9423                                         MGMT_OP_REMOVE_ADVERTISING,
9424                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9425                 goto unlock;
9426         }
9427
9428         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
9429                                data_len);
9430         if (!cmd) {
9431                 err = -ENOMEM;
9432                 goto unlock;
9433         }
9434
9435         err = hci_req_run(&req, remove_advertising_complete);
9436         if (err < 0)
9437                 mgmt_pending_remove(cmd);
9438
9439 unlock:
9440         hci_dev_unlock(hdev);
9441
9442         return err;
9443 }
9444
9445 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
9446                              void *data, u16 data_len)
9447 {
9448         struct mgmt_cp_get_adv_size_info *cp = data;
9449         struct mgmt_rp_get_adv_size_info rp;
9450         u32 flags, supported_flags;
9451         int err;
9452
9453         bt_dev_dbg(hdev, "sock %p", sk);
9454
9455         if (!lmp_le_capable(hdev))
9456                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9457                                        MGMT_STATUS_REJECTED);
9458
9459         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9460                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9461                                        MGMT_STATUS_INVALID_PARAMS);
9462
9463         flags = __le32_to_cpu(cp->flags);
9464
9465         /* The current implementation only supports a subset of the specified
9466          * flags.
9467          */
9468         supported_flags = get_supported_adv_flags(hdev);
9469         if (flags & ~supported_flags)
9470                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9471                                        MGMT_STATUS_INVALID_PARAMS);
9472
9473         rp.instance = cp->instance;
9474         rp.flags = cp->flags;
9475         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9476         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9477
9478         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9479                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9480
9481         return err;
9482 }
9483
9484 static const struct hci_mgmt_handler mgmt_handlers[] = {
9485         { NULL }, /* 0x0000 (no command) */
9486         { read_version,            MGMT_READ_VERSION_SIZE,
9487                                                 HCI_MGMT_NO_HDEV |
9488                                                 HCI_MGMT_UNTRUSTED },
9489         { read_commands,           MGMT_READ_COMMANDS_SIZE,
9490                                                 HCI_MGMT_NO_HDEV |
9491                                                 HCI_MGMT_UNTRUSTED },
9492         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
9493                                                 HCI_MGMT_NO_HDEV |
9494                                                 HCI_MGMT_UNTRUSTED },
9495         { read_controller_info,    MGMT_READ_INFO_SIZE,
9496                                                 HCI_MGMT_UNTRUSTED },
9497         { set_powered,             MGMT_SETTING_SIZE },
9498         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
9499         { set_connectable,         MGMT_SETTING_SIZE },
9500         { set_fast_connectable,    MGMT_SETTING_SIZE },
9501         { set_bondable,            MGMT_SETTING_SIZE },
9502         { set_link_security,       MGMT_SETTING_SIZE },
9503         { set_ssp,                 MGMT_SETTING_SIZE },
9504         { set_hs,                  MGMT_SETTING_SIZE },
9505         { set_le,                  MGMT_SETTING_SIZE },
9506         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
9507         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
9508         { add_uuid,                MGMT_ADD_UUID_SIZE },
9509         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
9510         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
9511                                                 HCI_MGMT_VAR_LEN },
9512         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
9513                                                 HCI_MGMT_VAR_LEN },
9514         { disconnect,              MGMT_DISCONNECT_SIZE },
9515         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
9516         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
9517         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
9518         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
9519         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
9520         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
9521         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
9522         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
9523         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
9524         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
9525         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
9526         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
9527         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
9528                                                 HCI_MGMT_VAR_LEN },
9529         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
9530         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
9531         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
9532         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
9533         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
9534         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
9535         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
9536         { set_advertising,         MGMT_SETTING_SIZE },
9537         { set_bredr,               MGMT_SETTING_SIZE },
9538         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
9539         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
9540         { set_secure_conn,         MGMT_SETTING_SIZE },
9541         { set_debug_keys,          MGMT_SETTING_SIZE },
9542         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
9543         { load_irks,               MGMT_LOAD_IRKS_SIZE,
9544                                                 HCI_MGMT_VAR_LEN },
9545         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
9546         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
9547         { add_device,              MGMT_ADD_DEVICE_SIZE },
9548         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
9549         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
9550                                                 HCI_MGMT_VAR_LEN },
9551         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
9552                                                 HCI_MGMT_NO_HDEV |
9553                                                 HCI_MGMT_UNTRUSTED },
9554         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
9555                                                 HCI_MGMT_UNCONFIGURED |
9556                                                 HCI_MGMT_UNTRUSTED },
9557         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
