net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #endif
  38
  39 #include "hci_request.h"
  40 #include "smp.h"
  41 #include "mgmt_util.h"
  42 #include "mgmt_config.h"
  43 #include "msft.h"
  44
  45 #define MGMT_VERSION    1
  46 #define MGMT_REVISION   21
  47
  48 static const u16 mgmt_commands[] = {
  49         MGMT_OP_READ_INDEX_LIST,
  50         MGMT_OP_READ_INFO,
  51         MGMT_OP_SET_POWERED,
  52         MGMT_OP_SET_DISCOVERABLE,
  53         MGMT_OP_SET_CONNECTABLE,
  54         MGMT_OP_SET_FAST_CONNECTABLE,
  55         MGMT_OP_SET_BONDABLE,
  56         MGMT_OP_SET_LINK_SECURITY,
  57         MGMT_OP_SET_SSP,
  58         MGMT_OP_SET_HS,
  59         MGMT_OP_SET_LE,
  60         MGMT_OP_SET_DEV_CLASS,
  61         MGMT_OP_SET_LOCAL_NAME,
  62         MGMT_OP_ADD_UUID,
  63         MGMT_OP_REMOVE_UUID,
  64         MGMT_OP_LOAD_LINK_KEYS,
  65         MGMT_OP_LOAD_LONG_TERM_KEYS,
  66         MGMT_OP_DISCONNECT,
  67         MGMT_OP_GET_CONNECTIONS,
  68         MGMT_OP_PIN_CODE_REPLY,
  69         MGMT_OP_PIN_CODE_NEG_REPLY,
  70         MGMT_OP_SET_IO_CAPABILITY,
  71         MGMT_OP_PAIR_DEVICE,
  72         MGMT_OP_CANCEL_PAIR_DEVICE,
  73         MGMT_OP_UNPAIR_DEVICE,
  74         MGMT_OP_USER_CONFIRM_REPLY,
  75         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  76         MGMT_OP_USER_PASSKEY_REPLY,
  77         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  78         MGMT_OP_READ_LOCAL_OOB_DATA,
  79         MGMT_OP_ADD_REMOTE_OOB_DATA,
  80         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  81         MGMT_OP_START_DISCOVERY,
  82         MGMT_OP_STOP_DISCOVERY,
  83         MGMT_OP_CONFIRM_NAME,
  84         MGMT_OP_BLOCK_DEVICE,
  85         MGMT_OP_UNBLOCK_DEVICE,
  86         MGMT_OP_SET_DEVICE_ID,
  87         MGMT_OP_SET_ADVERTISING,
  88         MGMT_OP_SET_BREDR,
  89         MGMT_OP_SET_STATIC_ADDRESS,
  90         MGMT_OP_SET_SCAN_PARAMS,
  91         MGMT_OP_SET_SECURE_CONN,
  92         MGMT_OP_SET_DEBUG_KEYS,
  93         MGMT_OP_SET_PRIVACY,
  94         MGMT_OP_LOAD_IRKS,
  95         MGMT_OP_GET_CONN_INFO,
  96         MGMT_OP_GET_CLOCK_INFO,
  97         MGMT_OP_ADD_DEVICE,
  98         MGMT_OP_REMOVE_DEVICE,
  99         MGMT_OP_LOAD_CONN_PARAM,
 100         MGMT_OP_READ_UNCONF_INDEX_LIST,
 101         MGMT_OP_READ_CONFIG_INFO,
 102         MGMT_OP_SET_EXTERNAL_CONFIG,
 103         MGMT_OP_SET_PUBLIC_ADDRESS,
 104         MGMT_OP_START_SERVICE_DISCOVERY,
 105         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 106         MGMT_OP_READ_EXT_INDEX_LIST,
 107         MGMT_OP_READ_ADV_FEATURES,
 108         MGMT_OP_ADD_ADVERTISING,
 109         MGMT_OP_REMOVE_ADVERTISING,
 110         MGMT_OP_GET_ADV_SIZE_INFO,
 111         MGMT_OP_START_LIMITED_DISCOVERY,
 112         MGMT_OP_READ_EXT_INFO,
 113         MGMT_OP_SET_APPEARANCE,
 114         MGMT_OP_GET_PHY_CONFIGURATION,
 115         MGMT_OP_SET_PHY_CONFIGURATION,
 116         MGMT_OP_SET_BLOCKED_KEYS,
 117         MGMT_OP_SET_WIDEBAND_SPEECH,
 118         MGMT_OP_READ_CONTROLLER_CAP,
 119         MGMT_OP_READ_EXP_FEATURES_INFO,
 120         MGMT_OP_SET_EXP_FEATURE,
 121         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 122         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 123         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 124         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 125         MGMT_OP_GET_DEVICE_FLAGS,
 126         MGMT_OP_SET_DEVICE_FLAGS,
 127         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 128         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 129         MGMT_OP_REMOVE_ADV_MONITOR,
 130         MGMT_OP_ADD_EXT_ADV_PARAMS,
 131         MGMT_OP_ADD_EXT_ADV_DATA,
 132         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 133 };
 134
 135 static const u16 mgmt_events[] = {
 136         MGMT_EV_CONTROLLER_ERROR,
 137         MGMT_EV_INDEX_ADDED,
 138         MGMT_EV_INDEX_REMOVED,
 139         MGMT_EV_NEW_SETTINGS,
 140         MGMT_EV_CLASS_OF_DEV_CHANGED,
 141         MGMT_EV_LOCAL_NAME_CHANGED,
 142         MGMT_EV_NEW_LINK_KEY,
 143         MGMT_EV_NEW_LONG_TERM_KEY,
 144         MGMT_EV_DEVICE_CONNECTED,
 145         MGMT_EV_DEVICE_DISCONNECTED,
 146         MGMT_EV_CONNECT_FAILED,
 147         MGMT_EV_PIN_CODE_REQUEST,
 148         MGMT_EV_USER_CONFIRM_REQUEST,
 149         MGMT_EV_USER_PASSKEY_REQUEST,
 150         MGMT_EV_AUTH_FAILED,
 151         MGMT_EV_DEVICE_FOUND,
 152         MGMT_EV_DISCOVERING,
 153         MGMT_EV_DEVICE_BLOCKED,
 154         MGMT_EV_DEVICE_UNBLOCKED,
 155         MGMT_EV_DEVICE_UNPAIRED,
 156         MGMT_EV_PASSKEY_NOTIFY,
 157         MGMT_EV_NEW_IRK,
 158         MGMT_EV_NEW_CSRK,
 159         MGMT_EV_DEVICE_ADDED,
 160         MGMT_EV_DEVICE_REMOVED,
 161         MGMT_EV_NEW_CONN_PARAM,
 162         MGMT_EV_UNCONF_INDEX_ADDED,
 163         MGMT_EV_UNCONF_INDEX_REMOVED,
 164         MGMT_EV_NEW_CONFIG_OPTIONS,
 165         MGMT_EV_EXT_INDEX_ADDED,
 166         MGMT_EV_EXT_INDEX_REMOVED,
 167         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 168         MGMT_EV_ADVERTISING_ADDED,
 169         MGMT_EV_ADVERTISING_REMOVED,
 170         MGMT_EV_EXT_INFO_CHANGED,
 171         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 172         MGMT_EV_EXP_FEATURE_CHANGED,
 173         MGMT_EV_DEVICE_FLAGS_CHANGED,
 174         MGMT_EV_ADV_MONITOR_ADDED,
 175         MGMT_EV_ADV_MONITOR_REMOVED,
 176         MGMT_EV_CONTROLLER_SUSPEND,
 177         MGMT_EV_CONTROLLER_RESUME,
 178 };
 179
 180 static const u16 mgmt_untrusted_commands[] = {
 181         MGMT_OP_READ_INDEX_LIST,
 182         MGMT_OP_READ_INFO,
 183         MGMT_OP_READ_UNCONF_INDEX_LIST,
 184         MGMT_OP_READ_CONFIG_INFO,
 185         MGMT_OP_READ_EXT_INDEX_LIST,
 186         MGMT_OP_READ_EXT_INFO,
 187         MGMT_OP_READ_CONTROLLER_CAP,
 188         MGMT_OP_READ_EXP_FEATURES_INFO,
 189         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 190         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 191 };
 192
 193 static const u16 mgmt_untrusted_events[] = {
 194         MGMT_EV_INDEX_ADDED,
 195         MGMT_EV_INDEX_REMOVED,
 196         MGMT_EV_NEW_SETTINGS,
 197         MGMT_EV_CLASS_OF_DEV_CHANGED,
 198         MGMT_EV_LOCAL_NAME_CHANGED,
 199         MGMT_EV_UNCONF_INDEX_ADDED,
 200         MGMT_EV_UNCONF_INDEX_REMOVED,
 201         MGMT_EV_NEW_CONFIG_OPTIONS,
 202         MGMT_EV_EXT_INDEX_ADDED,
 203         MGMT_EV_EXT_INDEX_REMOVED,
 204         MGMT_EV_EXT_INFO_CHANGED,
 205         MGMT_EV_EXP_FEATURE_CHANGED,
 206 };
 207
 208 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 209
 210 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 211                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 212
 213 /* HCI to MGMT error code conversion table */
 214 static const u8 mgmt_status_table[] = {
 215         MGMT_STATUS_SUCCESS,
 216         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 217         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 218         MGMT_STATUS_FAILED,             /* Hardware Failure */
 219         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 220         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 221         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 222         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 223         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 224         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 225         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 226         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 227         MGMT_STATUS_BUSY,               /* Command Disallowed */
 228         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 229         MGMT_STATUS_REJECTED,           /* Rejected Security */
 230         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 231         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 232         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 233         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 234         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 235         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 236         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 237         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 238         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 239         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 240         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 241         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 242         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 243         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 244         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 245         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 246         MGMT_STATUS_FAILED,             /* Unspecified Error */
 247         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 248         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 249         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 250         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 251         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 252         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 253         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 254         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 255         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 256         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 257         MGMT_STATUS_FAILED,             /* Transaction Collision */
 258         MGMT_STATUS_FAILED,             /* Reserved for future use */
 259         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 260         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 261         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 262         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 263         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 264         MGMT_STATUS_FAILED,             /* Reserved for future use */
 265         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 266         MGMT_STATUS_FAILED,             /* Reserved for future use */
 267         MGMT_STATUS_FAILED,             /* Slot Violation */
 268         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 269         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 270         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 271         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 272         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 273         MGMT_STATUS_BUSY,               /* Controller Busy */
 274         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 275         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 276         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 277         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 278         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 279 };
 280
 281 static u8 mgmt_status(u8 hci_status)
 282 {
 283         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 284                 return mgmt_status_table[hci_status];
 285
 286         return MGMT_STATUS_FAILED;
 287 }
 288
 289 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 290                             u16 len, int flag)
 291 {
 292         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 293                                flag, NULL);
 294 }
 295
 296 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 297                               u16 len, int flag, struct sock *skip_sk)
 298 {
 299         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 300                                flag, skip_sk);
 301 }
 302
 303 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 304                       struct sock *skip_sk)
 305 {
 306         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 307                                HCI_SOCK_TRUSTED, skip_sk);
 308 }
 309
 310 static u8 le_addr_type(u8 mgmt_addr_type)
 311 {
 312         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 313                 return ADDR_LE_DEV_PUBLIC;
 314         else
 315                 return ADDR_LE_DEV_RANDOM;
 316 }
 317
 318 void mgmt_fill_version_info(void *ver)
 319 {
 320         struct mgmt_rp_read_version *rp = ver;
 321
 322         rp->version = MGMT_VERSION;
 323         rp->revision = cpu_to_le16(MGMT_REVISION);
 324 }
 325
 326 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 327                         u16 data_len)
 328 {
 329         struct mgmt_rp_read_version rp;
 330
 331         bt_dev_dbg(hdev, "sock %p", sk);
 332
 333         mgmt_fill_version_info(&rp);
 334
 335         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 336                                  &rp, sizeof(rp));
 337 }
 338
 339 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 340                          u16 data_len)
 341 {
 342         struct mgmt_rp_read_commands *rp;
 343         u16 num_commands, num_events;
 344         size_t rp_size;
 345         int i, err;
 346
 347         bt_dev_dbg(hdev, "sock %p", sk);
 348
 349         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 350                 num_commands = ARRAY_SIZE(mgmt_commands);
 351                 num_events = ARRAY_SIZE(mgmt_events);
 352         } else {
 353                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 354                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 355         }
 356
 357         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 358
 359         rp = kmalloc(rp_size, GFP_KERNEL);
 360         if (!rp)
 361                 return -ENOMEM;
 362
 363         rp->num_commands = cpu_to_le16(num_commands);
 364         rp->num_events = cpu_to_le16(num_events);
 365
 366         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 367                 __le16 *opcode = rp->opcodes;
 368
 369                 for (i = 0; i < num_commands; i++, opcode++)
 370                         put_unaligned_le16(mgmt_commands[i], opcode);
 371
 372                 for (i = 0; i < num_events; i++, opcode++)
 373                         put_unaligned_le16(mgmt_events[i], opcode);
 374         } else {
 375                 __le16 *opcode = rp->opcodes;
 376
 377                 for (i = 0; i < num_commands; i++, opcode++)
 378                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 379
 380                 for (i = 0; i < num_events; i++, opcode++)
 381                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 382         }
 383
 384         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 385                                 rp, rp_size);
 386         kfree(rp);
 387
 388         return err;
 389 }
 390
 391 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 392                            u16 data_len)
 393 {
 394         struct mgmt_rp_read_index_list *rp;
 395         struct hci_dev *d;
 396         size_t rp_len;
 397         u16 count;
 398         int err;
 399
 400         bt_dev_dbg(hdev, "sock %p", sk);
 401
 402         read_lock(&hci_dev_list_lock);
 403
 404         count = 0;
 405         list_for_each_entry(d, &hci_dev_list, list) {
 406                 if (d->dev_type == HCI_PRIMARY &&
 407                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 408                         count++;
 409         }
 410
 411         rp_len = sizeof(*rp) + (2 * count);
 412         rp = kmalloc(rp_len, GFP_ATOMIC);
 413         if (!rp) {
 414                 read_unlock(&hci_dev_list_lock);
 415                 return -ENOMEM;
 416         }
 417
 418         count = 0;
 419         list_for_each_entry(d, &hci_dev_list, list) {
 420                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 421                     hci_dev_test_flag(d, HCI_CONFIG) ||
 422                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 423                         continue;
 424
 425                 /* Devices marked as raw-only are neither configured
 426                  * nor unconfigured controllers.
 427                  */
 428                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 429                         continue;
 430
 431                 if (d->dev_type == HCI_PRIMARY &&
 432                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 433                         rp->index[count++] = cpu_to_le16(d->id);
 434                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 435                 }
 436         }
 437
 438         rp->num_controllers = cpu_to_le16(count);
 439         rp_len = sizeof(*rp) + (2 * count);
 440
 441         read_unlock(&hci_dev_list_lock);
 442
 443         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 444                                 0, rp, rp_len);
 445
 446         kfree(rp);
 447
 448         return err;
 449 }
 450
 451 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 452                                   void *data, u16 data_len)
 453 {
 454         struct mgmt_rp_read_unconf_index_list *rp;
 455         struct hci_dev *d;
 456         size_t rp_len;
 457         u16 count;
 458         int err;
 459
 460         bt_dev_dbg(hdev, "sock %p", sk);
 461
 462         read_lock(&hci_dev_list_lock);
 463
 464         count = 0;
 465         list_for_each_entry(d, &hci_dev_list, list) {
 466                 if (d->dev_type == HCI_PRIMARY &&
 467                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 468                         count++;
 469         }
 470
 471         rp_len = sizeof(*rp) + (2 * count);
 472         rp = kmalloc(rp_len, GFP_ATOMIC);
 473         if (!rp) {
 474                 read_unlock(&hci_dev_list_lock);
 475                 return -ENOMEM;
 476         }
 477
 478         count = 0;
 479         list_for_each_entry(d, &hci_dev_list, list) {
 480                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 481                     hci_dev_test_flag(d, HCI_CONFIG) ||
 482                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 483                         continue;
 484
 485                 /* Devices marked as raw-only are neither configured
 486                  * nor unconfigured controllers.
 487                  */
 488                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 489                         continue;
 490
 491                 if (d->dev_type == HCI_PRIMARY &&
 492                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 493                         rp->index[count++] = cpu_to_le16(d->id);
 494                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 495                 }
 496         }
 497
 498         rp->num_controllers = cpu_to_le16(count);
 499         rp_len = sizeof(*rp) + (2 * count);
 500
 501         read_unlock(&hci_dev_list_lock);
 502
 503         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 504                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 505
 506         kfree(rp);
 507
 508         return err;
 509 }
 510
 511 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 512                                void *data, u16 data_len)
 513 {
 514         struct mgmt_rp_read_ext_index_list *rp;
 515         struct hci_dev *d;
 516         u16 count;
 517         int err;
 518
 519         bt_dev_dbg(hdev, "sock %p", sk);
 520
 521         read_lock(&hci_dev_list_lock);
 522
 523         count = 0;
 524         list_for_each_entry(d, &hci_dev_list, list) {
 525                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 526                         count++;
 527         }
 528
 529         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 530         if (!rp) {
 531                 read_unlock(&hci_dev_list_lock);
 532                 return -ENOMEM;
 533         }
 534
 535         count = 0;
 536         list_for_each_entry(d, &hci_dev_list, list) {
 537                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 538                     hci_dev_test_flag(d, HCI_CONFIG) ||
 539                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 540                         continue;
 541
 542                 /* Devices marked as raw-only are neither configured
 543                  * nor unconfigured controllers.
 544                  */
 545                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 546                         continue;
 547
 548                 if (d->dev_type == HCI_PRIMARY) {
 549                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 550                                 rp->entry[count].type = 0x01;
 551                         else
 552                                 rp->entry[count].type = 0x00;
 553                 } else if (d->dev_type == HCI_AMP) {
 554                         rp->entry[count].type = 0x02;
 555                 } else {
 556                         continue;
 557                 }
 558
 559                 rp->entry[count].bus = d->bus;
 560                 rp->entry[count++].index = cpu_to_le16(d->id);
 561                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 562         }
 563
 564         rp->num_controllers = cpu_to_le16(count);
 565
 566         read_unlock(&hci_dev_list_lock);
 567
 568         /* If this command is called at least once, then all the
 569          * default index and unconfigured index events are disabled
 570          * and from now on only extended index events are used.
 571          */
 572         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 573         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 574         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 575
 576         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 577                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 578                                 struct_size(rp, entry, count));
 579
 580         kfree(rp);
 581
 582         return err;
 583 }
 584
 585 static bool is_configured(struct hci_dev *hdev)
 586 {
 587         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 588             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 589                 return false;
 590
 591         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 592              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 593             !bacmp(&hdev->public_addr, BDADDR_ANY))
 594                 return false;
 595
 596         return true;
 597 }
 598
 599 static __le32 get_missing_options(struct hci_dev *hdev)
 600 {
 601         u32 options = 0;
 602
 603         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 604             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 605                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 606
 607         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 608              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 609             !bacmp(&hdev->public_addr, BDADDR_ANY))
 610                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 611
 612         return cpu_to_le32(options);
 613 }
 614
 615 static int new_options(struct hci_dev *hdev, struct sock *skip)
 616 {
 617         __le32 options = get_missing_options(hdev);
 618
 619         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 620                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 621 }
 622
 623 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 624 {
 625         __le32 options = get_missing_options(hdev);
 626
 627         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 628                                  sizeof(options));
 629 }
 630
 631 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 632                             void *data, u16 data_len)
 633 {
 634         struct mgmt_rp_read_config_info rp;
 635         u32 options = 0;
 636
 637         bt_dev_dbg(hdev, "sock %p", sk);
 638
 639         hci_dev_lock(hdev);
 640
 641         memset(&rp, 0, sizeof(rp));
 642         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 643
 644         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 645                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 646
 647         if (hdev->set_bdaddr)
 648                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 649
 650         rp.supported_options = cpu_to_le32(options);
 651         rp.missing_options = get_missing_options(hdev);
 652
 653         hci_dev_unlock(hdev);
 654
 655         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 656                                  &rp, sizeof(rp));
 657 }
 658
 659 static u32 get_supported_phys(struct hci_dev *hdev)
 660 {
 661         u32 supported_phys = 0;
 662
 663         if (lmp_bredr_capable(hdev)) {
 664                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 665
 666                 if (hdev->features[0][0] & LMP_3SLOT)
 667                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 668
 669                 if (hdev->features[0][0] & LMP_5SLOT)
 670                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 671
 672                 if (lmp_edr_2m_capable(hdev)) {
 673                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 674
 675                         if (lmp_edr_3slot_capable(hdev))
 676                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 677
 678                         if (lmp_edr_5slot_capable(hdev))
 679                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 680
 681                         if (lmp_edr_3m_capable(hdev)) {
 682                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 683
 684                                 if (lmp_edr_3slot_capable(hdev))
 685                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 686
 687                                 if (lmp_edr_5slot_capable(hdev))
 688                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 689                         }
 690                 }
 691         }
 692
 693         if (lmp_le_capable(hdev)) {
 694                 supported_phys |= MGMT_PHY_LE_1M_TX;
 695                 supported_phys |= MGMT_PHY_LE_1M_RX;
 696
 697                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 698                         supported_phys |= MGMT_PHY_LE_2M_TX;
 699                         supported_phys |= MGMT_PHY_LE_2M_RX;
 700                 }
 701
 702                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 703                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 704                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 705                 }
 706         }
 707
 708         return supported_phys;
 709 }
 710
 711 static u32 get_selected_phys(struct hci_dev *hdev)
 712 {
 713         u32 selected_phys = 0;
 714
 715         if (lmp_bredr_capable(hdev)) {
 716                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 717
 718                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 719                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 720
 721                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 722                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 723
 724                 if (lmp_edr_2m_capable(hdev)) {
 725                         if (!(hdev->pkt_type & HCI_2DH1))
 726                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 727
 728                         if (lmp_edr_3slot_capable(hdev) &&
 729                             !(hdev->pkt_type & HCI_2DH3))
 730                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 731
 732                         if (lmp_edr_5slot_capable(hdev) &&
 733                             !(hdev->pkt_type & HCI_2DH5))
 734                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 735
 736                         if (lmp_edr_3m_capable(hdev)) {
 737                                 if (!(hdev->pkt_type & HCI_3DH1))
 738                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 739
 740                                 if (lmp_edr_3slot_capable(hdev) &&
 741                                     !(hdev->pkt_type & HCI_3DH3))
 742                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 743
 744                                 if (lmp_edr_5slot_capable(hdev) &&
 745                                     !(hdev->pkt_type & HCI_3DH5))
 746                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 747                         }
 748                 }
 749         }
 750
 751         if (lmp_le_capable(hdev)) {
 752                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 753                         selected_phys |= MGMT_PHY_LE_1M_TX;
 754
 755                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 756                         selected_phys |= MGMT_PHY_LE_1M_RX;
 757
 758                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 759                         selected_phys |= MGMT_PHY_LE_2M_TX;
 760
 761                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 762                         selected_phys |= MGMT_PHY_LE_2M_RX;
 763
 764                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 765                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 766
 767                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 768                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 769         }
 770
 771         return selected_phys;
 772 }
 773
 774 static u32 get_configurable_phys(struct hci_dev *hdev)
 775 {
 776         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 777                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 778 }
 779
 780 static u32 get_supported_settings(struct hci_dev *hdev)
 781 {
 782         u32 settings = 0;
 783
 784         settings |= MGMT_SETTING_POWERED;
 785         settings |= MGMT_SETTING_BONDABLE;
 786         settings |= MGMT_SETTING_DEBUG_KEYS;
 787         settings |= MGMT_SETTING_CONNECTABLE;
 788         settings |= MGMT_SETTING_DISCOVERABLE;
 789
 790         if (lmp_bredr_capable(hdev)) {
 791                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 792                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 793                 settings |= MGMT_SETTING_BREDR;
 794                 settings |= MGMT_SETTING_LINK_SECURITY;
 795
 796                 if (lmp_ssp_capable(hdev)) {
 797                         settings |= MGMT_SETTING_SSP;
 798                         if (IS_ENABLED(CONFIG_BT_HS))
 799                                 settings |= MGMT_SETTING_HS;
 800                 }
 801
 802                 if (lmp_sc_capable(hdev))
 803                         settings |= MGMT_SETTING_SECURE_CONN;
 804
 805                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 806                              &hdev->quirks))
 807                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 808         }
 809
 810         if (lmp_le_capable(hdev)) {
 811                 settings |= MGMT_SETTING_LE;
 812                 settings |= MGMT_SETTING_SECURE_CONN;
 813                 settings |= MGMT_SETTING_PRIVACY;
 814                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 815
 816                 /* When the experimental feature for LL Privacy support is
 817                  * enabled, then advertising is no longer supported.
 818                  */
 819                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 820                         settings |= MGMT_SETTING_ADVERTISING;
 821         }
 822
 823         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 824             hdev->set_bdaddr)
 825                 settings |= MGMT_SETTING_CONFIGURATION;
 826
 827         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 828
 829         return settings;
 830 }
 831
 832 static u32 get_current_settings(struct hci_dev *hdev)
 833 {
 834         u32 settings = 0;
 835
 836         if (hdev_is_powered(hdev))
 837                 settings |= MGMT_SETTING_POWERED;
 838
 839         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 840                 settings |= MGMT_SETTING_CONNECTABLE;
 841
 842         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 843                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 844
 845         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 846                 settings |= MGMT_SETTING_DISCOVERABLE;
 847
 848         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 849                 settings |= MGMT_SETTING_BONDABLE;
 850
 851         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 852                 settings |= MGMT_SETTING_BREDR;
 853
 854         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 855                 settings |= MGMT_SETTING_LE;
 856
 857         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 858                 settings |= MGMT_SETTING_LINK_SECURITY;
 859
 860         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 861                 settings |= MGMT_SETTING_SSP;
 862
 863         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 864                 settings |= MGMT_SETTING_HS;
 865
 866         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 867                 settings |= MGMT_SETTING_ADVERTISING;
 868
 869         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 870                 settings |= MGMT_SETTING_SECURE_CONN;
 871
 872         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 873                 settings |= MGMT_SETTING_DEBUG_KEYS;
 874
 875         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 876                 settings |= MGMT_SETTING_PRIVACY;
 877
 878         /* The current setting for static address has two purposes. The
 879          * first is to indicate if the static address will be used and
 880          * the second is to indicate if it is actually set.
 881          *
 882          * This means if the static address is not configured, this flag
 883          * will never be set. If the address is configured, then if the
 884          * address is actually used decides if the flag is set or not.
 885          *
 886          * For single mode LE only controllers and dual-mode controllers
 887          * with BR/EDR disabled, the existence of the static address will
 888          * be evaluated.
 889          */
 890         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 891             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 892             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 893                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 894                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 895         }
 896
 897         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 898                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 899
 900         return settings;
 901 }
 902
 903 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 904 {
 905         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 906 }
 907
 908 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 909                                                   struct hci_dev *hdev,
 910                                                   const void *data)
 911 {
 912         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 913 }
 914
 915 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 916 {
 917         struct mgmt_pending_cmd *cmd;
 918
 919         /* If there's a pending mgmt command the flags will not yet have
 920          * their final values, so check for this first.
 921          */
 922         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 923         if (cmd) {
 924                 struct mgmt_mode *cp = cmd->param;
 925                 if (cp->val == 0x01)
 926                         return LE_AD_GENERAL;
 927                 else if (cp->val == 0x02)
 928                         return LE_AD_LIMITED;
 929         } else {
 930                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 931                         return LE_AD_LIMITED;
 932                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 933                         return LE_AD_GENERAL;
 934         }
 935
 936         return 0;
 937 }
 938
 939 bool mgmt_get_connectable(struct hci_dev *hdev)
 940 {
 941         struct mgmt_pending_cmd *cmd;
 942
 943         /* If there's a pending mgmt command the flag will not yet have
 944          * it's final value, so check for this first.
 945          */
 946         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 947         if (cmd) {
 948                 struct mgmt_mode *cp = cmd->param;
 949
 950                 return cp->val;
 951         }
 952
 953         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 954 }
 955
 956 static void service_cache_off(struct work_struct *work)
 957 {
 958         struct hci_dev *hdev = container_of(work, struct hci_dev,
 959                                             service_cache.work);
 960         struct hci_request req;
 961
 962         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 963                 return;
 964
 965         hci_req_init(&req, hdev);
 966
 967         hci_dev_lock(hdev);
 968
 969         __hci_req_update_eir(&req);
 970         __hci_req_update_class(&req);
 971
 972         hci_dev_unlock(hdev);
 973
 974         hci_req_run(&req, NULL);
 975 }
 976
 977 static void rpa_expired(struct work_struct *work)
 978 {
 979         struct hci_dev *hdev = container_of(work, struct hci_dev,
 980                                             rpa_expired.work);
 981         struct hci_request req;
 982
 983         bt_dev_dbg(hdev, "");
 984
 985         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 986
 987         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 988                 return;
 989
 990         /* The generation of a new RPA and programming it into the
 991          * controller happens in the hci_req_enable_advertising()
 992          * function.
 993          */
 994         hci_req_init(&req, hdev);
 995         if (ext_adv_capable(hdev))
 996                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 997         else
 998                 __hci_req_enable_advertising(&req);
 999         hci_req_run(&req, NULL);
1000 }
1001
1002 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1003 {
1004         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1005                 return;
1006
1007         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1008         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1009
1010         /* Non-mgmt controlled devices get this bit set
1011          * implicitly so that pairing works for them, however
1012          * for mgmt we require user-space to explicitly enable
1013          * it
1014          */
1015         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1016 }
1017
1018 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1019                                 void *data, u16 data_len)
1020 {
1021         struct mgmt_rp_read_info rp;
1022
1023         bt_dev_dbg(hdev, "sock %p", sk);
1024
1025         hci_dev_lock(hdev);
1026
1027         memset(&rp, 0, sizeof(rp));
1028
1029         bacpy(&rp.bdaddr, &hdev->bdaddr);
1030
1031         rp.version = hdev->hci_ver;
1032         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1033
1034         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1035         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1036
1037         memcpy(rp.dev_class, hdev->dev_class, 3);
1038
1039         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1040         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1041
1042         hci_dev_unlock(hdev);
1043
1044         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1045                                  sizeof(rp));
1046 }
1047
1048 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1049 {
1050         u16 eir_len = 0;
1051         size_t name_len;
1052
1053         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1054                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1055                                           hdev->dev_class, 3);
1056
1057         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1058                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1059                                           hdev->appearance);
1060
1061         name_len = strlen(hdev->dev_name);
1062         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1063                                   hdev->dev_name, name_len);
1064
1065         name_len = strlen(hdev->short_name);
1066         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1067                                   hdev->short_name, name_len);
1068
1069         return eir_len;
1070 }
1071
1072 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1073                                     void *data, u16 data_len)
1074 {
1075         char buf[512];
1076         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1077         u16 eir_len;
1078
1079         bt_dev_dbg(hdev, "sock %p", sk);
1080
1081         memset(&buf, 0, sizeof(buf));
1082
1083         hci_dev_lock(hdev);
1084
1085         bacpy(&rp->bdaddr, &hdev->bdaddr);
1086
1087         rp->version = hdev->hci_ver;
1088         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1089
1090         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1091         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1092
1093
1094         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1095         rp->eir_len = cpu_to_le16(eir_len);
1096
1097         hci_dev_unlock(hdev);
1098
1099         /* If this command is called at least once, then the events
1100          * for class of device and local name changes are disabled
1101          * and only the new extended controller information event
1102          * is used.