9558                                                 HCI_MGMT_UNCONFIGURED },
9559         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
9560                                                 HCI_MGMT_UNCONFIGURED },
9561         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
9562                                                 HCI_MGMT_VAR_LEN },
9563         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
9564         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
9565                                                 HCI_MGMT_NO_HDEV |
9566                                                 HCI_MGMT_UNTRUSTED },
9567         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
9568         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
9569                                                 HCI_MGMT_VAR_LEN },
9570         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
9571         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
9572         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
9573         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
9574                                                 HCI_MGMT_UNTRUSTED },
9575         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
9576         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
9577         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
9578         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
9579                                                 HCI_MGMT_VAR_LEN },
9580         { set_wideband_speech,     MGMT_SETTING_SIZE },
9581         { read_security_info,      MGMT_READ_SECURITY_INFO_SIZE,
9582                                                 HCI_MGMT_UNTRUSTED },
9583         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
9584                                                 HCI_MGMT_UNTRUSTED |
9585                                                 HCI_MGMT_HDEV_OPTIONAL },
9586         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
9587                                                 HCI_MGMT_VAR_LEN |
9588                                                 HCI_MGMT_HDEV_OPTIONAL },
9589         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
9590                                                 HCI_MGMT_UNTRUSTED },
9591         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
9592                                                 HCI_MGMT_VAR_LEN },
9593         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
9594                                                 HCI_MGMT_UNTRUSTED },
9595         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
9596                                                 HCI_MGMT_VAR_LEN },
9597         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
9598         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
9599         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
9600         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
9601                                                 HCI_MGMT_VAR_LEN },
9602         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
9603 };
9604
9605 #ifdef TIZEN_BT
9606 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
9607         { NULL }, /* 0x0000 (no command) */
9608         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
9609         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
9610                                                 HCI_MGMT_VAR_LEN },
9611         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
9612                                                 HCI_MGMT_VAR_LEN },
9613         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
9614         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
9615         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
9616         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
9617         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
9618         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
9619         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
9620         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
9621         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
9622         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
9623         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
9624         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
9625 };
9626 #endif
9627
9628 void mgmt_index_added(struct hci_dev *hdev)
9629 {
9630         struct mgmt_ev_ext_index ev;
9631
9632         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9633                 return;
9634
9635         switch (hdev->dev_type) {
9636         case HCI_PRIMARY:
9637                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9638                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
9639                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9640                         ev.type = 0x01;
9641                 } else {
9642                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
9643                                          HCI_MGMT_INDEX_EVENTS);
9644                         ev.type = 0x00;
9645                 }
9646                 break;
9647         case HCI_AMP:
9648                 ev.type = 0x02;
9649                 break;
9650         default:
9651                 return;
9652         }
9653
9654         ev.bus = hdev->bus;
9655
9656         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
9657                          HCI_MGMT_EXT_INDEX_EVENTS);
9658 }
9659
9660 void mgmt_index_removed(struct hci_dev *hdev)
9661 {
9662         struct mgmt_ev_ext_index ev;
9663         u8 status = MGMT_STATUS_INVALID_INDEX;
9664
9665         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
9666                 return;
9667
9668         switch (hdev->dev_type) {
9669         case HCI_PRIMARY:
9670                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9671
9672                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9673                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
9674                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
9675                         ev.type = 0x01;
9676                 } else {
9677                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
9678                                          HCI_MGMT_INDEX_EVENTS);
9679                         ev.type = 0x00;
9680                 }
9681                 break;
9682         case HCI_AMP:
9683                 ev.type = 0x02;
9684                 break;
9685         default:
9686                 return;
9687         }
9688
9689         ev.bus = hdev->bus;
9690
9691         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
9692                          HCI_MGMT_EXT_INDEX_EVENTS);
9693 }
9694
9695 /* This function requires the caller holds hdev->lock */
9696 static void restart_le_actions(struct hci_dev *hdev)
9697 {
9698         struct hci_conn_params *p;
9699
9700         list_for_each_entry(p, &hdev->le_conn_params, list) {
9701                 /* Needed for AUTO_OFF case where might not "really"
9702                  * have been powered off.