1103          */
1104         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1105         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1106         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1107
1108         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1109                                  sizeof(*rp) + eir_len);
1110 }
1111
1112 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1113 {
1114         char buf[512];
1115         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1116         u16 eir_len;
1117
1118         memset(buf, 0, sizeof(buf));
1119
1120         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1121         ev->eir_len = cpu_to_le16(eir_len);
1122
1123         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1124                                   sizeof(*ev) + eir_len,
1125                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1126 }
1127
1128 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1129 {
1130         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1131
1132         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1133                                  sizeof(settings));
1134 }
1135
1136 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1137 {
1138         bt_dev_dbg(hdev, "status 0x%02x", status);
1139
1140         if (hci_conn_count(hdev) == 0) {
1141                 cancel_delayed_work(&hdev->power_off);
1142                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1143         }
1144 }
1145
1146 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1147 {
1148         struct mgmt_ev_advertising_added ev;
1149
1150         ev.instance = instance;
1151
1152         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1153 }
1154
1155 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1156                               u8 instance)
1157 {
1158         struct mgmt_ev_advertising_removed ev;
1159
1160         ev.instance = instance;
1161
1162         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1163 }
1164
1165 static void cancel_adv_timeout(struct hci_dev *hdev)
1166 {
1167         if (hdev->adv_instance_timeout) {
1168                 hdev->adv_instance_timeout = 0;
1169                 cancel_delayed_work(&hdev->adv_instance_expire);
1170         }
1171 }
1172
1173 static int clean_up_hci_state(struct hci_dev *hdev)
1174 {
1175         struct hci_request req;
1176         struct hci_conn *conn;
1177         bool discov_stopped;
1178         int err;
1179
1180         hci_req_init(&req, hdev);
1181
1182         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1183             test_bit(HCI_PSCAN, &hdev->flags)) {
1184                 u8 scan = 0x00;
1185                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1186         }
1187
1188         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1189
1190         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1191                 __hci_req_disable_advertising(&req);
1192
1193         discov_stopped = hci_req_stop_discovery(&req);
1194
1195         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1196                 /* 0x15 == Terminated due to Power Off */
1197                 __hci_abort_conn(&req, conn, 0x15);
1198         }
1199
1200         err = hci_req_run(&req, clean_up_hci_complete);
1201         if (!err && discov_stopped)
1202                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1203
1204         return err;
1205 }
1206
1207 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1208                        u16 len)
1209 {
1210         struct mgmt_mode *cp = data;
1211         struct mgmt_pending_cmd *cmd;
1212         int err;
1213
1214         bt_dev_dbg(hdev, "sock %p", sk);
1215
1216         if (cp->val != 0x00 && cp->val != 0x01)
1217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1218                                        MGMT_STATUS_INVALID_PARAMS);
1219
1220         hci_dev_lock(hdev);
1221
1222         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1223                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1224                                       MGMT_STATUS_BUSY);
1225                 goto failed;
1226         }
1227
1228         if (!!cp->val == hdev_is_powered(hdev)) {
1229                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1230                 goto failed;
1231         }
1232
1233         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1234         if (!cmd) {
1235                 err = -ENOMEM;
1236                 goto failed;
1237         }
1238
1239         if (cp->val) {
1240                 queue_work(hdev->req_workqueue, &hdev->power_on);
1241                 err = 0;
1242         } else {
1243                 /* Disconnect connections, stop scans, etc */
1244                 err = clean_up_hci_state(hdev);
1245                 if (!err)
1246                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1247                                            HCI_POWER_OFF_TIMEOUT);
1248
1249                 /* ENODATA means there were no HCI commands queued */
1250                 if (err == -ENODATA) {
1251                         cancel_delayed_work(&hdev->power_off);
1252                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1253                         err = 0;
1254                 }
1255         }
1256
1257 failed:
1258         hci_dev_unlock(hdev);
1259         return err;
1260 }
1261
1262 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1263 {
1264         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1265
1266         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1267                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1268 }
1269
1270 int mgmt_new_settings(struct hci_dev *hdev)
1271 {
1272         return new_settings(hdev, NULL);
1273 }
1274
1275 struct cmd_lookup {
1276         struct sock *sk;
1277         struct hci_dev *hdev;
1278         u8 mgmt_status;
1279 };
1280
1281 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1282 {
1283         struct cmd_lookup *match = data;
1284
1285         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1286
1287         list_del(&cmd->list);
1288
1289         if (match->sk == NULL) {
1290                 match->sk = cmd->sk;
1291                 sock_hold(match->sk);
1292         }
1293
1294         mgmt_pending_free(cmd);
1295 }
1296
1297 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1298 {
1299         u8 *status = data;
1300
1301         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1302         mgmt_pending_remove(cmd);
1303 }
1304
1305 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1306 {
1307         if (cmd->cmd_complete) {
1308                 u8 *status = data;
1309
1310                 cmd->cmd_complete(cmd, *status);
1311                 mgmt_pending_remove(cmd);
1312
1313                 return;
1314         }
1315
1316         cmd_status_rsp(cmd, data);
1317 }
1318
1319 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1320 {
1321         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1322                                  cmd->param, cmd->param_len);
1323 }
1324
1325 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1326 {
1327         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1328                                  cmd->param, sizeof(struct mgmt_addr_info));
1329 }
1330
1331 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1332 {
1333         if (!lmp_bredr_capable(hdev))
1334                 return MGMT_STATUS_NOT_SUPPORTED;
1335         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1336                 return MGMT_STATUS_REJECTED;
1337         else
1338                 return MGMT_STATUS_SUCCESS;
1339 }
1340
1341 static u8 mgmt_le_support(struct hci_dev *hdev)
1342 {
1343         if (!lmp_le_capable(hdev))
1344                 return MGMT_STATUS_NOT_SUPPORTED;
1345         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1346                 return MGMT_STATUS_REJECTED;
1347         else
1348                 return MGMT_STATUS_SUCCESS;
1349 }
1350
1351 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1352 {
1353         struct mgmt_pending_cmd *cmd;
1354
1355         bt_dev_dbg(hdev, "status 0x%02x", status);
1356
1357         hci_dev_lock(hdev);
1358
1359         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1360         if (!cmd)
1361                 goto unlock;
1362
1363         if (status) {
1364                 u8 mgmt_err = mgmt_status(status);
1365                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1366                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1367                 goto remove_cmd;
1368         }
1369
1370         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1371             hdev->discov_timeout > 0) {
1372                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1373                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1374         }
1375
1376         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1377         new_settings(hdev, cmd->sk);
1378
1379 remove_cmd:
1380         mgmt_pending_remove(cmd);
1381
1382 unlock:
1383         hci_dev_unlock(hdev);
1384 }
1385
1386 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1387                             u16 len)
1388 {
1389         struct mgmt_cp_set_discoverable *cp = data;
1390         struct mgmt_pending_cmd *cmd;
1391         u16 timeout;
1392         int err;
1393
1394         bt_dev_dbg(hdev, "sock %p", sk);
1395
1396         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1397             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1398                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1399                                        MGMT_STATUS_REJECTED);
1400
1401         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1402                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1403                                        MGMT_STATUS_INVALID_PARAMS);
1404
1405         timeout = __le16_to_cpu(cp->timeout);
1406
1407         /* Disabling discoverable requires that no timeout is set,
1408          * and enabling limited discoverable requires a timeout.
1409          */
1410         if ((cp->val == 0x00 && timeout > 0) ||
1411             (cp->val == 0x02 && timeout == 0))
1412                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1413                                        MGMT_STATUS_INVALID_PARAMS);
1414
1415         hci_dev_lock(hdev);
1416
1417         if (!hdev_is_powered(hdev) && timeout > 0) {
1418                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1419                                       MGMT_STATUS_NOT_POWERED);
1420                 goto failed;
1421         }
1422
1423         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1424             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1425                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1426                                       MGMT_STATUS_BUSY);
1427                 goto failed;
1428         }
1429
1430         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1431                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1432                                       MGMT_STATUS_REJECTED);
1433                 goto failed;
1434         }
1435
1436         if (hdev->advertising_paused) {
1437                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1438                                       MGMT_STATUS_BUSY);
1439                 goto failed;
1440         }
1441
1442         if (!hdev_is_powered(hdev)) {
1443                 bool changed = false;
1444
1445                 /* Setting limited discoverable when powered off is
1446                  * not a valid operation since it requires a timeout
1447                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1448                  */
1449                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1450                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1451                         changed = true;
1452                 }
1453
1454                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1455                 if (err < 0)
1456                         goto failed;
1457
1458                 if (changed)
1459                         err = new_settings(hdev, sk);
1460
1461                 goto failed;
1462         }
1463
1464         /* If the current mode is the same, then just update the timeout
1465          * value with the new value. And if only the timeout gets updated,
1466          * then no need for any HCI transactions.
1467          */
1468         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1469             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1470                                                    HCI_LIMITED_DISCOVERABLE)) {
1471                 cancel_delayed_work(&hdev->discov_off);
1472                 hdev->discov_timeout = timeout;
1473
1474                 if (cp->val && hdev->discov_timeout > 0) {
1475                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1476                         queue_delayed_work(hdev->req_workqueue,
1477                                            &hdev->discov_off, to);
1478                 }
1479
1480                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1481                 goto failed;
1482         }
1483
1484         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1485         if (!cmd) {
1486                 err = -ENOMEM;
1487                 goto failed;
1488         }
1489
1490         /* Cancel any potential discoverable timeout that might be
1491          * still active and store new timeout value. The arming of
1492          * the timeout happens in the complete handler.
1493          */
1494         cancel_delayed_work(&hdev->discov_off);
1495         hdev->discov_timeout = timeout;
1496
1497         if (cp->val)
1498                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1499         else
1500                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1501
1502         /* Limited discoverable mode */
1503         if (cp->val == 0x02)
1504                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1505         else
1506                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1507
1508         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1509         err = 0;
1510
1511 failed:
1512         hci_dev_unlock(hdev);
1513         return err;
1514 }
1515
1516 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1517 {
1518         struct mgmt_pending_cmd *cmd;
1519
1520         bt_dev_dbg(hdev, "status 0x%02x", status);
1521
1522         hci_dev_lock(hdev);
1523
1524         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1525         if (!cmd)
1526                 goto unlock;
1527
1528         if (status) {
1529                 u8 mgmt_err = mgmt_status(status);
1530                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1531                 goto remove_cmd;
1532         }
1533
1534         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1535         new_settings(hdev, cmd->sk);
1536
1537 remove_cmd:
1538         mgmt_pending_remove(cmd);
1539
1540 unlock:
1541         hci_dev_unlock(hdev);
1542 }
1543
1544 static int set_connectable_update_settings(struct hci_dev *hdev,
1545                                            struct sock *sk, u8 val)
1546 {
1547         bool changed = false;
1548         int err;
1549
1550         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1551                 changed = true;
1552
1553         if (val) {
1554                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1555         } else {
1556                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1557                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1558         }
1559
1560         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1561         if (err < 0)
1562                 return err;
1563
1564         if (changed) {
1565                 hci_req_update_scan(hdev);
1566                 hci_update_background_scan(hdev);
1567                 return new_settings(hdev, sk);
1568         }
1569
1570         return 0;
1571 }
1572
1573 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1574                            u16 len)
1575 {
1576         struct mgmt_mode *cp = data;
1577         struct mgmt_pending_cmd *cmd;
1578         int err;
1579
1580         bt_dev_dbg(hdev, "sock %p", sk);
1581
1582         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1583             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1584                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1585                                        MGMT_STATUS_REJECTED);
1586
1587         if (cp->val != 0x00 && cp->val != 0x01)
1588                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1589                                        MGMT_STATUS_INVALID_PARAMS);
1590
1591         hci_dev_lock(hdev);
1592
1593         if (!hdev_is_powered(hdev)) {
1594                 err = set_connectable_update_settings(hdev, sk, cp->val);
1595                 goto failed;
1596         }
1597
1598         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1599             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1600                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1601                                       MGMT_STATUS_BUSY);
1602                 goto failed;
1603         }
1604
1605         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1606         if (!cmd) {
1607                 err = -ENOMEM;
1608                 goto failed;
1609         }
1610
1611         if (cp->val) {
1612                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1613         } else {
1614                 if (hdev->discov_timeout > 0)
1615                         cancel_delayed_work(&hdev->discov_off);
1616
1617                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1618                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1619                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1620         }
1621
1622         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1623         err = 0;
1624
1625 failed:
1626         hci_dev_unlock(hdev);
1627         return err;
1628 }
1629
1630 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1631                         u16 len)
1632 {
1633         struct mgmt_mode *cp = data;
1634         bool changed;
1635         int err;
1636
1637         bt_dev_dbg(hdev, "sock %p", sk);
1638
1639         if (cp->val != 0x00 && cp->val != 0x01)
1640                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1641                                        MGMT_STATUS_INVALID_PARAMS);
1642
1643         hci_dev_lock(hdev);
1644
1645         if (cp->val)
1646                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1647         else
1648                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1649
1650         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1651         if (err < 0)
1652                 goto unlock;
1653
1654         if (changed) {
1655                 /* In limited privacy mode the change of bondable mode
1656                  * may affect the local advertising address.
1657                  */
1658                 if (hdev_is_powered(hdev) &&
1659                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1660                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1661                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1662                         queue_work(hdev->req_workqueue,
1663                                    &hdev->discoverable_update);
1664
1665                 err = new_settings(hdev, sk);
1666         }
1667
1668 unlock:
1669         hci_dev_unlock(hdev);
1670         return err;
1671 }
1672
1673 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1674                              u16 len)
1675 {
1676         struct mgmt_mode *cp = data;
1677         struct mgmt_pending_cmd *cmd;
1678         u8 val, status;
1679         int err;
1680
1681         bt_dev_dbg(hdev, "sock %p", sk);
1682
1683         status = mgmt_bredr_support(hdev);
1684         if (status)
1685                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1686                                        status);
1687
1688         if (cp->val != 0x00 && cp->val != 0x01)
1689                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1690                                        MGMT_STATUS_INVALID_PARAMS);
1691
1692         hci_dev_lock(hdev);
1693
1694         if (!hdev_is_powered(hdev)) {
1695                 bool changed = false;
1696
1697                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1698                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1699                         changed = true;
1700                 }
1701
1702                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1703                 if (err < 0)
1704                         goto failed;
1705
1706                 if (changed)
1707                         err = new_settings(hdev, sk);
1708
1709                 goto failed;
1710         }
1711
1712         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1713                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1714                                       MGMT_STATUS_BUSY);
1715                 goto failed;
1716         }
1717
1718         val = !!cp->val;
1719
1720         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1721                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1722                 goto failed;
1723         }
1724
1725         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1726         if (!cmd) {
1727                 err = -ENOMEM;
1728                 goto failed;
1729         }
1730
1731         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1732         if (err < 0) {
1733                 mgmt_pending_remove(cmd);
1734                 goto failed;
1735         }
1736
1737 failed:
1738         hci_dev_unlock(hdev);
1739         return err;
1740 }
1741
1742 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1743 {
1744         struct mgmt_mode *cp = data;
1745         struct mgmt_pending_cmd *cmd;
1746         u8 status;
1747         int err;
1748
1749         bt_dev_dbg(hdev, "sock %p", sk);
1750
1751         status = mgmt_bredr_support(hdev);
1752         if (status)
1753                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1754
1755         if (!lmp_ssp_capable(hdev))
1756                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1757                                        MGMT_STATUS_NOT_SUPPORTED);
1758
1759         if (cp->val != 0x00 && cp->val != 0x01)
1760                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1761                                        MGMT_STATUS_INVALID_PARAMS);
1762
1763         hci_dev_lock(hdev);
1764
1765         if (!hdev_is_powered(hdev)) {
1766                 bool changed;
1767
1768                 if (cp->val) {
1769                         changed = !hci_dev_test_and_set_flag(hdev,
1770                                                              HCI_SSP_ENABLED);
1771                 } else {
1772                         changed = hci_dev_test_and_clear_flag(hdev,
1773                                                               HCI_SSP_ENABLED);
1774                         if (!changed)
1775                                 changed = hci_dev_test_and_clear_flag(hdev,
1776                                                                       HCI_HS_ENABLED);
1777                         else
1778                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1779                 }
1780
1781                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1782                 if (err < 0)
1783                         goto failed;
1784
1785                 if (changed)
1786                         err = new_settings(hdev, sk);
1787
1788                 goto failed;
1789         }
1790
1791         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1792                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1793                                       MGMT_STATUS_BUSY);
1794                 goto failed;
1795         }
1796
1797         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1798                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1799                 goto failed;
1800         }
1801
1802         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1803         if (!cmd) {
1804                 err = -ENOMEM;
1805                 goto failed;
1806         }
1807
1808         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1809                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1810                              sizeof(cp->val), &cp->val);
1811
1812         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1813         if (err < 0) {
1814                 mgmt_pending_remove(cmd);
1815                 goto failed;
1816         }
1817
1818 failed:
1819         hci_dev_unlock(hdev);
1820         return err;
1821 }
1822
1823 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1824 {
1825         struct mgmt_mode *cp = data;
1826         bool changed;
1827         u8 status;
1828         int err;
1829
1830         bt_dev_dbg(hdev, "sock %p", sk);
1831
1832         if (!IS_ENABLED(CONFIG_BT_HS))
1833                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1834                                        MGMT_STATUS_NOT_SUPPORTED);
1835
1836         status = mgmt_bredr_support(hdev);
1837         if (status)
1838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1839
1840         if (!lmp_ssp_capable(hdev))
1841                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1842                                        MGMT_STATUS_NOT_SUPPORTED);
1843
1844         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1845                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1846                                        MGMT_STATUS_REJECTED);
1847
1848         if (cp->val != 0x00 && cp->val != 0x01)
1849                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1850                                        MGMT_STATUS_INVALID_PARAMS);
1851
1852         hci_dev_lock(hdev);
1853
1854         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1855                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1856                                       MGMT_STATUS_BUSY);
1857                 goto unlock;
1858         }
1859
1860         if (cp->val) {
1861                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1862         } else {
1863                 if (hdev_is_powered(hdev)) {
1864                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1865                                               MGMT_STATUS_REJECTED);
1866                         goto unlock;
1867                 }
1868
1869                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1870         }
1871
1872         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1873         if (err < 0)
1874                 goto unlock;
1875
1876         if (changed)
1877                 err = new_settings(hdev, sk);
1878
1879 unlock:
1880         hci_dev_unlock(hdev);
1881         return err;
1882 }
1883
1884 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1885 {
1886         struct cmd_lookup match = { NULL, hdev };
1887
1888         hci_dev_lock(hdev);
1889
1890         if (status) {
1891                 u8 mgmt_err = mgmt_status(status);
1892
1893                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1894                                      &mgmt_err);
1895                 goto unlock;
1896         }
1897
1898         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1899
1900         new_settings(hdev, match.sk);
1901
1902         if (match.sk)
1903                 sock_put(match.sk);
1904
1905         /* Make sure the controller has a good default for
1906          * advertising data. Restrict the update to when LE
1907          * has actually been enabled. During power on, the
1908          * update in powered_update_hci will take care of it.
1909          */
1910         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1911                 struct hci_request req;
1912                 hci_req_init(&req, hdev);
1913                 if (ext_adv_capable(hdev)) {
1914                         int err;
1915
1916                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1917                         if (!err)
1918                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1919                 } else {
1920                         __hci_req_update_adv_data(&req, 0x00);
1921                         __hci_req_update_scan_rsp_data(&req, 0x00);
1922                 }
1923                 hci_req_run(&req, NULL);
1924                 hci_update_background_scan(hdev);
1925         }
1926
1927 unlock:
1928         hci_dev_unlock(hdev);
1929 }
1930
1931 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1932 {
1933         struct mgmt_mode *cp = data;
1934         struct hci_cp_write_le_host_supported hci_cp;
1935         struct mgmt_pending_cmd *cmd;
1936         struct hci_request req;
1937         int err;
1938         u8 val, enabled;
1939
1940         bt_dev_dbg(hdev, "sock %p", sk);
1941
1942         if (!lmp_le_capable(hdev))
1943                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1944                                        MGMT_STATUS_NOT_SUPPORTED);
1945
1946         if (cp->val != 0x00 && cp->val != 0x01)
1947                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1948                                        MGMT_STATUS_INVALID_PARAMS);
1949
1950         /* Bluetooth single mode LE only controllers or dual-mode
1951          * controllers configured as LE only devices, do not allow
1952          * switching LE off. These have either LE enabled explicitly
1953          * or BR/EDR has been previously switched off.
1954          *
1955          * When trying to enable an already enabled LE, then gracefully
1956          * send a positive response. Trying to disable it however will
1957          * result into rejection.
1958          */
1959         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1960                 if (cp->val == 0x01)
1961                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1962
1963                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1964                                        MGMT_STATUS_REJECTED);
1965         }
1966
1967         hci_dev_lock(hdev);
1968
1969         val = !!cp->val;
1970         enabled = lmp_host_le_capable(hdev);
1971
1972         if (!val)
1973                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1974
1975         if (!hdev_is_powered(hdev) || val == enabled) {
1976                 bool changed = false;
1977
1978                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1979                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1980                         changed = true;
1981                 }
1982
1983                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1984                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1985                         changed = true;
1986                 }
1987
1988                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1989                 if (err < 0)
1990                         goto unlock;
1991
1992                 if (changed)
1993                         err = new_settings(hdev, sk);
1994
1995                 goto unlock;
1996         }
1997
1998         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1999             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2000                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2001                                       MGMT_STATUS_BUSY);
2002                 goto unlock;
2003         }
2004
2005         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2006         if (!cmd) {
2007                 err = -ENOMEM;
2008                 goto unlock;
2009         }
2010
2011         hci_req_init(&req, hdev);
2012
2013         memset(&hci_cp, 0, sizeof(hci_cp));
2014
2015         if (val) {
2016                 hci_cp.le = val;
2017                 hci_cp.simul = 0x00;
2018         } else {
2019                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2020                         __hci_req_disable_advertising(&req);
2021
2022                 if (ext_adv_capable(hdev))
2023                         __hci_req_clear_ext_adv_sets(&req);
2024         }
2025
2026         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2027                     &hci_cp);
2028
2029         err = hci_req_run(&req, le_enable_complete);
2030         if (err < 0)
2031                 mgmt_pending_remove(cmd);
2032
2033 unlock:
2034         hci_dev_unlock(hdev);
2035         return err;
2036 }
2037
2038 /* This is a helper function to test for pending mgmt commands that can
2039  * cause CoD or EIR HCI commands. We can only allow one such pending
2040  * mgmt command at a time since otherwise we cannot easily track what
2041  * the current values are, will be, and based on that calculate if a new
2042  * HCI command needs to be sent and if yes with what value.
2043  */
2044 static bool pending_eir_or_class(struct hci_dev *hdev)
2045 {
2046         struct mgmt_pending_cmd *cmd;
2047
2048         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2049                 switch (cmd->opcode) {
2050                 case MGMT_OP_ADD_UUID:
2051                 case MGMT_OP_REMOVE_UUID:
2052                 case MGMT_OP_SET_DEV_CLASS:
2053                 case MGMT_OP_SET_POWERED:
2054                         return true;
2055                 }
2056         }
2057
2058         return false;
2059 }
2060
2061 static const u8 bluetooth_base_uuid[] = {
2062                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2063                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2064 };
2065
2066 static u8 get_uuid_size(const u8 *uuid)
2067 {
2068         u32 val;
2069
2070         if (memcmp(uuid, bluetooth_base_uuid, 12))
2071                 return 128;
2072
2073         val = get_unaligned_le32(&uuid[12]);
2074         if (val > 0xffff)
2075                 return 32;
2076
2077         return 16;
2078 }
2079
2080 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2081 {
2082         struct mgmt_pending_cmd *cmd;
2083
2084         hci_dev_lock(hdev);
2085
2086         cmd = pending_find(mgmt_op, hdev);
2087         if (!cmd)
2088                 goto unlock;
2089
2090         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2091                           mgmt_status(status), hdev->dev_class, 3);
2092
2093         mgmt_pending_remove(cmd);
2094
2095 unlock:
2096         hci_dev_unlock(hdev);
2097 }
2098
2099 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2100 {
2101         bt_dev_dbg(hdev, "status 0x%02x", status);
2102
2103         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2104 }
2105
2106 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2107 {
2108         struct mgmt_cp_add_uuid *cp = data;
2109         struct mgmt_pending_cmd *cmd;
2110         struct hci_request req;
2111         struct bt_uuid *uuid;
2112         int err;
2113
2114         bt_dev_dbg(hdev, "sock %p", sk);
2115
2116         hci_dev_lock(hdev);
2117
2118         if (pending_eir_or_class(hdev)) {
2119                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2120                                       MGMT_STATUS_BUSY);
2121                 goto failed;
2122         }
2123
2124         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2125         if (!uuid) {
2126                 err = -ENOMEM;
2127                 goto failed;
2128         }
2129
2130         memcpy(uuid->uuid, cp->uuid, 16);
2131         uuid->svc_hint = cp->svc_hint;
2132         uuid->size = get_uuid_size(cp->uuid);
2133
2134         list_add_tail(&uuid->list, &hdev->uuids);
2135
2136         hci_req_init(&req, hdev);
2137
2138         __hci_req_update_class(&req);
2139         __hci_req_update_eir(&req);
2140
2141         err = hci_req_run(&req, add_uuid_complete);
2142         if (err < 0) {
2143                 if (err != -ENODATA)
2144                         goto failed;
2145
2146                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2147                                         hdev->dev_class, 3);
2148                 goto failed;
2149         }
2150
2151         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2152         if (!cmd) {
2153                 err = -ENOMEM;
2154                 goto failed;
2155         }
2156
2157         err = 0;
2158
2159 failed:
2160         hci_dev_unlock(hdev);
2161         return err;
2162 }
2163
2164 static bool enable_service_cache(struct hci_dev *hdev)
2165 {
2166         if (!hdev_is_powered(hdev))
2167                 return false;
2168
2169         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2170                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2171                                    CACHE_TIMEOUT);
2172                 return true;
2173         }
2174
2175         return false;
2176 }
2177
2178 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2179 {
2180         bt_dev_dbg(hdev, "status 0x%02x", status);
2181
2182         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2183 }
2184
2185 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2186                        u16 len)
2187 {
2188         struct mgmt_cp_remove_uuid *cp = data;
2189         struct mgmt_pending_cmd *cmd;
2190         struct bt_uuid *match, *tmp;
2191         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2192         struct hci_request req;
2193         int err, found;
2194
2195         bt_dev_dbg(hdev, "sock %p", sk);
2196
2197         hci_dev_lock(hdev);
2198
2199         if (pending_eir_or_class(hdev)) {
2200                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2201                                       MGMT_STATUS_BUSY);
2202                 goto unlock;
2203         }
2204
2205         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2206                 hci_uuids_clear(hdev);
2207
2208                 if (enable_service_cache(hdev)) {
2209                         err = mgmt_cmd_complete(sk, hdev->id,
2210                                                 MGMT_OP_REMOVE_UUID,
2211                                                 0, hdev->dev_class, 3);
2212                         goto unlock;
2213                 }
2214
2215                 goto update_class;
2216         }
2217
2218         found = 0;
2219
2220         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2221                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2222                         continue;
2223
2224                 list_del(&match->list);
2225                 kfree(match);
2226                 found++;
2227         }
2228
2229         if (found == 0) {
2230                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2231                                       MGMT_STATUS_INVALID_PARAMS);
2232                 goto unlock;
2233         }
2234
2235 update_class:
2236         hci_req_init(&req, hdev);
2237
2238         __hci_req_update_class(&req);
2239         __hci_req_update_eir(&req);
2240
2241         err = hci_req_run(&req, remove_uuid_complete);
2242         if (err < 0) {
2243                 if (err != -ENODATA)
2244                         goto unlock;
2245
2246                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2247                                         hdev->dev_class, 3);
2248                 goto unlock;
2249         }
2250
2251         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2252         if (!cmd) {
2253                 err = -ENOMEM;
2254                 goto unlock;
2255         }
2256
2257         err = 0;
2258
2259 unlock:
2260         hci_dev_unlock(hdev);
2261         return err;
2262 }
2263
2264 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2265 {
2266         bt_dev_dbg(hdev, "status 0x%02x", status);
2267
2268         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2269 }
2270
2271 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2272                          u16 len)
2273 {
2274         struct mgmt_cp_set_dev_class *cp = data;
2275         struct mgmt_pending_cmd *cmd;
2276         struct hci_request req;
2277         int err;
2278
2279         bt_dev_dbg(hdev, "sock %p", sk);
2280
2281         if (!lmp_bredr_capable(hdev))
2282                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2283                                        MGMT_STATUS_NOT_SUPPORTED);
2284
2285         hci_dev_lock(hdev);
2286
2287         if (pending_eir_or_class(hdev)) {
2288                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2289                                       MGMT_STATUS_BUSY);
2290                 goto unlock;
2291         }
2292
2293         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2294                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2295                                       MGMT_STATUS_INVALID_PARAMS);
2296                 goto unlock;
2297         }
2298
2299         hdev->major_class = cp->major;
2300         hdev->minor_class = cp->minor;
2301
2302         if (!hdev_is_powered(hdev)) {
2303                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2304                                         hdev->dev_class, 3);
2305                 goto unlock;
2306         }
2307
2308         hci_req_init(&req, hdev);
2309
2310         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2311                 hci_dev_unlock(hdev);
2312                 cancel_delayed_work_sync(&hdev->service_cache);
2313                 hci_dev_lock(hdev);
2314                 __hci_req_update_eir(&req);
2315         }
2316
2317         __hci_req_update_class(&req);
2318
2319         err = hci_req_run(&req, set_class_complete);
2320         if (err < 0) {
2321                 if (err != -ENODATA)
2322                         goto unlock;
2323
2324                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2325                                         hdev->dev_class, 3);
2326                 goto unlock;
2327         }
2328
2329         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2330         if (!cmd) {
2331                 err = -ENOMEM;
2332                 goto unlock;
2333         }
2334
2335         err = 0;
2336
2337 unlock:
2338         hci_dev_unlock(hdev);
2339         return err;
2340 }
2341
2342 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2343                           u16 len)
2344 {
2345         struct mgmt_cp_load_link_keys *cp = data;
2346         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2347                                    sizeof(struct mgmt_link_key_info));
2348         u16 key_count, expected_len;
2349         bool changed;
2350         int i;
2351
2352         bt_dev_dbg(hdev, "sock %p", sk);
2353
2354         if (!lmp_bredr_capable(hdev))
2355                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2356                                        MGMT_STATUS_NOT_SUPPORTED);
2357
2358         key_count = __le16_to_cpu(cp->key_count);
2359         if (key_count > max_key_count) {
2360                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2361                            key_count);
2362                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2363                                        MGMT_STATUS_INVALID_PARAMS);
2364         }
2365
2366         expected_len = struct_size(cp, keys, key_count);
2367         if (expected_len != len) {
2368                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2369                            expected_len, len);
2370                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2371                                        MGMT_STATUS_INVALID_PARAMS);
2372         }
2373
2374         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2375                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2376                                        MGMT_STATUS_INVALID_PARAMS);
2377
2378         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2379                    key_count);
2380
2381         for (i = 0; i < key_count; i++) {
2382                 struct mgmt_link_key_info *key = &cp->keys[i];
2383
2384                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2385                         return mgmt_cmd_status(sk, hdev->id,
2386                                                MGMT_OP_LOAD_LINK_KEYS,
2387                                                MGMT_STATUS_INVALID_PARAMS);
2388         }
2389
2390         hci_dev_lock(hdev);
2391
2392         hci_link_keys_clear(hdev);
2393
2394         if (cp->debug_keys)
2395                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2396         else
2397                 changed = hci_dev_test_and_clear_flag(hdev,
2398                                                       HCI_KEEP_DEBUG_KEYS);
2399
2400         if (changed)
2401                 new_settings(hdev, NULL);
2402
2403         for (i = 0; i < key_count; i++) {
2404                 struct mgmt_link_key_info *key = &cp->keys[i];
2405
2406                 if (hci_is_blocked_key(hdev,
2407                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2408                                        key->val)) {
2409                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2410                                     &key->addr.bdaddr);
2411                         continue;
2412                 }
2413
2414                 /* Always ignore debug keys and require a new pairing if
2415                  * the user wants to use them.
2416                  */
2417                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2418                         continue;
2419
2420                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2421                                  key->type, key->pin_len, NULL);
2422         }
2423
2424         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2425
2426         hci_dev_unlock(hdev);
2427
2428         return 0;
2429 }
2430
2431 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2432                            u8 addr_type, struct sock *skip_sk)
2433 {
2434         struct mgmt_ev_device_unpaired ev;
2435
2436         bacpy(&ev.addr.bdaddr, bdaddr);
2437         ev.addr.type = addr_type;
2438
2439         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2440                           skip_sk);
2441 }
2442
2443 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2444                          u16 len)
2445 {
2446         struct mgmt_cp_unpair_device *cp = data;
2447         struct mgmt_rp_unpair_device rp;
2448         struct hci_conn_params *params;
2449         struct mgmt_pending_cmd *cmd;
2450         struct hci_conn *conn;
2451         u8 addr_type;
2452         int err;
2453
2454         memset(&rp, 0, sizeof(rp));
2455         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2456         rp.addr.type = cp->addr.type;
2457
2458         if (!bdaddr_type_is_valid(cp->addr.type))
2459                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2460                                          MGMT_STATUS_INVALID_PARAMS,
2461                                          &rp, sizeof(rp));
2462
2463         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2464                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2465                                          MGMT_STATUS_INVALID_PARAMS,
2466                                          &rp, sizeof(rp));
2467
2468         hci_dev_lock(hdev);
2469
2470         if (!hdev_is_powered(hdev)) {
2471                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2472                                         MGMT_STATUS_NOT_POWERED, &rp,
2473                                         sizeof(rp));
2474                 goto unlock;
2475         }
2476
2477         if (cp->addr.type == BDADDR_BREDR) {
2478                 /* If disconnection is requested, then look up the
2479                  * connection. If the remote device is connected, it
2480                  * will be later used to terminate the link.
2481                  *
2482                  * Setting it to NULL explicitly will cause no
2483                  * termination of the link.
2484                  */
2485                 if (cp->disconnect)
2486                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2487                                                        &cp->addr.bdaddr);
2488                 else
2489                         conn = NULL;
2490
2491                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2492                 if (err < 0) {
2493                         err = mgmt_cmd_complete(sk, hdev->id,
2494                                                 MGMT_OP_UNPAIR_DEVICE,
2495                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2496                                                 sizeof(rp));
2497                         goto unlock;
2498                 }
2499
2500                 goto done;
2501         }
2502
2503         /* LE address type */
2504         addr_type = le_addr_type(cp->addr.type);
2505
2506         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2507         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2508         if (err < 0) {
2509                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2510                                         MGMT_STATUS_NOT_PAIRED, &rp,
2511                                         sizeof(rp));
2512                 goto unlock;
2513         }
2514
2515         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2516         if (!conn) {
2517                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2518                 goto done;
2519         }
2520
2521
2522         /* Defer clearing up the connection parameters until closing to
2523          * give a chance of keeping them if a repairing happens.
2524          */
2525         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2526
2527         /* Disable auto-connection parameters if present */
2528         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2529         if (params) {
2530                 if (params->explicit_connect)
2531                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2532                 else
2533                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2534         }
2535
2536         /* If disconnection is not requested, then clear the connection
2537          * variable so that the link is not terminated.
2538          */
2539         if (!cp->disconnect)
2540                 conn = NULL;
2541
2542 done:
2543         /* If the connection variable is set, then termination of the
2544          * link is requested.