9703                  */
9704                 list_del_init(&p->action);
9705
9706                 switch (p->auto_connect) {
9707                 case HCI_AUTO_CONN_DIRECT:
9708                 case HCI_AUTO_CONN_ALWAYS:
9709                         list_add(&p->action, &hdev->pend_le_conns);
9710                         break;
9711                 case HCI_AUTO_CONN_REPORT:
9712                         list_add(&p->action, &hdev->pend_le_reports);
9713                         break;
9714                 default:
9715                         break;
9716                 }
9717         }
9718 }
9719
9720 void mgmt_power_on(struct hci_dev *hdev, int err)
9721 {
9722         struct cmd_lookup match = { NULL, hdev };
9723
9724         bt_dev_dbg(hdev, "err %d", err);
9725
9726         hci_dev_lock(hdev);
9727
9728         if (!err) {
9729                 restart_le_actions(hdev);
9730                 hci_update_background_scan(hdev);
9731         }
9732
9733         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9734
9735         new_settings(hdev, match.sk);
9736
9737         if (match.sk)
9738                 sock_put(match.sk);
9739
9740         hci_dev_unlock(hdev);
9741 }
9742
9743 void __mgmt_power_off(struct hci_dev *hdev)
9744 {
9745         struct cmd_lookup match = { NULL, hdev };
9746         u8 status, zero_cod[] = { 0, 0, 0 };
9747
9748         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9749
9750         /* If the power off is because of hdev unregistration let
9751          * use the appropriate INVALID_INDEX status. Otherwise use
9752          * NOT_POWERED. We cover both scenarios here since later in
9753          * mgmt_index_removed() any hci_conn callbacks will have already
9754          * been triggered, potentially causing misleading DISCONNECTED
9755          * status responses.
9756          */
9757         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9758                 status = MGMT_STATUS_INVALID_INDEX;
9759         else
9760                 status = MGMT_STATUS_NOT_POWERED;
9761
9762         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
9763
9764         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
9765                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9766                                    zero_cod, sizeof(zero_cod),
9767                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9768                 ext_info_changed(hdev, NULL);
9769         }
9770
9771         new_settings(hdev, match.sk);
9772
9773         if (match.sk)
9774                 sock_put(match.sk);
9775 }
9776
9777 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
9778 {
9779         struct mgmt_pending_cmd *cmd;
9780         u8 status;
9781
9782         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9783         if (!cmd)
9784                 return;
9785
9786         if (err == -ERFKILL)
9787                 status = MGMT_STATUS_RFKILLED;
9788         else
9789                 status = MGMT_STATUS_FAILED;
9790
9791         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
9792
9793         mgmt_pending_remove(cmd);
9794 }
9795
9796 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9797                        bool persistent)
9798 {
9799         struct mgmt_ev_new_link_key ev;
9800
9801         memset(&ev, 0, sizeof(ev));
9802
9803         ev.store_hint = persistent;
9804         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9805         ev.key.addr.type = BDADDR_BREDR;
9806         ev.key.type = key->type;
9807         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
9808         ev.key.pin_len = key->pin_len;
9809
9810         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
9811 }
9812
9813 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9814 {
9815         switch (ltk->type) {
9816         case SMP_LTK:
9817         case SMP_LTK_SLAVE:
9818                 if (ltk->authenticated)
9819                         return MGMT_LTK_AUTHENTICATED;
9820                 return MGMT_LTK_UNAUTHENTICATED;
9821         case SMP_LTK_P256:
9822                 if (ltk->authenticated)
9823                         return MGMT_LTK_P256_AUTH;
9824                 return MGMT_LTK_P256_UNAUTH;
9825         case SMP_LTK_P256_DEBUG:
9826                 return MGMT_LTK_P256_DEBUG;
9827         }
9828
9829         return MGMT_LTK_UNAUTHENTICATED;
9830 }
9831
9832 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
9833 {
9834         struct mgmt_ev_new_long_term_key ev;
9835
9836         memset(&ev, 0, sizeof(ev));
9837
9838         /* Devices using resolvable or non-resolvable random addresses
9839          * without providing an identity resolving key don't require
9840          * to store long term keys. Their addresses will change the
9841          * next time around.
9842          *
9843          * Only when a remote device provides an identity address
9844          * make sure the long term key is stored. If the remote
9845          * identity is known, the long term keys are internally
9846          * mapped to the identity address. So allow static random
9847          * and public addresses here.
9848          */
9849         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9850             (key->bdaddr.b[5] & 0xc0) != 0xc0)
9851                 ev.store_hint = 0x00;
9852         else
9853                 ev.store_hint = persistent;
9854
9855         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9856         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
9857         ev.key.type = mgmt_ltk_type(key);
9858         ev.key.enc_size = key->enc_size;
9859         ev.key.ediv = key->ediv;
9860         ev.key.rand = key->rand;
9861
9862         if (key->type == SMP_LTK)
9863                 ev.key.master = 1;
9864
9865         /* Make sure we copy only the significant bytes based on the
9866          * encryption key size, and set the rest of the value to zeroes.