2545          */
2546         if (!conn) {
2547                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2548                                         &rp, sizeof(rp));
2549                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2550                 goto unlock;
2551         }
2552
2553         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2554                                sizeof(*cp));
2555         if (!cmd) {
2556                 err = -ENOMEM;
2557                 goto unlock;
2558         }
2559
2560         cmd->cmd_complete = addr_cmd_complete;
2561
2562         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2563         if (err < 0)
2564                 mgmt_pending_remove(cmd);
2565
2566 unlock:
2567         hci_dev_unlock(hdev);
2568         return err;
2569 }
2570
2571 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2572                       u16 len)
2573 {
2574         struct mgmt_cp_disconnect *cp = data;
2575         struct mgmt_rp_disconnect rp;
2576         struct mgmt_pending_cmd *cmd;
2577         struct hci_conn *conn;
2578         int err;
2579
2580         bt_dev_dbg(hdev, "sock %p", sk);
2581
2582         memset(&rp, 0, sizeof(rp));
2583         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2584         rp.addr.type = cp->addr.type;
2585
2586         if (!bdaddr_type_is_valid(cp->addr.type))
2587                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2588                                          MGMT_STATUS_INVALID_PARAMS,
2589                                          &rp, sizeof(rp));
2590
2591         hci_dev_lock(hdev);
2592
2593         if (!test_bit(HCI_UP, &hdev->flags)) {
2594                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2595                                         MGMT_STATUS_NOT_POWERED, &rp,
2596                                         sizeof(rp));
2597                 goto failed;
2598         }
2599
2600         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2601                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2602                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2603                 goto failed;
2604         }
2605
2606         if (cp->addr.type == BDADDR_BREDR)
2607                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2608                                                &cp->addr.bdaddr);
2609         else
2610                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2611                                                le_addr_type(cp->addr.type));
2612
2613         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2614                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2615                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2616                                         sizeof(rp));
2617                 goto failed;
2618         }
2619
2620         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2621         if (!cmd) {
2622                 err = -ENOMEM;
2623                 goto failed;
2624         }
2625
2626         cmd->cmd_complete = generic_cmd_complete;
2627
2628         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2629         if (err < 0)
2630                 mgmt_pending_remove(cmd);
2631
2632 failed:
2633         hci_dev_unlock(hdev);
2634         return err;
2635 }
2636
2637 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2638 {
2639         switch (link_type) {
2640         case LE_LINK:
2641                 switch (addr_type) {
2642                 case ADDR_LE_DEV_PUBLIC:
2643                         return BDADDR_LE_PUBLIC;
2644
2645                 default:
2646                         /* Fallback to LE Random address type */
2647                         return BDADDR_LE_RANDOM;
2648                 }
2649
2650         default:
2651                 /* Fallback to BR/EDR type */
2652                 return BDADDR_BREDR;
2653         }
2654 }
2655
2656 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2657                            u16 data_len)
2658 {
2659         struct mgmt_rp_get_connections *rp;
2660         struct hci_conn *c;
2661         int err;
2662         u16 i;
2663
2664         bt_dev_dbg(hdev, "sock %p", sk);
2665
2666         hci_dev_lock(hdev);
2667
2668         if (!hdev_is_powered(hdev)) {
2669                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2670                                       MGMT_STATUS_NOT_POWERED);
2671                 goto unlock;
2672         }
2673
2674         i = 0;
2675         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2676                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2677                         i++;
2678         }
2679
2680         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2681         if (!rp) {
2682                 err = -ENOMEM;
2683                 goto unlock;
2684         }
2685
2686         i = 0;
2687         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2688                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2689                         continue;
2690                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2691                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2692                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2693                         continue;
2694                 i++;
2695         }
2696
2697         rp->conn_count = cpu_to_le16(i);
2698
2699         /* Recalculate length in case of filtered SCO connections, etc */
2700         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2701                                 struct_size(rp, addr, i));
2702
2703         kfree(rp);
2704
2705 unlock:
2706         hci_dev_unlock(hdev);
2707         return err;
2708 }
2709
2710 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2711                                    struct mgmt_cp_pin_code_neg_reply *cp)
2712 {
2713         struct mgmt_pending_cmd *cmd;
2714         int err;
2715
2716         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2717                                sizeof(*cp));
2718         if (!cmd)
2719                 return -ENOMEM;
2720
2721         cmd->cmd_complete = addr_cmd_complete;
2722
2723         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2724                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2725         if (err < 0)
2726                 mgmt_pending_remove(cmd);
2727
2728         return err;
2729 }
2730
2731 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2732                           u16 len)
2733 {
2734         struct hci_conn *conn;
2735         struct mgmt_cp_pin_code_reply *cp = data;
2736         struct hci_cp_pin_code_reply reply;
2737         struct mgmt_pending_cmd *cmd;
2738         int err;
2739
2740         bt_dev_dbg(hdev, "sock %p", sk);
2741
2742         hci_dev_lock(hdev);
2743
2744         if (!hdev_is_powered(hdev)) {
2745                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2746                                       MGMT_STATUS_NOT_POWERED);
2747                 goto failed;
2748         }
2749
2750         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2751         if (!conn) {
2752                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2753                                       MGMT_STATUS_NOT_CONNECTED);
2754                 goto failed;
2755         }
2756
2757         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2758                 struct mgmt_cp_pin_code_neg_reply ncp;
2759
2760                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2761
2762                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2763
2764                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2765                 if (err >= 0)
2766                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2767                                               MGMT_STATUS_INVALID_PARAMS);
2768
2769                 goto failed;
2770         }
2771
2772         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2773         if (!cmd) {
2774                 err = -ENOMEM;
2775                 goto failed;
2776         }
2777
2778         cmd->cmd_complete = addr_cmd_complete;
2779
2780         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2781         reply.pin_len = cp->pin_len;
2782         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2783
2784         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2785         if (err < 0)
2786                 mgmt_pending_remove(cmd);
2787
2788 failed:
2789         hci_dev_unlock(hdev);
2790         return err;
2791 }
2792
2793 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2794                              u16 len)
2795 {
2796         struct mgmt_cp_set_io_capability *cp = data;
2797
2798         bt_dev_dbg(hdev, "sock %p", sk);
2799
2800         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2801                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2802                                        MGMT_STATUS_INVALID_PARAMS);
2803
2804         hci_dev_lock(hdev);
2805
2806         hdev->io_capability = cp->io_capability;
2807
2808         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2809
2810         hci_dev_unlock(hdev);
2811
2812         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2813                                  NULL, 0);
2814 }
2815
2816 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2817 {
2818         struct hci_dev *hdev = conn->hdev;
2819         struct mgmt_pending_cmd *cmd;
2820
2821         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2822                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2823                         continue;
2824
2825                 if (cmd->user_data != conn)
2826                         continue;
2827
2828                 return cmd;
2829         }
2830
2831         return NULL;
2832 }
2833
2834 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2835 {
2836         struct mgmt_rp_pair_device rp;
2837         struct hci_conn *conn = cmd->user_data;
2838         int err;
2839
2840         bacpy(&rp.addr.bdaddr, &conn->dst);
2841         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2842
2843         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2844                                 status, &rp, sizeof(rp));
2845
2846         /* So we don't get further callbacks for this connection */
2847         conn->connect_cfm_cb = NULL;
2848         conn->security_cfm_cb = NULL;
2849         conn->disconn_cfm_cb = NULL;
2850
2851         hci_conn_drop(conn);
2852
2853         /* The device is paired so there is no need to remove
2854          * its connection parameters anymore.
2855          */
2856         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2857
2858         hci_conn_put(conn);
2859
2860         return err;
2861 }
2862
2863 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2864 {
2865         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2866         struct mgmt_pending_cmd *cmd;
2867
2868         cmd = find_pairing(conn);
2869         if (cmd) {
2870                 cmd->cmd_complete(cmd, status);
2871                 mgmt_pending_remove(cmd);
2872         }
2873 }
2874
2875 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2876 {
2877         struct mgmt_pending_cmd *cmd;
2878
2879         BT_DBG("status %u", status);
2880
2881         cmd = find_pairing(conn);
2882         if (!cmd) {
2883                 BT_DBG("Unable to find a pending command");
2884                 return;
2885         }
2886
2887         cmd->cmd_complete(cmd, mgmt_status(status));
2888         mgmt_pending_remove(cmd);
2889 }
2890
2891 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2892 {
2893         struct mgmt_pending_cmd *cmd;
2894
2895         BT_DBG("status %u", status);
2896
2897         if (!status)
2898                 return;
2899
2900         cmd = find_pairing(conn);
2901         if (!cmd) {
2902                 BT_DBG("Unable to find a pending command");
2903                 return;
2904         }
2905
2906         cmd->cmd_complete(cmd, mgmt_status(status));
2907         mgmt_pending_remove(cmd);
2908 }
2909
2910 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2911                        u16 len)
2912 {
2913         struct mgmt_cp_pair_device *cp = data;
2914         struct mgmt_rp_pair_device rp;
2915         struct mgmt_pending_cmd *cmd;
2916         u8 sec_level, auth_type;
2917         struct hci_conn *conn;
2918         int err;
2919
2920         bt_dev_dbg(hdev, "sock %p", sk);
2921
2922         memset(&rp, 0, sizeof(rp));
2923         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2924         rp.addr.type = cp->addr.type;
2925
2926         if (!bdaddr_type_is_valid(cp->addr.type))
2927                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2928                                          MGMT_STATUS_INVALID_PARAMS,
2929                                          &rp, sizeof(rp));
2930
2931         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2932                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2933                                          MGMT_STATUS_INVALID_PARAMS,
2934                                          &rp, sizeof(rp));
2935
2936         hci_dev_lock(hdev);
2937
2938         if (!hdev_is_powered(hdev)) {
2939                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2940                                         MGMT_STATUS_NOT_POWERED, &rp,
2941                                         sizeof(rp));
2942                 goto unlock;
2943         }
2944
2945         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2946                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2947                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2948                                         sizeof(rp));
2949                 goto unlock;
2950         }
2951
2952         sec_level = BT_SECURITY_MEDIUM;
2953         auth_type = HCI_AT_DEDICATED_BONDING;
2954
2955         if (cp->addr.type == BDADDR_BREDR) {
2956                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2957                                        auth_type, CONN_REASON_PAIR_DEVICE);
2958         } else {
2959                 u8 addr_type = le_addr_type(cp->addr.type);
2960                 struct hci_conn_params *p;
2961
2962                 /* When pairing a new device, it is expected to remember
2963                  * this device for future connections. Adding the connection
2964                  * parameter information ahead of time allows tracking
2965                  * of the peripheral preferred values and will speed up any
2966                  * further connection establishment.
2967                  *
2968                  * If connection parameters already exist, then they
2969                  * will be kept and this function does nothing.
2970                  */
2971                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2972
2973                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2974                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2975
2976                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2977                                            sec_level, HCI_LE_CONN_TIMEOUT,
2978                                            CONN_REASON_PAIR_DEVICE);
2979         }
2980
2981         if (IS_ERR(conn)) {
2982                 int status;
2983
2984                 if (PTR_ERR(conn) == -EBUSY)
2985                         status = MGMT_STATUS_BUSY;
2986                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2987                         status = MGMT_STATUS_NOT_SUPPORTED;
2988                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2989                         status = MGMT_STATUS_REJECTED;
2990                 else
2991                         status = MGMT_STATUS_CONNECT_FAILED;
2992
2993                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2994                                         status, &rp, sizeof(rp));
2995                 goto unlock;
2996         }
2997
2998         if (conn->connect_cfm_cb) {
2999                 hci_conn_drop(conn);
3000                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3001                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3002                 goto unlock;
3003         }
3004
3005         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3006         if (!cmd) {
3007                 err = -ENOMEM;
3008                 hci_conn_drop(conn);
3009                 goto unlock;
3010         }
3011
3012         cmd->cmd_complete = pairing_complete;
3013
3014         /* For LE, just connecting isn't a proof that the pairing finished */
3015         if (cp->addr.type == BDADDR_BREDR) {
3016                 conn->connect_cfm_cb = pairing_complete_cb;
3017                 conn->security_cfm_cb = pairing_complete_cb;
3018                 conn->disconn_cfm_cb = pairing_complete_cb;
3019         } else {
3020                 conn->connect_cfm_cb = le_pairing_complete_cb;
3021                 conn->security_cfm_cb = le_pairing_complete_cb;
3022                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3023         }
3024
3025         conn->io_capability = cp->io_cap;
3026         cmd->user_data = hci_conn_get(conn);
3027
3028         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3029             hci_conn_security(conn, sec_level, auth_type, true)) {
3030                 cmd->cmd_complete(cmd, 0);
3031                 mgmt_pending_remove(cmd);
3032         }
3033
3034         err = 0;
3035
3036 unlock:
3037         hci_dev_unlock(hdev);
3038         return err;
3039 }
3040
3041 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3042                               u16 len)
3043 {
3044         struct mgmt_addr_info *addr = data;
3045         struct mgmt_pending_cmd *cmd;
3046         struct hci_conn *conn;
3047         int err;
3048
3049         bt_dev_dbg(hdev, "sock %p", sk);
3050
3051         hci_dev_lock(hdev);
3052
3053         if (!hdev_is_powered(hdev)) {
3054                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3055                                       MGMT_STATUS_NOT_POWERED);
3056                 goto unlock;
3057         }
3058
3059         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3060         if (!cmd) {
3061                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3062                                       MGMT_STATUS_INVALID_PARAMS);
3063                 goto unlock;
3064         }
3065
3066         conn = cmd->user_data;
3067
3068         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3069                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3070                                       MGMT_STATUS_INVALID_PARAMS);
3071                 goto unlock;
3072         }
3073
3074         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3075         mgmt_pending_remove(cmd);
3076
3077         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3078                                 addr, sizeof(*addr));
3079
3080         /* Since user doesn't want to proceed with the connection, abort any
3081          * ongoing pairing and then terminate the link if it was created
3082          * because of the pair device action.
3083          */
3084         if (addr->type == BDADDR_BREDR)
3085                 hci_remove_link_key(hdev, &addr->bdaddr);
3086         else
3087                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3088                                               le_addr_type(addr->type));
3089
3090         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3091                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3092
3093 unlock:
3094         hci_dev_unlock(hdev);
3095         return err;
3096 }
3097
3098 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3099                              struct mgmt_addr_info *addr, u16 mgmt_op,
3100                              u16 hci_op, __le32 passkey)
3101 {
3102         struct mgmt_pending_cmd *cmd;
3103         struct hci_conn *conn;
3104         int err;
3105
3106         hci_dev_lock(hdev);
3107
3108         if (!hdev_is_powered(hdev)) {
3109                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3110                                         MGMT_STATUS_NOT_POWERED, addr,
3111                                         sizeof(*addr));
3112                 goto done;
3113         }
3114
3115         if (addr->type == BDADDR_BREDR)
3116                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3117         else
3118                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3119                                                le_addr_type(addr->type));
3120
3121         if (!conn) {
3122                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3123                                         MGMT_STATUS_NOT_CONNECTED, addr,
3124                                         sizeof(*addr));
3125                 goto done;
3126         }
3127
3128         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3129                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3130                 if (!err)
3131                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3132                                                 MGMT_STATUS_SUCCESS, addr,
3133                                                 sizeof(*addr));
3134                 else
3135                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3136                                                 MGMT_STATUS_FAILED, addr,
3137                                                 sizeof(*addr));
3138
3139                 goto done;
3140         }
3141
3142         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3143         if (!cmd) {
3144                 err = -ENOMEM;
3145                 goto done;
3146         }
3147
3148         cmd->cmd_complete = addr_cmd_complete;
3149
3150         /* Continue with pairing via HCI */
3151         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3152                 struct hci_cp_user_passkey_reply cp;
3153
3154                 bacpy(&cp.bdaddr, &addr->bdaddr);
3155                 cp.passkey = passkey;
3156                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3157         } else
3158                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3159                                    &addr->bdaddr);
3160
3161         if (err < 0)
3162                 mgmt_pending_remove(cmd);
3163
3164 done:
3165         hci_dev_unlock(hdev);
3166         return err;
3167 }
3168
3169 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3170                               void *data, u16 len)
3171 {
3172         struct mgmt_cp_pin_code_neg_reply *cp = data;
3173
3174         bt_dev_dbg(hdev, "sock %p", sk);
3175
3176         return user_pairing_resp(sk, hdev, &cp->addr,
3177                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3178                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3179 }
3180
3181 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3182                               u16 len)
3183 {
3184         struct mgmt_cp_user_confirm_reply *cp = data;
3185
3186         bt_dev_dbg(hdev, "sock %p", sk);
3187
3188         if (len != sizeof(*cp))
3189                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3190                                        MGMT_STATUS_INVALID_PARAMS);
3191
3192         return user_pairing_resp(sk, hdev, &cp->addr,
3193                                  MGMT_OP_USER_CONFIRM_REPLY,
3194                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3195 }
3196
3197 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3198                                   void *data, u16 len)
3199 {
3200         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3201
3202         bt_dev_dbg(hdev, "sock %p", sk);
3203
3204         return user_pairing_resp(sk, hdev, &cp->addr,
3205                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3206                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3207 }
3208
3209 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3210                               u16 len)
3211 {
3212         struct mgmt_cp_user_passkey_reply *cp = data;
3213
3214         bt_dev_dbg(hdev, "sock %p", sk);
3215
3216         return user_pairing_resp(sk, hdev, &cp->addr,
3217                                  MGMT_OP_USER_PASSKEY_REPLY,
3218                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3219 }
3220
3221 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3222                                   void *data, u16 len)
3223 {
3224         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3225
3226         bt_dev_dbg(hdev, "sock %p", sk);
3227
3228         return user_pairing_resp(sk, hdev, &cp->addr,
3229                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3230                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3231 }
3232
3233 static void adv_expire(struct hci_dev *hdev, u32 flags)
3234 {
3235         struct adv_info *adv_instance;
3236         struct hci_request req;
3237         int err;
3238
3239         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3240         if (!adv_instance)
3241                 return;
3242
3243         /* stop if current instance doesn't need to be changed */
3244         if (!(adv_instance->flags & flags))
3245                 return;
3246
3247         cancel_adv_timeout(hdev);
3248
3249         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3250         if (!adv_instance)
3251                 return;
3252
3253         hci_req_init(&req, hdev);
3254         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3255                                               true);
3256         if (err)
3257                 return;
3258
3259         hci_req_run(&req, NULL);
3260 }
3261
3262 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3263 {
3264         struct mgmt_cp_set_local_name *cp;
3265         struct mgmt_pending_cmd *cmd;
3266
3267         bt_dev_dbg(hdev, "status 0x%02x", status);
3268
3269         hci_dev_lock(hdev);
3270
3271         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3272         if (!cmd)
3273                 goto unlock;
3274
3275         cp = cmd->param;
3276
3277         if (status) {
3278                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3279                                 mgmt_status(status));
3280         } else {
3281                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3282                                   cp, sizeof(*cp));
3283
3284                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3285                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3286         }
3287
3288         mgmt_pending_remove(cmd);
3289
3290 unlock:
3291         hci_dev_unlock(hdev);
3292 }
3293
3294 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3295                           u16 len)
3296 {
3297         struct mgmt_cp_set_local_name *cp = data;
3298         struct mgmt_pending_cmd *cmd;
3299         struct hci_request req;
3300         int err;
3301
3302         bt_dev_dbg(hdev, "sock %p", sk);
3303
3304         hci_dev_lock(hdev);
3305
3306         /* If the old values are the same as the new ones just return a
3307          * direct command complete event.