9867          */
9868         memcpy(ev.key.val, key->val, key->enc_size);
9869         memset(ev.key.val + key->enc_size, 0,
9870                sizeof(ev.key.val) - key->enc_size);
9871
9872         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
9873 }
9874
9875 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
9876 {
9877         struct mgmt_ev_new_irk ev;
9878
9879         memset(&ev, 0, sizeof(ev));
9880
9881         ev.store_hint = persistent;
9882
9883         bacpy(&ev.rpa, &irk->rpa);
9884         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
9885         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
9886         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9887
9888         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9889 }
9890
9891 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9892                    bool persistent)
9893 {
9894         struct mgmt_ev_new_csrk ev;
9895
9896         memset(&ev, 0, sizeof(ev));
9897
9898         /* Devices using resolvable or non-resolvable random addresses
9899          * without providing an identity resolving key don't require
9900          * to store signature resolving keys. Their addresses will change
9901          * the next time around.
9902          *
9903          * Only when a remote device provides an identity address
9904          * make sure the signature resolving key is stored. So allow
9905          * static random and public addresses here.
9906          */
9907         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9908             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9909                 ev.store_hint = 0x00;
9910         else
9911                 ev.store_hint = persistent;
9912
9913         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9914         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
9915         ev.key.type = csrk->type;
9916         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9917
9918         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9919 }
9920
9921 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9922                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
9923                          u16 max_interval, u16 latency, u16 timeout)
9924 {
9925         struct mgmt_ev_new_conn_param ev;
9926
9927         if (!hci_is_identity_address(bdaddr, bdaddr_type))
9928                 return;
9929
9930         memset(&ev, 0, sizeof(ev));
9931         bacpy(&ev.addr.bdaddr, bdaddr);
9932         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
9933         ev.store_hint = store_hint;
9934         ev.min_interval = cpu_to_le16(min_interval);
9935         ev.max_interval = cpu_to_le16(max_interval);
9936         ev.latency = cpu_to_le16(latency);
9937         ev.timeout = cpu_to_le16(timeout);
9938
9939         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
9940 }
9941
9942 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
9943                            u32 flags, u8 *name, u8 name_len)
9944 {
9945         char buf[512];
9946         struct mgmt_ev_device_connected *ev = (void *) buf;
9947         u16 eir_len = 0;
9948
9949         bacpy(&ev->addr.bdaddr, &conn->dst);
9950         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9951
9952         ev->flags = __cpu_to_le32(flags);
9953
9954         /* We must ensure that the EIR Data fields are ordered and
9955          * unique. Keep it simple for now and avoid the problem by not
9956          * adding any BR/EDR data to the LE adv.
9957          */
9958         if (conn->le_adv_data_len > 0) {
9959                 memcpy(&ev->eir[eir_len],
9960                        conn->le_adv_data, conn->le_adv_data_len);
9961                 eir_len = conn->le_adv_data_len;
9962         } else {
9963                 if (name_len > 0)
9964                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
9965                                                   name, name_len);
9966
9967                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
9968                         eir_len = eir_append_data(ev->eir, eir_len,
9969                                                   EIR_CLASS_OF_DEV,
9970                                                   conn->dev_class, 3);
9971         }
9972
9973         ev->eir_len = cpu_to_le16(eir_len);
9974
9975         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
9976                     sizeof(*ev) + eir_len, NULL);
9977 }
9978
9979 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
9980 {
9981         struct sock **sk = data;
9982
9983         cmd->cmd_complete(cmd, 0);
9984
9985         *sk = cmd->sk;
9986         sock_hold(*sk);
9987
9988         mgmt_pending_remove(cmd);
9989 }
9990
9991 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
9992 {
9993         struct hci_dev *hdev = data;
9994         struct mgmt_cp_unpair_device *cp = cmd->param;
9995
9996         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
9997
9998         cmd->cmd_complete(cmd, 0);
9999         mgmt_pending_remove(cmd);
10000 }
10001
10002 bool mgmt_powering_down(struct hci_dev *hdev)
10003 {
10004         struct mgmt_pending_cmd *cmd;
10005         struct mgmt_mode *cp;
10006
10007         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10008         if (!cmd)
10009                 return false;
10010
10011         cp = cmd->param;
10012         if (!cp->val)
10013                 return true;
10014
10015         return false;
10016 }
10017
10018 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10019                               u8 link_type, u8 addr_type, u8 reason,
10020                               bool mgmt_connected)
10021 {
10022         struct mgmt_ev_device_disconnected ev;
10023         struct sock *sk = NULL;
10024
10025         /* The connection is still in hci_conn_hash so test for 1
10026          * instead of 0 to know if this is the last one.
10027          */
10028         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10029                 cancel_delayed_work(&hdev->power_off);
10030                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10031         }
10032
10033         if (!mgmt_connected)
10034                 return;
10035
10036         if (link_type != ACL_LINK && link_type != LE_LINK)
10037                 return;
10038
10039         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
10040
10041         bacpy(&ev.addr.bdaddr, bdaddr);
10042         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10043         ev.reason = reason;
10044
10045         /* Report disconnects due to suspend */
10046         if (hdev->suspended)
10047                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10048
10049         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10050
10051         if (sk)
10052                 sock_put(sk);
10053
10054         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10055                              hdev);
10056 }
10057
10058 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10059                             u8 link_type, u8 addr_type, u8 status)
10060 {
10061         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10062         struct mgmt_cp_disconnect *cp;
10063         struct mgmt_pending_cmd *cmd;
10064
10065         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10066                              hdev);
10067
10068         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10069         if (!cmd)
10070                 return;
10071
10072         cp = cmd->param;
10073
10074         if (bacmp(bdaddr, &cp->addr.bdaddr))
10075                 return;
10076
10077         if (cp->addr.type != bdaddr_type)
10078                 return;
10079
10080         cmd->cmd_complete(cmd, mgmt_status(status));
10081         mgmt_pending_remove(cmd);
10082 }
10083
10084 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10085                          u8 addr_type, u8 status)
10086 {
10087         struct mgmt_ev_connect_failed ev;
10088
10089         /* The connection is still in hci_conn_hash so test for 1
10090          * instead of 0 to know if this is the last one.
10091          */
10092         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10093                 cancel_delayed_work(&hdev->power_off);
10094                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10095         }
10096
10097         bacpy(&ev.addr.bdaddr, bdaddr);
10098         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10099         ev.status = mgmt_status(status);
10100
10101         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
10102 }
10103
10104 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
10105 {
10106         struct mgmt_ev_pin_code_request ev;
10107
10108         bacpy(&ev.addr.bdaddr, bdaddr);
10109         ev.addr.type = BDADDR_BREDR;
10110         ev.secure = secure;
10111
10112         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
10113 }
10114
10115 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10116                                   u8 status)
10117 {
10118         struct mgmt_pending_cmd *cmd;
10119
10120         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
10121         if (!cmd)
10122                 return;
10123
10124         cmd->cmd_complete(cmd, mgmt_status(status));
10125         mgmt_pending_remove(cmd);
10126 }
10127
10128 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10129                                       u8 status)
10130 {
10131         struct mgmt_pending_cmd *cmd;
10132
10133         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
10134         if (!cmd)
10135                 return;
10136
10137         cmd->cmd_complete(cmd, mgmt_status(status));
10138         mgmt_pending_remove(cmd);
10139 }
10140
10141 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10142                               u8 link_type, u8 addr_type, u32 value,
10143                               u8 confirm_hint)
10144 {
10145         struct mgmt_ev_user_confirm_request ev;
10146
10147         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10148
10149         bacpy(&ev.addr.bdaddr, bdaddr);
10150         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10151         ev.confirm_hint = confirm_hint;
10152         ev.value = cpu_to_le32(value);
10153
10154         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
10155                           NULL);
10156 }
10157
10158 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10159                               u8 link_type, u8 addr_type)
10160 {
10161         struct mgmt_ev_user_passkey_request ev;
10162
10163         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10164
10165         bacpy(&ev.addr.bdaddr, bdaddr);
10166         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10167
10168         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
10169                           NULL);
10170 }
10171
10172 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10173                                       u8 link_type, u8 addr_type, u8 status,
10174                                       u8 opcode)
10175 {
10176         struct mgmt_pending_cmd *cmd;
10177
10178         cmd = pending_find(opcode, hdev);
10179         if (!cmd)
10180                 return -ENOENT;
10181
10182         cmd->cmd_complete(cmd, mgmt_status(status));
10183         mgmt_pending_remove(cmd);
10184
10185         return 0;
10186 }
10187
10188 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10189                                      u8 link_type, u8 addr_type, u8 status)
10190 {
10191         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10192                                           status, MGMT_OP_USER_CONFIRM_REPLY);
10193 }
10194
10195 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10196                                          u8 link_type, u8 addr_type, u8 status)
10197 {
10198         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10199                                           status,
10200                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
10201 }
10202
10203 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10204                                      u8 link_type, u8 addr_type, u8 status)
10205 {
10206         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10207                                           status, MGMT_OP_USER_PASSKEY_REPLY);
10208 }
10209
10210 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10211                                          u8 link_type, u8 addr_type, u8 status)