3308          */
3309         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3310             !memcmp(hdev->short_name, cp->short_name,
3311                     sizeof(hdev->short_name))) {
3312                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3313                                         data, len);
3314                 goto failed;
3315         }
3316
3317         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3318
3319         if (!hdev_is_powered(hdev)) {
3320                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3321
3322                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3323                                         data, len);
3324                 if (err < 0)
3325                         goto failed;
3326
3327                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3328                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3329                 ext_info_changed(hdev, sk);
3330
3331                 goto failed;
3332         }
3333
3334         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3335         if (!cmd) {
3336                 err = -ENOMEM;
3337                 goto failed;
3338         }
3339
3340         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3341
3342         hci_req_init(&req, hdev);
3343
3344         if (lmp_bredr_capable(hdev)) {
3345                 __hci_req_update_name(&req);
3346                 __hci_req_update_eir(&req);
3347         }
3348
3349         /* The name is stored in the scan response data and so
3350          * no need to update the advertising data here.
3351          */
3352         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3353                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3354
3355         err = hci_req_run(&req, set_name_complete);
3356         if (err < 0)
3357                 mgmt_pending_remove(cmd);
3358
3359 failed:
3360         hci_dev_unlock(hdev);
3361         return err;
3362 }
3363
3364 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3365                           u16 len)
3366 {
3367         struct mgmt_cp_set_appearance *cp = data;
3368         u16 appearance;
3369         int err;
3370
3371         bt_dev_dbg(hdev, "sock %p", sk);
3372
3373         if (!lmp_le_capable(hdev))
3374                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3375                                        MGMT_STATUS_NOT_SUPPORTED);
3376
3377         appearance = le16_to_cpu(cp->appearance);
3378
3379         hci_dev_lock(hdev);
3380
3381         if (hdev->appearance != appearance) {
3382                 hdev->appearance = appearance;
3383
3384                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3385                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3386
3387                 ext_info_changed(hdev, sk);
3388         }
3389
3390         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3391                                 0);
3392
3393         hci_dev_unlock(hdev);
3394
3395         return err;
3396 }
3397
3398 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3399                                  void *data, u16 len)
3400 {
3401         struct mgmt_rp_get_phy_configuration rp;
3402
3403         bt_dev_dbg(hdev, "sock %p", sk);
3404
3405         hci_dev_lock(hdev);
3406
3407         memset(&rp, 0, sizeof(rp));
3408
3409         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3410         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3411         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3412
3413         hci_dev_unlock(hdev);
3414
3415         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3416                                  &rp, sizeof(rp));
3417 }
3418
3419 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3420 {
3421         struct mgmt_ev_phy_configuration_changed ev;
3422
3423         memset(&ev, 0, sizeof(ev));
3424
3425         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3426
3427         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3428                           sizeof(ev), skip);
3429 }
3430
3431 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3432                                      u16 opcode, struct sk_buff *skb)
3433 {
3434         struct mgmt_pending_cmd *cmd;
3435
3436         bt_dev_dbg(hdev, "status 0x%02x", status);
3437
3438         hci_dev_lock(hdev);
3439
3440         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3441         if (!cmd)
3442                 goto unlock;
3443
3444         if (status) {
3445                 mgmt_cmd_status(cmd->sk, hdev->id,
3446                                 MGMT_OP_SET_PHY_CONFIGURATION,
3447                                 mgmt_status(status));
3448         } else {
3449                 mgmt_cmd_complete(cmd->sk, hdev->id,
3450                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3451                                   NULL, 0);
3452
3453                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3454         }
3455
3456         mgmt_pending_remove(cmd);
3457
3458 unlock:
3459         hci_dev_unlock(hdev);
3460 }
3461
3462 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3463                                  void *data, u16 len)
3464 {
3465         struct mgmt_cp_set_phy_configuration *cp = data;
3466         struct hci_cp_le_set_default_phy cp_phy;
3467         struct mgmt_pending_cmd *cmd;
3468         struct hci_request req;
3469         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3470         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3471         bool changed = false;
3472         int err;
3473
3474         bt_dev_dbg(hdev, "sock %p", sk);
3475
3476         configurable_phys = get_configurable_phys(hdev);
3477         supported_phys = get_supported_phys(hdev);
3478         selected_phys = __le32_to_cpu(cp->selected_phys);
3479
3480         if (selected_phys & ~supported_phys)
3481                 return mgmt_cmd_status(sk, hdev->id,
3482                                        MGMT_OP_SET_PHY_CONFIGURATION,
3483                                        MGMT_STATUS_INVALID_PARAMS);
3484
3485         unconfigure_phys = supported_phys & ~configurable_phys;
3486
3487         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3488                 return mgmt_cmd_status(sk, hdev->id,
3489                                        MGMT_OP_SET_PHY_CONFIGURATION,
3490                                        MGMT_STATUS_INVALID_PARAMS);
3491
3492         if (selected_phys == get_selected_phys(hdev))
3493                 return mgmt_cmd_complete(sk, hdev->id,
3494                                          MGMT_OP_SET_PHY_CONFIGURATION,
3495                                          0, NULL, 0);
3496
3497         hci_dev_lock(hdev);
3498
3499         if (!hdev_is_powered(hdev)) {
3500                 err = mgmt_cmd_status(sk, hdev->id,
3501                                       MGMT_OP_SET_PHY_CONFIGURATION,
3502                                       MGMT_STATUS_REJECTED);
3503                 goto unlock;
3504         }
3505
3506         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3507                 err = mgmt_cmd_status(sk, hdev->id,
3508                                       MGMT_OP_SET_PHY_CONFIGURATION,
3509                                       MGMT_STATUS_BUSY);
3510                 goto unlock;
3511         }
3512
3513         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3514                 pkt_type |= (HCI_DH3 | HCI_DM3);
3515         else
3516                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3517
3518         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3519                 pkt_type |= (HCI_DH5 | HCI_DM5);
3520         else
3521                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3522
3523         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3524                 pkt_type &= ~HCI_2DH1;
3525         else
3526                 pkt_type |= HCI_2DH1;
3527
3528         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3529                 pkt_type &= ~HCI_2DH3;
3530         else
3531                 pkt_type |= HCI_2DH3;
3532
3533         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3534                 pkt_type &= ~HCI_2DH5;
3535         else
3536                 pkt_type |= HCI_2DH5;
3537
3538         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3539                 pkt_type &= ~HCI_3DH1;
3540         else
3541                 pkt_type |= HCI_3DH1;
3542
3543         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3544                 pkt_type &= ~HCI_3DH3;
3545         else
3546                 pkt_type |= HCI_3DH3;
3547
3548         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3549                 pkt_type &= ~HCI_3DH5;
3550         else
3551                 pkt_type |= HCI_3DH5;
3552
3553         if (pkt_type != hdev->pkt_type) {
3554                 hdev->pkt_type = pkt_type;
3555                 changed = true;
3556         }
3557
3558         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3559             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3560                 if (changed)
3561                         mgmt_phy_configuration_changed(hdev, sk);
3562
3563                 err = mgmt_cmd_complete(sk, hdev->id,
3564                                         MGMT_OP_SET_PHY_CONFIGURATION,
3565                                         0, NULL, 0);
3566
3567                 goto unlock;
3568         }
3569
3570         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3571                                len);
3572         if (!cmd) {
3573                 err = -ENOMEM;
3574                 goto unlock;
3575         }
3576
3577         hci_req_init(&req, hdev);
3578
3579         memset(&cp_phy, 0, sizeof(cp_phy));
3580
3581         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3582                 cp_phy.all_phys |= 0x01;
3583
3584         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3585                 cp_phy.all_phys |= 0x02;
3586
3587         if (selected_phys & MGMT_PHY_LE_1M_TX)
3588                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3589
3590         if (selected_phys & MGMT_PHY_LE_2M_TX)
3591                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3592
3593         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3594                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3595
3596         if (selected_phys & MGMT_PHY_LE_1M_RX)
3597                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3598
3599         if (selected_phys & MGMT_PHY_LE_2M_RX)
3600                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3601
3602         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3603                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3604
3605         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3606
3607         err = hci_req_run_skb(&req, set_default_phy_complete);
3608         if (err < 0)
3609                 mgmt_pending_remove(cmd);
3610
3611 unlock:
3612         hci_dev_unlock(hdev);
3613
3614         return err;
3615 }
3616
3617 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3618                             u16 len)
3619 {
3620         int err = MGMT_STATUS_SUCCESS;
3621         struct mgmt_cp_set_blocked_keys *keys = data;
3622         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3623                                    sizeof(struct mgmt_blocked_key_info));
3624         u16 key_count, expected_len;
3625         int i;
3626
3627         bt_dev_dbg(hdev, "sock %p", sk);
3628
3629         key_count = __le16_to_cpu(keys->key_count);
3630         if (key_count > max_key_count) {
3631                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3632                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3633                                        MGMT_STATUS_INVALID_PARAMS);
3634         }
3635
3636         expected_len = struct_size(keys, keys, key_count);
3637         if (expected_len != len) {
3638                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3639                            expected_len, len);
3640                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3641                                        MGMT_STATUS_INVALID_PARAMS);
3642         }
3643
3644         hci_dev_lock(hdev);
3645
3646         hci_blocked_keys_clear(hdev);
3647
3648         for (i = 0; i < keys->key_count; ++i) {
3649                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3650
3651                 if (!b) {
3652                         err = MGMT_STATUS_NO_RESOURCES;
3653                         break;
3654                 }
3655
3656                 b->type = keys->keys[i].type;
3657                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3658                 list_add_rcu(&b->list, &hdev->blocked_keys);
3659         }
3660         hci_dev_unlock(hdev);
3661
3662         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3663                                 err, NULL, 0);
3664 }
3665
3666 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3667                                void *data, u16 len)
3668 {
3669         struct mgmt_mode *cp = data;
3670         int err;
3671         bool changed = false;
3672
3673         bt_dev_dbg(hdev, "sock %p", sk);
3674
3675         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3676                 return mgmt_cmd_status(sk, hdev->id,
3677                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3678                                        MGMT_STATUS_NOT_SUPPORTED);
3679
3680         if (cp->val != 0x00 && cp->val != 0x01)
3681                 return mgmt_cmd_status(sk, hdev->id,
3682                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3683                                        MGMT_STATUS_INVALID_PARAMS);
3684
3685         hci_dev_lock(hdev);
3686
3687         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3688                 err = mgmt_cmd_status(sk, hdev->id,
3689                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3690                                       MGMT_STATUS_BUSY);
3691                 goto unlock;
3692         }
3693
3694         if (hdev_is_powered(hdev) &&
3695             !!cp->val != hci_dev_test_flag(hdev,
3696                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3697                 err = mgmt_cmd_status(sk, hdev->id,
3698                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3699                                       MGMT_STATUS_REJECTED);
3700                 goto unlock;
3701         }
3702
3703         if (cp->val)
3704                 changed = !hci_dev_test_and_set_flag(hdev,
3705                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3706         else
3707                 changed = hci_dev_test_and_clear_flag(hdev,
3708                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3709
3710         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3711         if (err < 0)
3712                 goto unlock;
3713
3714         if (changed)
3715                 err = new_settings(hdev, sk);
3716
3717 unlock:
3718         hci_dev_unlock(hdev);
3719         return err;
3720 }
3721
3722 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3723                                void *data, u16 data_len)
3724 {
3725         char buf[20];
3726         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3727         u16 cap_len = 0;
3728         u8 flags = 0;
3729         u8 tx_power_range[2];
3730
3731         bt_dev_dbg(hdev, "sock %p", sk);
3732
3733         memset(&buf, 0, sizeof(buf));
3734
3735         hci_dev_lock(hdev);
3736
3737         /* When the Read Simple Pairing Options command is supported, then
3738          * the remote public key validation is supported.
3739          *
3740          * Alternatively, when Microsoft extensions are available, they can
3741          * indicate support for public key validation as well.
3742          */
3743         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3744                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3745
3746         flags |= 0x02;          /* Remote public key validation (LE) */
3747
3748         /* When the Read Encryption Key Size command is supported, then the
3749          * encryption key size is enforced.
3750          */
3751         if (hdev->commands[20] & 0x10)
3752                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3753
3754         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3755
3756         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3757                                   &flags, 1);
3758
3759         /* When the Read Simple Pairing Options command is supported, then
3760          * also max encryption key size information is provided.
3761          */
3762         if (hdev->commands[41] & 0x08)
3763                 cap_len = eir_append_le16(rp->cap, cap_len,
3764                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3765                                           hdev->max_enc_key_size);
3766
3767         cap_len = eir_append_le16(rp->cap, cap_len,
3768                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3769                                   SMP_MAX_ENC_KEY_SIZE);
3770
3771         /* Append the min/max LE tx power parameters if we were able to fetch
3772          * it from the controller
3773          */
3774         if (hdev->commands[38] & 0x80) {
3775                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3776                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3777                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3778                                           tx_power_range, 2);
3779         }
3780
3781         rp->cap_len = cpu_to_le16(cap_len);
3782
3783         hci_dev_unlock(hdev);
3784
3785         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3786                                  rp, sizeof(*rp) + cap_len);
3787 }
3788
3789 #ifdef CONFIG_BT_FEATURE_DEBUG
3790 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3791 static const u8 debug_uuid[16] = {
3792         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3793         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3794 };
3795 #endif
3796
3797 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3798 static const u8 simult_central_periph_uuid[16] = {
3799         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3800         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3801 };
3802
3803 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3804 static const u8 rpa_resolution_uuid[16] = {
3805         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3806         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3807 };
3808
3809 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3810                                   void *data, u16 data_len)
3811 {
3812         char buf[62];   /* Enough space for 3 features */
3813         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3814         u16 idx = 0;
3815         u32 flags;
3816
3817         bt_dev_dbg(hdev, "sock %p", sk);
3818
3819         memset(&buf, 0, sizeof(buf));
3820
3821 #ifdef CONFIG_BT_FEATURE_DEBUG
3822         if (!hdev) {
3823                 flags = bt_dbg_get() ? BIT(0) : 0;
3824
3825                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3826                 rp->features[idx].flags = cpu_to_le32(flags);
3827                 idx++;
3828         }
3829 #endif
3830
3831         if (hdev) {
3832                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3833                     (hdev->le_states[4] & 0x08) &&      /* Central */
3834                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3835                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3836                         flags = BIT(0);
3837                 else
3838                         flags = 0;
3839
3840                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3841                 rp->features[idx].flags = cpu_to_le32(flags);
3842                 idx++;
3843         }
3844
3845         if (hdev && use_ll_privacy(hdev)) {
3846                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3847                         flags = BIT(0) | BIT(1);
3848                 else
3849                         flags = BIT(1);
3850
3851                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3852                 rp->features[idx].flags = cpu_to_le32(flags);
3853                 idx++;
3854         }
3855
3856         rp->feature_count = cpu_to_le16(idx);
3857
3858         /* After reading the experimental features information, enable
3859          * the events to update client on any future change.
3860          */
3861         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3862
3863         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3864                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3865                                  0, rp, sizeof(*rp) + (20 * idx));
3866 }
3867
3868 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3869                                           struct sock *skip)
3870 {
3871         struct mgmt_ev_exp_feature_changed ev;
3872
3873         memset(&ev, 0, sizeof(ev));
3874         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3875         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3876
3877         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3878                                   &ev, sizeof(ev),
3879                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3880
3881 }
3882
3883 #ifdef CONFIG_BT_FEATURE_DEBUG
3884 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3885 {
3886         struct mgmt_ev_exp_feature_changed ev;
3887
3888         memset(&ev, 0, sizeof(ev));
3889         memcpy(ev.uuid, debug_uuid, 16);
3890         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3891
3892         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3893                                   &ev, sizeof(ev),
3894                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3895 }
3896 #endif
3897
3898 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
3899                            void *data, u16 data_len)
3900 {
3901         struct mgmt_cp_set_exp_feature *cp = data;
3902         struct mgmt_rp_set_exp_feature rp;
3903
3904         bt_dev_dbg(hdev, "sock %p", sk);
3905
3906         if (!memcmp(cp->uuid, ZERO_KEY, 16)) {
3907                 memset(rp.uuid, 0, 16);
3908                 rp.flags = cpu_to_le32(0);
3909
3910 #ifdef CONFIG_BT_FEATURE_DEBUG
3911                 if (!hdev) {
3912                         bool changed = bt_dbg_get();
3913
3914                         bt_dbg_set(false);
3915
3916                         if (changed)
3917                                 exp_debug_feature_changed(false, sk);
3918                 }
3919 #endif
3920
3921                 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3922                         bool changed = hci_dev_test_flag(hdev,
3923                                                          HCI_ENABLE_LL_PRIVACY);
3924
3925                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3926
3927                         if (changed)
3928                                 exp_ll_privacy_feature_changed(false, hdev, sk);
3929                 }
3930
3931                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3932
3933                 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3934                                          MGMT_OP_SET_EXP_FEATURE, 0,
3935                                          &rp, sizeof(rp));
3936         }
3937
3938 #ifdef CONFIG_BT_FEATURE_DEBUG
3939         if (!memcmp(cp->uuid, debug_uuid, 16)) {
3940                 bool val, changed;
3941                 int err;
3942
3943                 /* Command requires to use the non-controller index */
3944                 if (hdev)
3945                         return mgmt_cmd_status(sk, hdev->id,
3946                                                MGMT_OP_SET_EXP_FEATURE,
3947                                                MGMT_STATUS_INVALID_INDEX);
3948
3949                 /* Parameters are limited to a single octet */
3950                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3951                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3952                                                MGMT_OP_SET_EXP_FEATURE,
3953                                                MGMT_STATUS_INVALID_PARAMS);
3954
3955                 /* Only boolean on/off is supported */
3956                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3957                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3958                                                MGMT_OP_SET_EXP_FEATURE,
3959                                                MGMT_STATUS_INVALID_PARAMS);
3960
3961                 val = !!cp->param[0];
3962                 changed = val ? !bt_dbg_get() : bt_dbg_get();
3963                 bt_dbg_set(val);
3964
3965                 memcpy(rp.uuid, debug_uuid, 16);
3966                 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3967
3968                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3969
3970                 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3971                                         MGMT_OP_SET_EXP_FEATURE, 0,
3972                                         &rp, sizeof(rp));
3973
3974                 if (changed)
3975                         exp_debug_feature_changed(val, sk);
3976
3977                 return err;
3978         }
3979 #endif
3980
3981         if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) {
3982                 bool val, changed;
3983                 int err;
3984                 u32 flags;
3985
3986                 /* Command requires to use the controller index */
3987                 if (!hdev)
3988                         return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3989                                                MGMT_OP_SET_EXP_FEATURE,
3990                                                MGMT_STATUS_INVALID_INDEX);
3991
3992                 /* Changes can only be made when controller is powered down */
3993                 if (hdev_is_powered(hdev))
3994                         return mgmt_cmd_status(sk, hdev->id,
3995                                                MGMT_OP_SET_EXP_FEATURE,
3996                                                MGMT_STATUS_REJECTED);
3997
3998                 /* Parameters are limited to a single octet */
3999                 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4000                         return mgmt_cmd_status(sk, hdev->id,
4001                                                MGMT_OP_SET_EXP_FEATURE,
4002                                                MGMT_STATUS_INVALID_PARAMS);
4003
4004                 /* Only boolean on/off is supported */
4005                 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4006                         return mgmt_cmd_status(sk, hdev->id,
4007                                                MGMT_OP_SET_EXP_FEATURE,
4008                                                MGMT_STATUS_INVALID_PARAMS);
4009
4010                 val = !!cp->param[0];
4011
4012                 if (val) {
4013                         changed = !hci_dev_test_flag(hdev,
4014                                                      HCI_ENABLE_LL_PRIVACY);
4015                         hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4016                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4017
4018                         /* Enable LL privacy + supported settings changed */
4019                         flags = BIT(0) | BIT(1);
4020                 } else {
4021                         changed = hci_dev_test_flag(hdev,
4022                                                     HCI_ENABLE_LL_PRIVACY);
4023                         hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4024
4025                         /* Disable LL privacy + supported settings changed */
4026                         flags = BIT(1);
4027                 }
4028
4029                 memcpy(rp.uuid, rpa_resolution_uuid, 16);
4030                 rp.flags = cpu_to_le32(flags);
4031
4032                 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4033
4034                 err = mgmt_cmd_complete(sk, hdev->id,
4035                                         MGMT_OP_SET_EXP_FEATURE, 0,
4036                                         &rp, sizeof(rp));
4037
4038                 if (changed)
4039                         exp_ll_privacy_feature_changed(val, hdev, sk);
4040
4041                 return err;
4042         }
4043
4044         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4045                                MGMT_OP_SET_EXP_FEATURE,
4046                                MGMT_STATUS_NOT_SUPPORTED);
4047 }
4048
4049 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4050
4051 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4052                             u16 data_len)
4053 {
4054         struct mgmt_cp_get_device_flags *cp = data;
4055         struct mgmt_rp_get_device_flags rp;
4056         struct bdaddr_list_with_flags *br_params;
4057         struct hci_conn_params *params;
4058         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4059         u32 current_flags = 0;
4060         u8 status = MGMT_STATUS_INVALID_PARAMS;
4061
4062         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4063                    &cp->addr.bdaddr, cp->addr.type);
4064
4065         hci_dev_lock(hdev);
4066
4067         memset(&rp, 0, sizeof(rp));
4068
4069         if (cp->addr.type == BDADDR_BREDR) {
4070                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4071                                                               &cp->addr.bdaddr,
4072                                                               cp->addr.type);
4073                 if (!br_params)
4074                         goto done;
4075
4076                 current_flags = br_params->current_flags;
4077         } else {
4078                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4079                                                 le_addr_type(cp->addr.type));
4080
4081                 if (!params)
4082                         goto done;
4083
4084                 current_flags = params->current_flags;
4085         }
4086
4087         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4088         rp.addr.type = cp->addr.type;
4089         rp.supported_flags = cpu_to_le32(supported_flags);
4090         rp.current_flags = cpu_to_le32(current_flags);
4091
4092         status = MGMT_STATUS_SUCCESS;
4093
4094 done:
4095         hci_dev_unlock(hdev);
4096
4097         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4098                                 &rp, sizeof(rp));
4099 }
4100
4101 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4102                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4103                                  u32 supported_flags, u32 current_flags)
4104 {
4105         struct mgmt_ev_device_flags_changed ev;
4106
4107         bacpy(&ev.addr.bdaddr, bdaddr);
4108         ev.addr.type = bdaddr_type;
4109         ev.supported_flags = cpu_to_le32(supported_flags);
4110         ev.current_flags = cpu_to_le32(current_flags);
4111
4112         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4113 }
4114
4115 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4116                             u16 len)
4117 {
4118         struct mgmt_cp_set_device_flags *cp = data;
4119         struct bdaddr_list_with_flags *br_params;
4120         struct hci_conn_params *params;
4121         u8 status = MGMT_STATUS_INVALID_PARAMS;
4122         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4123         u32 current_flags = __le32_to_cpu(cp->current_flags);
4124
4125         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4126                    &cp->addr.bdaddr, cp->addr.type,
4127                    __le32_to_cpu(current_flags));
4128
4129         if ((supported_flags | current_flags) != supported_flags) {
4130                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4131                             current_flags, supported_flags);
4132                 goto done;
4133         }
4134
4135         hci_dev_lock(hdev);
4136
4137         if (cp->addr.type == BDADDR_BREDR) {
4138                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4139                                                               &cp->addr.bdaddr,
4140                                                               cp->addr.type);
4141
4142                 if (br_params) {
4143                         br_params->current_flags = current_flags;
4144                         status = MGMT_STATUS_SUCCESS;
4145                 } else {
4146                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4147                                     &cp->addr.bdaddr, cp->addr.type);
4148                 }
4149         } else {
4150                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4151                                                 le_addr_type(cp->addr.type));
4152                 if (params) {
4153                         params->current_flags = current_flags;
4154                         status = MGMT_STATUS_SUCCESS;
4155                 } else {
4156                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4157                                     &cp->addr.bdaddr,
4158                                     le_addr_type(cp->addr.type));
4159                 }
4160         }
4161
4162 done:
4163         hci_dev_unlock(hdev);
4164
4165         if (status == MGMT_STATUS_SUCCESS)
4166                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4167                                      supported_flags, current_flags);
4168
4169         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4170                                  &cp->addr, sizeof(cp->addr));
4171 }
4172
4173 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4174                                    u16 handle)
4175 {
4176         struct mgmt_ev_adv_monitor_added ev;
4177
4178         ev.monitor_handle = cpu_to_le16(handle);
4179
4180         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4181 }
4182
4183 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4184 {
4185         struct mgmt_ev_adv_monitor_removed ev;
4186         struct mgmt_pending_cmd *cmd;
4187         struct sock *sk_skip = NULL;
4188         struct mgmt_cp_remove_adv_monitor *cp;
4189
4190         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4191         if (cmd) {
4192                 cp = cmd->param;
4193
4194                 if (cp->monitor_handle)
4195                         sk_skip = cmd->sk;
4196         }
4197
4198         ev.monitor_handle = cpu_to_le16(handle);
4199
4200         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4201 }
4202
4203 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4204                                  void *data, u16 len)
4205 {
4206         struct adv_monitor *monitor = NULL;
4207         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4208         int handle, err;
4209         size_t rp_size = 0;
4210         __u32 supported = 0;
4211         __u32 enabled = 0;
4212         __u16 num_handles = 0;
4213         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4214
4215         BT_DBG("request for %s", hdev->name);
4216
4217         hci_dev_lock(hdev);
4218
4219         if (msft_monitor_supported(hdev))
4220                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4221
4222         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4223                 handles[num_handles++] = monitor->handle;
4224
4225         hci_dev_unlock(hdev);
4226
4227         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4228         rp = kmalloc(rp_size, GFP_KERNEL);
4229         if (!rp)
4230                 return -ENOMEM;
4231
4232         /* All supported features are currently enabled */
4233         enabled = supported;
4234
4235         rp->supported_features = cpu_to_le32(supported);
4236         rp->enabled_features = cpu_to_le32(enabled);
4237         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4238         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4239         rp->num_handles = cpu_to_le16(num_handles);
4240         if (num_handles)
4241                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4242
4243         err = mgmt_cmd_complete(sk, hdev->id,
4244                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4245                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4246
4247         kfree(rp);
4248
4249         return err;
4250 }
4251
4252 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4253 {
4254         struct mgmt_rp_add_adv_patterns_monitor rp;
4255         struct mgmt_pending_cmd *cmd;
4256         struct adv_monitor *monitor;
4257         int err = 0;
4258
4259         hci_dev_lock(hdev);
4260
4261         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4262         if (!cmd) {
4263                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4264                 if (!cmd)
4265                         goto done;
4266         }
4267
4268         monitor = cmd->user_data;
4269         rp.monitor_handle = cpu_to_le16(monitor->handle);
4270
4271         if (!status) {
4272                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4273                 hdev->adv_monitors_cnt++;
4274                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4275                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4276                 hci_update_background_scan(hdev);
4277         }
4278
4279         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4280                                 mgmt_status(status), &rp, sizeof(rp));
4281         mgmt_pending_remove(cmd);
4282
4283 done:
4284         hci_dev_unlock(hdev);
4285         bt_dev_dbg(hdev, "add monitor %d complete, status %u",
4286                    rp.monitor_handle, status);
4287
4288         return err;
4289 }
4290
4291 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4292                                       struct adv_monitor *m, u8 status,
4293                                       void *data, u16 len, u16 op)
4294 {
4295         struct mgmt_rp_add_adv_patterns_monitor rp;
4296         struct mgmt_pending_cmd *cmd;
4297         int err;
4298         bool pending;
4299
4300         hci_dev_lock(hdev);
4301
4302         if (status)
4303                 goto unlock;
4304
4305         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4306             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4307             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4308             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4309                 status = MGMT_STATUS_BUSY;
4310                 goto unlock;
4311         }
4312
4313         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4314         if (!cmd) {
4315                 status = MGMT_STATUS_NO_RESOURCES;
4316                 goto unlock;
4317         }
4318
4319         cmd->user_data = m;
4320         pending = hci_add_adv_monitor(hdev, m, &err);
4321         if (err) {
4322                 if (err == -ENOSPC || err == -ENOMEM)
4323                         status = MGMT_STATUS_NO_RESOURCES;
4324                 else if (err == -EINVAL)
4325                         status = MGMT_STATUS_INVALID_PARAMS;
4326                 else
4327                         status = MGMT_STATUS_FAILED;
4328
4329                 mgmt_pending_remove(cmd);
4330                 goto unlock;
4331         }
4332
4333         if (!pending) {
4334                 mgmt_pending_remove(cmd);
4335                 rp.monitor_handle = cpu_to_le16(m->handle);
4336                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4337                 m->state = ADV_MONITOR_STATE_REGISTERED;
4338                 hdev->adv_monitors_cnt++;
4339
4340                 hci_dev_unlock(hdev);
4341                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4342                                          &rp, sizeof(rp));
4343         }
4344
4345         hci_dev_unlock(hdev);
4346
4347         return 0;
4348
4349 unlock:
4350         hci_free_adv_monitor(hdev, m);
4351         hci_dev_unlock(hdev);
4352         return mgmt_cmd_status(sk, hdev->id, op, status);
4353 }
4354
4355 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4356                                    struct mgmt_adv_rssi_thresholds *rssi)
4357 {
4358         if (rssi) {
4359                 m->rssi.low_threshold = rssi->low_threshold;
4360                 m->rssi.low_threshold_timeout =
4361                     __le16_to_cpu(rssi->low_threshold_timeout);
4362                 m->rssi.high_threshold = rssi->high_threshold;
4363                 m->rssi.high_threshold_timeout =
4364                     __le16_to_cpu(rssi->high_threshold_timeout);
4365                 m->rssi.sampling_period = rssi->sampling_period;
4366         } else {
4367                 /* Default values. These numbers are the least constricting
4368                  * parameters for MSFT API to work, so it behaves as if there
4369                  * are no rssi parameter to consider. May need to be changed
4370                  * if other API are to be supported.