10212 {
10213         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10214                                           status,
10215                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
10216 }
10217
10218 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
10219                              u8 link_type, u8 addr_type, u32 passkey,
10220                              u8 entered)
10221 {
10222         struct mgmt_ev_passkey_notify ev;
10223
10224         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10225
10226         bacpy(&ev.addr.bdaddr, bdaddr);
10227         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10228         ev.passkey = __cpu_to_le32(passkey);
10229         ev.entered = entered;
10230
10231         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
10232 }
10233
10234 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
10235 {
10236         struct mgmt_ev_auth_failed ev;
10237         struct mgmt_pending_cmd *cmd;
10238         u8 status = mgmt_status(hci_status);
10239
10240         bacpy(&ev.addr.bdaddr, &conn->dst);
10241         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10242         ev.status = status;
10243
10244         cmd = find_pairing(conn);
10245
10246         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
10247                     cmd ? cmd->sk : NULL);
10248
10249         if (cmd) {
10250                 cmd->cmd_complete(cmd, status);
10251                 mgmt_pending_remove(cmd);
10252         }
10253 }
10254
10255 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
10256 {
10257         struct cmd_lookup match = { NULL, hdev };
10258         bool changed;
10259
10260         if (status) {
10261                 u8 mgmt_err = mgmt_status(status);
10262                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
10263                                      cmd_status_rsp, &mgmt_err);
10264                 return;
10265         }
10266
10267         if (test_bit(HCI_AUTH, &hdev->flags))
10268                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
10269         else
10270                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
10271
10272         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
10273                              &match);
10274
10275         if (changed)
10276                 new_settings(hdev, match.sk);
10277
10278         if (match.sk)
10279                 sock_put(match.sk);
10280 }
10281
10282 static void clear_eir(struct hci_request *req)
10283 {
10284         struct hci_dev *hdev = req->hdev;
10285         struct hci_cp_write_eir cp;
10286
10287         if (!lmp_ext_inq_capable(hdev))
10288                 return;
10289
10290         memset(hdev->eir, 0, sizeof(hdev->eir));
10291
10292         memset(&cp, 0, sizeof(cp));
10293
10294         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
10295 }
10296
10297 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
10298 {
10299         struct cmd_lookup match = { NULL, hdev };
10300         struct hci_request req;
10301         bool changed = false;
10302
10303         if (status) {
10304                 u8 mgmt_err = mgmt_status(status);
10305
10306                 if (enable && hci_dev_test_and_clear_flag(hdev,
10307                                                           HCI_SSP_ENABLED)) {
10308                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
10309                         new_settings(hdev, NULL);
10310                 }
10311
10312                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
10313                                      &mgmt_err);
10314                 return;
10315         }
10316
10317         if (enable) {
10318                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
10319         } else {
10320                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
10321                 if (!changed)
10322                         changed = hci_dev_test_and_clear_flag(hdev,
10323                                                               HCI_HS_ENABLED);
10324                 else
10325                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
10326         }
10327
10328         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
10329
10330         if (changed)
10331                 new_settings(hdev, match.sk);
10332
10333         if (match.sk)
10334                 sock_put(match.sk);
10335
10336         hci_req_init(&req, hdev);
10337
10338         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
10339                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
10340                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
10341                                     sizeof(enable), &enable);
10342                 __hci_req_update_eir(&req);
10343         } else {
10344                 clear_eir(&req);
10345         }
10346
10347         hci_req_run(&req, NULL);
10348 }
10349
10350 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
10351 {
10352         struct cmd_lookup *match = data;
10353
10354         if (match->sk == NULL) {
10355                 match->sk = cmd->sk;
10356                 sock_hold(match->sk);
10357         }
10358 }
10359
10360 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
10361                                     u8 status)
10362 {
10363         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
10364
10365         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
10366         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
10367         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
10368
10369         if (!status) {
10370                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
10371                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10372                 ext_info_changed(hdev, NULL);
10373         }
10374
10375         if (match.sk)
10376                 sock_put(match.sk);
10377 }
10378
10379 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
10380 {
10381         struct mgmt_cp_set_local_name ev;
10382         struct mgmt_pending_cmd *cmd;
10383
10384         if (status)
10385                 return;
10386
10387         memset(&ev, 0, sizeof(ev));
10388         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
10389         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
10390
10391         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
10392         if (!cmd) {
10393                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
10394
10395                 /* If this is a HCI command related to powering on the
10396                  * HCI dev don't send any mgmt signals.
10397                  */
10398                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
10399                         return;
10400         }
10401
10402         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
10403                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
10404         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
10405 }
10406
10407 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
10408 {
10409         int i;
10410
10411         for (i = 0; i < uuid_count; i++) {
10412                 if (!memcmp(uuid, uuids[i], 16))
10413                         return true;
10414         }
10415
10416         return false;
10417 }
10418
10419 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
10420 {
10421         u16 parsed = 0;
10422
10423         while (parsed < eir_len) {
10424                 u8 field_len = eir[0];
10425                 u8 uuid[16];
10426                 int i;
10427
10428                 if (field_len == 0)
10429                         break;
10430
10431                 if (eir_len - parsed < field_len + 1)
10432                         break;
10433
10434                 switch (eir[1]) {
10435                 case EIR_UUID16_ALL:
10436                 case EIR_UUID16_SOME:
10437                         for (i = 0; i + 3 <= field_len; i += 2) {
10438                                 memcpy(uuid, bluetooth_base_uuid, 16);
10439                                 uuid[13] = eir[i + 3];
10440                                 uuid[12] = eir[i + 2];
10441                                 if (has_uuid(uuid, uuid_count, uuids))
10442                                         return true;
10443                         }
10444                         break;
10445                 case EIR_UUID32_ALL:
10446                 case EIR_UUID32_SOME:
10447                         for (i = 0; i + 5 <= field_len; i += 4) {
10448                                 memcpy(uuid, bluetooth_base_uuid, 16);
10449                                 uuid[15] = eir[i + 5];
10450                                 uuid[14] = eir[i + 4];
10451                                 uuid[13] = eir[i + 3];
10452                                 uuid[12] = eir[i + 2];
10453                                 if (has_uuid(uuid, uuid_count, uuids))
10454                                         return true;
10455                         }
10456                         break;
10457                 case EIR_UUID128_ALL:
10458                 case EIR_UUID128_SOME:
10459                         for (i = 0; i + 17 <= field_len; i += 16) {
10460                                 memcpy(uuid, eir + i + 2, 16);
10461                                 if (has_uuid(uuid, uuid_count, uuids))
10462                                         return true;
10463                         }
10464                         break;
10465                 }
10466
10467                 parsed += field_len + 1;
10468                 eir += field_len + 1;
10469         }
10470
10471         return false;
10472 }
10473
10474 static void restart_le_scan(struct hci_dev *hdev)
10475 {
10476         /* If controller is not scanning we are done. */
10477         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
10478                 return;
10479
10480         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
10481                        hdev->discovery.scan_start +
10482                        hdev->discovery.scan_duration))
10483                 return;
10484
10485         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
10486                            DISCOV_LE_RESTART_DELAY);
10487 }
10488
10489 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
10490                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10491 {
10492         /* If a RSSI threshold has been specified, and
10493          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
10494          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
10495          * is set, let it through for further processing, as we might need to
10496          * restart the scan.
10497          *
10498          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
10499          * the results are also dropped.
10500          */
10501         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10502             (rssi == HCI_RSSI_INVALID ||
10503             (rssi < hdev->discovery.rssi &&
10504              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
10505                 return  false;
10506
10507         if (hdev->discovery.uuid_count != 0) {
10508                 /* If a list of UUIDs is provided in filter, results with no
10509                  * matching UUID should be dropped.
10510                  */
10511                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
10512                                    hdev->discovery.uuids) &&
10513                     !eir_has_uuids(scan_rsp, scan_rsp_len,
10514                                    hdev->discovery.uuid_count,
10515                                    hdev->discovery.uuids))
10516                         return false;
10517         }
10518
10519         /* If duplicate filtering does not report RSSI changes, then restart
10520          * scanning to ensure updated result with updated RSSI values.
10521          */
10522         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
10523                 restart_le_scan(hdev);
10524
10525                 /* Validate RSSI value against the RSSI threshold once more. */
10526                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10527                     rssi < hdev->discovery.rssi)
10528                         return false;
10529         }
10530
10531         return true;
10532 }
10533
10534 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10535                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
10536                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10537 {
10538         char buf[512];
10539         struct mgmt_ev_device_found *ev = (void *)buf;
10540         size_t ev_size;
10541
10542         /* Don't send events for a non-kernel initiated discovery. With
10543          * LE one exception is if we have pend_le_reports > 0 in which
10544          * case we're doing passive scanning and want these events.
10545          */
10546         if (!hci_discovery_active(hdev)) {
10547                 if (link_type == ACL_LINK)
10548                         return;
10549                 if (link_type == LE_LINK &&
10550                     list_empty(&hdev->pend_le_reports) &&
10551                     !hci_is_adv_monitoring(hdev)) {
10552                         return;
10553                 }
10554         }
10555
10556         if (hdev->discovery.result_filtering) {
10557                 /* We are using service discovery */
10558                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
10559                                      scan_rsp_len))
10560                         return;
10561         }
10562
10563         if (hdev->discovery.limited) {
10564                 /* Check for limited discoverable bit */
10565                 if (dev_class) {
10566                         if (!(dev_class[1] & 0x20))
10567                                 return;
10568                 } else {
10569                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
10570                         if (!flags || !(flags[0] & LE_AD_LIMITED))
10571                                 return;
10572                 }
10573         }
10574
10575         /* Make sure that the buffer is big enough. The 5 extra bytes
10576          * are for the potential CoD field.
10577          */
10578         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
10579                 return;
10580
10581         memset(buf, 0, sizeof(buf));
10582
10583         /* In case of device discovery with BR/EDR devices (pre 1.2), the
10584          * RSSI value was reported as 0 when not available. This behavior
10585          * is kept when using device discovery. This is required for full
10586          * backwards compatibility with the API.
10587          *
10588          * However when using service discovery, the value 127 will be
10589          * returned when the RSSI is not available.
10590          */
10591         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
10592             link_type == ACL_LINK)
10593                 rssi = 0;
10594
10595         bacpy(&ev->addr.bdaddr, bdaddr);
10596         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10597         ev->rssi = rssi;
10598         ev->flags = cpu_to_le32(flags);
10599
10600         if (eir_len > 0)
10601                 /* Copy EIR or advertising data into event */
10602                 memcpy(ev->eir, eir, eir_len);
10603
10604         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
10605                                        NULL))
10606                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
10607                                           dev_class, 3);
10608
10609         if (scan_rsp_len > 0)
10610                 /* Append scan response data to event */
10611                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
10612
10613         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10614         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
10615
10616         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
10617 }
10618
10619 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10620                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
10621 {
10622         struct mgmt_ev_device_found *ev;
10623         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
10624         u16 eir_len;
10625
10626         ev = (struct mgmt_ev_device_found *) buf;
10627
10628         memset(buf, 0, sizeof(buf));
10629
10630         bacpy(&ev->addr.bdaddr, bdaddr);
10631         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10632         ev->rssi = rssi;
10633
10634         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
10635                                   name_len);
10636
10637         ev->eir_len = cpu_to_le16(eir_len);
10638
10639         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
10640 }
10641
10642 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
10643 {
10644         struct mgmt_ev_discovering ev;
10645
10646         bt_dev_dbg(hdev, "discovering %u", discovering);
10647
10648         memset(&ev, 0, sizeof(ev));
10649         ev.type = hdev->discovery.type;
10650         ev.discovering = discovering;
10651
10652         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
10653 }
10654
10655 void mgmt_suspending(struct hci_dev *hdev, u8 state)
10656 {
10657         struct mgmt_ev_controller_suspend ev;
10658
10659         ev.suspend_state = state;
10660         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
10661 }
10662
10663 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
10664                    u8 addr_type)
10665 {
10666         struct mgmt_ev_controller_resume ev;
10667
10668         ev.wake_reason = reason;
10669         if (bdaddr) {
10670                 bacpy(&ev.addr.bdaddr, bdaddr);
10671                 ev.addr.type = addr_type;
10672         } else {
10673                 memset(&ev.addr, 0, sizeof(ev.addr));
10674         }
10675
10676         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
10677 }
10678
10679 static struct hci_mgmt_chan chan = {
10680         .channel        = HCI_CHANNEL_CONTROL,
10681         .handler_count  = ARRAY_SIZE(mgmt_handlers),
10682         .handlers       = mgmt_handlers,
10683 #ifdef TIZEN_BT
10684         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
10685         .tizen_handlers = tizen_mgmt_handlers,
10686 #endif
10687         .hdev_init      = mgmt_init_hdev,
10688 };
10689
10690 int mgmt_init(void)
10691 {
10692         return hci_mgmt_chan_register(&chan);
10693 }
10694
10695 void mgmt_exit(void)
10696 {
10697         hci_mgmt_chan_unregister(&chan);
10698 }