4371                  */
4372                 m->rssi.low_threshold = -127;
4373                 m->rssi.low_threshold_timeout = 60;
4374                 m->rssi.high_threshold = -127;
4375                 m->rssi.high_threshold_timeout = 0;
4376                 m->rssi.sampling_period = 0;
4377         }
4378 }
4379
4380 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4381                                     struct mgmt_adv_pattern *patterns)
4382 {
4383         u8 offset = 0, length = 0;
4384         struct adv_pattern *p = NULL;
4385         int i;
4386
4387         for (i = 0; i < pattern_count; i++) {
4388                 offset = patterns[i].offset;
4389                 length = patterns[i].length;
4390                 if (offset >= HCI_MAX_AD_LENGTH ||
4391                     length > HCI_MAX_AD_LENGTH ||
4392                     (offset + length) > HCI_MAX_AD_LENGTH)
4393                         return MGMT_STATUS_INVALID_PARAMS;
4394
4395                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4396                 if (!p)
4397                         return MGMT_STATUS_NO_RESOURCES;
4398
4399                 p->ad_type = patterns[i].ad_type;
4400                 p->offset = patterns[i].offset;
4401                 p->length = patterns[i].length;
4402                 memcpy(p->value, patterns[i].value, p->length);
4403
4404                 INIT_LIST_HEAD(&p->list);
4405                 list_add(&p->list, &m->patterns);
4406         }
4407
4408         return MGMT_STATUS_SUCCESS;
4409 }
4410
4411 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4412                                     void *data, u16 len)
4413 {
4414         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4415         struct adv_monitor *m = NULL;
4416         u8 status = MGMT_STATUS_SUCCESS;
4417         size_t expected_size = sizeof(*cp);
4418
4419         BT_DBG("request for %s", hdev->name);
4420
4421         if (len <= sizeof(*cp)) {
4422                 status = MGMT_STATUS_INVALID_PARAMS;
4423                 goto done;
4424         }
4425
4426         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4427         if (len != expected_size) {
4428                 status = MGMT_STATUS_INVALID_PARAMS;
4429                 goto done;
4430         }
4431
4432         m = kzalloc(sizeof(*m), GFP_KERNEL);
4433         if (!m) {
4434                 status = MGMT_STATUS_NO_RESOURCES;
4435                 goto done;
4436         }
4437
4438         INIT_LIST_HEAD(&m->patterns);
4439
4440         parse_adv_monitor_rssi(m, NULL);
4441         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4442
4443 done:
4444         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4445                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4446 }
4447
4448 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4449                                          void *data, u16 len)
4450 {
4451         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4452         struct adv_monitor *m = NULL;
4453         u8 status = MGMT_STATUS_SUCCESS;
4454         size_t expected_size = sizeof(*cp);
4455
4456         BT_DBG("request for %s", hdev->name);
4457
4458         if (len <= sizeof(*cp)) {
4459                 status = MGMT_STATUS_INVALID_PARAMS;
4460                 goto done;
4461         }
4462
4463         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4464         if (len != expected_size) {
4465                 status = MGMT_STATUS_INVALID_PARAMS;
4466                 goto done;
4467         }
4468
4469         m = kzalloc(sizeof(*m), GFP_KERNEL);
4470         if (!m) {
4471                 status = MGMT_STATUS_NO_RESOURCES;
4472                 goto done;
4473         }
4474
4475         INIT_LIST_HEAD(&m->patterns);
4476
4477         parse_adv_monitor_rssi(m, &cp->rssi);
4478         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4479
4480 done:
4481         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4482                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4483 }
4484
4485 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4486 {
4487         struct mgmt_rp_remove_adv_monitor rp;
4488         struct mgmt_cp_remove_adv_monitor *cp;
4489         struct mgmt_pending_cmd *cmd;
4490         int err = 0;
4491
4492         hci_dev_lock(hdev);
4493
4494         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4495         if (!cmd)
4496                 goto done;
4497
4498         cp = cmd->param;
4499         rp.monitor_handle = cp->monitor_handle;
4500
4501         if (!status)
4502                 hci_update_background_scan(hdev);
4503
4504         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4505                                 mgmt_status(status), &rp, sizeof(rp));
4506         mgmt_pending_remove(cmd);
4507
4508 done:
4509         hci_dev_unlock(hdev);
4510         bt_dev_dbg(hdev, "remove monitor %d complete, status %u",
4511                    rp.monitor_handle, status);
4512
4513         return err;
4514 }
4515
4516 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4517                               void *data, u16 len)
4518 {
4519         struct mgmt_cp_remove_adv_monitor *cp = data;
4520         struct mgmt_rp_remove_adv_monitor rp;
4521         struct mgmt_pending_cmd *cmd;
4522         u16 handle = __le16_to_cpu(cp->monitor_handle);
4523         int err, status;
4524         bool pending;
4525
4526         BT_DBG("request for %s", hdev->name);
4527         rp.monitor_handle = cp->monitor_handle;
4528
4529         hci_dev_lock(hdev);
4530
4531         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4532             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4533             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4534             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4535                 status = MGMT_STATUS_BUSY;
4536                 goto unlock;
4537         }
4538
4539         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4540         if (!cmd) {
4541                 status = MGMT_STATUS_NO_RESOURCES;
4542                 goto unlock;
4543         }
4544
4545         if (handle)
4546                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4547         else
4548                 pending = hci_remove_all_adv_monitor(hdev, &err);
4549
4550         if (err) {
4551                 mgmt_pending_remove(cmd);
4552
4553                 if (err == -ENOENT)
4554                         status = MGMT_STATUS_INVALID_INDEX;
4555                 else
4556                         status = MGMT_STATUS_FAILED;
4557
4558                 goto unlock;
4559         }
4560
4561         /* monitor can be removed without forwarding request to controller */
4562         if (!pending) {
4563                 mgmt_pending_remove(cmd);
4564                 hci_dev_unlock(hdev);
4565
4566                 return mgmt_cmd_complete(sk, hdev->id,
4567                                          MGMT_OP_REMOVE_ADV_MONITOR,
4568                                          MGMT_STATUS_SUCCESS,
4569                                          &rp, sizeof(rp));
4570         }
4571
4572         hci_dev_unlock(hdev);
4573         return 0;
4574
4575 unlock:
4576         hci_dev_unlock(hdev);
4577         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4578                                status);
4579 }
4580
4581 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4582                                          u16 opcode, struct sk_buff *skb)
4583 {
4584         struct mgmt_rp_read_local_oob_data mgmt_rp;
4585         size_t rp_size = sizeof(mgmt_rp);
4586         struct mgmt_pending_cmd *cmd;
4587
4588         bt_dev_dbg(hdev, "status %u", status);
4589
4590         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4591         if (!cmd)
4592                 return;
4593
4594         if (status || !skb) {
4595                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4596                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4597                 goto remove;
4598         }
4599
4600         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4601
4602         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4603                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4604
4605                 if (skb->len < sizeof(*rp)) {
4606                         mgmt_cmd_status(cmd->sk, hdev->id,
4607                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4608                                         MGMT_STATUS_FAILED);
4609                         goto remove;
4610                 }
4611
4612                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4613                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4614
4615                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4616         } else {
4617                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4618
4619                 if (skb->len < sizeof(*rp)) {
4620                         mgmt_cmd_status(cmd->sk, hdev->id,
4621                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4622                                         MGMT_STATUS_FAILED);
4623                         goto remove;
4624                 }
4625
4626                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4627                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4628
4629                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4630                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4631         }
4632
4633         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4634                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4635
4636 remove:
4637         mgmt_pending_remove(cmd);
4638 }
4639
4640 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4641                                void *data, u16 data_len)
4642 {
4643         struct mgmt_pending_cmd *cmd;
4644         struct hci_request req;
4645         int err;
4646
4647         bt_dev_dbg(hdev, "sock %p", sk);
4648
4649         hci_dev_lock(hdev);
4650
4651         if (!hdev_is_powered(hdev)) {
4652                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4653                                       MGMT_STATUS_NOT_POWERED);
4654                 goto unlock;
4655         }
4656
4657         if (!lmp_ssp_capable(hdev)) {
4658                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4659                                       MGMT_STATUS_NOT_SUPPORTED);
4660                 goto unlock;
4661         }
4662
4663         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4664                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4665                                       MGMT_STATUS_BUSY);
4666                 goto unlock;
4667         }
4668
4669         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4670         if (!cmd) {
4671                 err = -ENOMEM;
4672                 goto unlock;
4673         }
4674
4675         hci_req_init(&req, hdev);
4676
4677         if (bredr_sc_enabled(hdev))
4678                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4679         else
4680                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4681
4682         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4683         if (err < 0)
4684                 mgmt_pending_remove(cmd);
4685
4686 unlock:
4687         hci_dev_unlock(hdev);
4688         return err;
4689 }
4690
4691 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4692                                void *data, u16 len)
4693 {
4694         struct mgmt_addr_info *addr = data;
4695         int err;
4696
4697         bt_dev_dbg(hdev, "sock %p", sk);
4698
4699         if (!bdaddr_type_is_valid(addr->type))
4700                 return mgmt_cmd_complete(sk, hdev->id,
4701                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4702                                          MGMT_STATUS_INVALID_PARAMS,
4703                                          addr, sizeof(*addr));
4704
4705         hci_dev_lock(hdev);
4706
4707         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4708                 struct mgmt_cp_add_remote_oob_data *cp = data;
4709                 u8 status;
4710
4711                 if (cp->addr.type != BDADDR_BREDR) {
4712                         err = mgmt_cmd_complete(sk, hdev->id,
4713                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4714                                                 MGMT_STATUS_INVALID_PARAMS,
4715                                                 &cp->addr, sizeof(cp->addr));
4716                         goto unlock;
4717                 }
4718
4719                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4720                                               cp->addr.type, cp->hash,
4721                                               cp->rand, NULL, NULL);
4722                 if (err < 0)
4723                         status = MGMT_STATUS_FAILED;
4724                 else
4725                         status = MGMT_STATUS_SUCCESS;
4726
4727                 err = mgmt_cmd_complete(sk, hdev->id,
4728                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4729                                         &cp->addr, sizeof(cp->addr));
4730         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4731                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4732                 u8 *rand192, *hash192, *rand256, *hash256;
4733                 u8 status;
4734
4735                 if (bdaddr_type_is_le(cp->addr.type)) {
4736                         /* Enforce zero-valued 192-bit parameters as
4737                          * long as legacy SMP OOB isn't implemented.
4738                          */
4739                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4740                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4741                                 err = mgmt_cmd_complete(sk, hdev->id,
4742                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4743                                                         MGMT_STATUS_INVALID_PARAMS,
4744                                                         addr, sizeof(*addr));
4745                                 goto unlock;
4746                         }
4747
4748                         rand192 = NULL;
4749                         hash192 = NULL;
4750                 } else {
4751                         /* In case one of the P-192 values is set to zero,
4752                          * then just disable OOB data for P-192.
4753                          */
4754                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4755                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4756                                 rand192 = NULL;
4757                                 hash192 = NULL;
4758                         } else {
4759                                 rand192 = cp->rand192;
4760                                 hash192 = cp->hash192;
4761                         }
4762                 }
4763
4764                 /* In case one of the P-256 values is set to zero, then just
4765                  * disable OOB data for P-256.
4766                  */
4767                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4768                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4769                         rand256 = NULL;
4770                         hash256 = NULL;
4771                 } else {
4772                         rand256 = cp->rand256;
4773                         hash256 = cp->hash256;
4774                 }
4775
4776                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4777                                               cp->addr.type, hash192, rand192,
4778                                               hash256, rand256);
4779                 if (err < 0)
4780                         status = MGMT_STATUS_FAILED;
4781                 else
4782                         status = MGMT_STATUS_SUCCESS;
4783
4784                 err = mgmt_cmd_complete(sk, hdev->id,
4785                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4786                                         status, &cp->addr, sizeof(cp->addr));
4787         } else {
4788                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4789                            len);
4790                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4791                                       MGMT_STATUS_INVALID_PARAMS);
4792         }
4793
4794 unlock:
4795         hci_dev_unlock(hdev);
4796         return err;
4797 }
4798
4799 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4800                                   void *data, u16 len)
4801 {
4802         struct mgmt_cp_remove_remote_oob_data *cp = data;
4803         u8 status;
4804         int err;
4805
4806         bt_dev_dbg(hdev, "sock %p", sk);
4807
4808         if (cp->addr.type != BDADDR_BREDR)
4809                 return mgmt_cmd_complete(sk, hdev->id,
4810                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4811                                          MGMT_STATUS_INVALID_PARAMS,
4812                                          &cp->addr, sizeof(cp->addr));
4813
4814         hci_dev_lock(hdev);
4815
4816         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4817                 hci_remote_oob_data_clear(hdev);
4818                 status = MGMT_STATUS_SUCCESS;
4819                 goto done;
4820         }
4821
4822         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4823         if (err < 0)
4824                 status = MGMT_STATUS_INVALID_PARAMS;
4825         else
4826                 status = MGMT_STATUS_SUCCESS;
4827
4828 done:
4829         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4830                                 status, &cp->addr, sizeof(cp->addr));
4831
4832         hci_dev_unlock(hdev);
4833         return err;
4834 }
4835
4836 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4837 {
4838         struct mgmt_pending_cmd *cmd;
4839
4840         bt_dev_dbg(hdev, "status %u", status);
4841
4842         hci_dev_lock(hdev);
4843
4844         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4845         if (!cmd)
4846                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4847
4848         if (!cmd)
4849                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4850
4851         if (cmd) {
4852                 cmd->cmd_complete(cmd, mgmt_status(status));
4853                 mgmt_pending_remove(cmd);
4854         }
4855
4856         hci_dev_unlock(hdev);
4857
4858         /* Handle suspend notifier */
4859         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4860                                hdev->suspend_tasks)) {
4861                 bt_dev_dbg(hdev, "Unpaused discovery");
4862                 wake_up(&hdev->suspend_wait_q);
4863         }
4864 }
4865
4866 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4867                                     uint8_t *mgmt_status)
4868 {
4869         switch (type) {
4870         case DISCOV_TYPE_LE:
4871                 *mgmt_status = mgmt_le_support(hdev);
4872                 if (*mgmt_status)
4873                         return false;
4874                 break;
4875         case DISCOV_TYPE_INTERLEAVED:
4876                 *mgmt_status = mgmt_le_support(hdev);
4877                 if (*mgmt_status)
4878                         return false;
4879                 fallthrough;
4880         case DISCOV_TYPE_BREDR:
4881                 *mgmt_status = mgmt_bredr_support(hdev);
4882                 if (*mgmt_status)
4883                         return false;
4884                 break;
4885         default:
4886                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4887                 return false;
4888         }
4889
4890         return true;
4891 }
4892
4893 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4894                                     u16 op, void *data, u16 len)
4895 {
4896         struct mgmt_cp_start_discovery *cp = data;
4897         struct mgmt_pending_cmd *cmd;
4898         u8 status;
4899         int err;
4900
4901         bt_dev_dbg(hdev, "sock %p", sk);
4902
4903         hci_dev_lock(hdev);
4904
4905         if (!hdev_is_powered(hdev)) {
4906                 err = mgmt_cmd_complete(sk, hdev->id, op,
4907                                         MGMT_STATUS_NOT_POWERED,
4908                                         &cp->type, sizeof(cp->type));
4909                 goto failed;
4910         }
4911
4912         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4913             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4914                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4915                                         &cp->type, sizeof(cp->type));
4916                 goto failed;
4917         }
4918
4919         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4920                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4921                                         &cp->type, sizeof(cp->type));
4922                 goto failed;
4923         }
4924
4925         /* Can't start discovery when it is paused */
4926         if (hdev->discovery_paused) {
4927                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4928                                         &cp->type, sizeof(cp->type));
4929                 goto failed;
4930         }
4931
4932         /* Clear the discovery filter first to free any previously
4933          * allocated memory for the UUID list.
4934          */
4935         hci_discovery_filter_clear(hdev);
4936
4937         hdev->discovery.type = cp->type;
4938         hdev->discovery.report_invalid_rssi = false;
4939         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4940                 hdev->discovery.limited = true;
4941         else
4942                 hdev->discovery.limited = false;
4943
4944         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4945         if (!cmd) {
4946                 err = -ENOMEM;
4947                 goto failed;
4948         }
4949
4950         cmd->cmd_complete = generic_cmd_complete;
4951
4952         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4953         queue_work(hdev->req_workqueue, &hdev->discov_update);
4954         err = 0;
4955
4956 failed:
4957         hci_dev_unlock(hdev);
4958         return err;
4959 }
4960
4961 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4962                            void *data, u16 len)
4963 {
4964         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4965                                         data, len);
4966 }
4967
4968 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
4969                                    void *data, u16 len)
4970 {
4971         return start_discovery_internal(sk, hdev,
4972                                         MGMT_OP_START_LIMITED_DISCOVERY,
4973                                         data, len);
4974 }
4975
4976 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4977                                           u8 status)
4978 {
4979         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4980                                  cmd->param, 1);
4981 }
4982
4983 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4984                                    void *data, u16 len)
4985 {
4986         struct mgmt_cp_start_service_discovery *cp = data;
4987         struct mgmt_pending_cmd *cmd;
4988         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4989         u16 uuid_count, expected_len;
4990         u8 status;
4991         int err;
4992
4993         bt_dev_dbg(hdev, "sock %p", sk);
4994
4995         hci_dev_lock(hdev);
4996
4997         if (!hdev_is_powered(hdev)) {
4998                 err = mgmt_cmd_complete(sk, hdev->id,
4999                                         MGMT_OP_START_SERVICE_DISCOVERY,
5000                                         MGMT_STATUS_NOT_POWERED,
5001                                         &cp->type, sizeof(cp->type));
5002                 goto failed;
5003         }
5004
5005         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5006             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5007                 err = mgmt_cmd_complete(sk, hdev->id,
5008                                         MGMT_OP_START_SERVICE_DISCOVERY,
5009                                         MGMT_STATUS_BUSY, &cp->type,
5010                                         sizeof(cp->type));
5011                 goto failed;
5012         }
5013
5014         if (hdev->discovery_paused) {
5015                 err = mgmt_cmd_complete(sk, hdev->id,
5016                                         MGMT_OP_START_SERVICE_DISCOVERY,
5017                                         MGMT_STATUS_BUSY, &cp->type,
5018                                         sizeof(cp->type));
5019                 goto failed;
5020         }
5021
5022         uuid_count = __le16_to_cpu(cp->uuid_count);
5023         if (uuid_count > max_uuid_count) {
5024                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5025                            uuid_count);
5026                 err = mgmt_cmd_complete(sk, hdev->id,
5027                                         MGMT_OP_START_SERVICE_DISCOVERY,
5028                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5029                                         sizeof(cp->type));
5030                 goto failed;
5031         }
5032
5033         expected_len = sizeof(*cp) + uuid_count * 16;
5034         if (expected_len != len) {
5035                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5036                            expected_len, len);
5037                 err = mgmt_cmd_complete(sk, hdev->id,
5038                                         MGMT_OP_START_SERVICE_DISCOVERY,
5039                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5040                                         sizeof(cp->type));
5041                 goto failed;
5042         }
5043
5044         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5045                 err = mgmt_cmd_complete(sk, hdev->id,
5046                                         MGMT_OP_START_SERVICE_DISCOVERY,
5047                                         status, &cp->type, sizeof(cp->type));
5048                 goto failed;
5049         }
5050
5051         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5052                                hdev, data, len);
5053         if (!cmd) {
5054                 err = -ENOMEM;
5055                 goto failed;
5056         }
5057
5058         cmd->cmd_complete = service_discovery_cmd_complete;
5059
5060         /* Clear the discovery filter first to free any previously
5061          * allocated memory for the UUID list.
5062          */
5063         hci_discovery_filter_clear(hdev);
5064
5065         hdev->discovery.result_filtering = true;
5066         hdev->discovery.type = cp->type;
5067         hdev->discovery.rssi = cp->rssi;
5068         hdev->discovery.uuid_count = uuid_count;
5069
5070         if (uuid_count > 0) {
5071                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5072                                                 GFP_KERNEL);
5073                 if (!hdev->discovery.uuids) {
5074                         err = mgmt_cmd_complete(sk, hdev->id,
5075                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5076                                                 MGMT_STATUS_FAILED,
5077                                                 &cp->type, sizeof(cp->type));
5078                         mgmt_pending_remove(cmd);
5079                         goto failed;
5080                 }
5081         }
5082
5083         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5084         queue_work(hdev->req_workqueue, &hdev->discov_update);
5085         err = 0;
5086
5087 failed:
5088         hci_dev_unlock(hdev);
5089         return err;
5090 }
5091
5092 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5093 {
5094         struct mgmt_pending_cmd *cmd;
5095
5096         bt_dev_dbg(hdev, "status %u", status);
5097
5098         hci_dev_lock(hdev);
5099
5100         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5101         if (cmd) {
5102                 cmd->cmd_complete(cmd, mgmt_status(status));
5103                 mgmt_pending_remove(cmd);
5104         }
5105
5106         hci_dev_unlock(hdev);
5107
5108         /* Handle suspend notifier */
5109         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5110                 bt_dev_dbg(hdev, "Paused discovery");
5111                 wake_up(&hdev->suspend_wait_q);
5112         }
5113 }
5114
5115 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5116                           u16 len)
5117 {
5118         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5119         struct mgmt_pending_cmd *cmd;
5120         int err;
5121
5122         bt_dev_dbg(hdev, "sock %p", sk);
5123
5124         hci_dev_lock(hdev);
5125
5126         if (!hci_discovery_active(hdev)) {
5127                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5128                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5129                                         sizeof(mgmt_cp->type));
5130                 goto unlock;
5131         }
5132
5133         if (hdev->discovery.type != mgmt_cp->type) {
5134                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5135                                         MGMT_STATUS_INVALID_PARAMS,
5136                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5137                 goto unlock;
5138         }
5139
5140         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5141         if (!cmd) {
5142                 err = -ENOMEM;
5143                 goto unlock;
5144         }
5145
5146         cmd->cmd_complete = generic_cmd_complete;
5147
5148         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5149         queue_work(hdev->req_workqueue, &hdev->discov_update);
5150         err = 0;
5151
5152 unlock:
5153         hci_dev_unlock(hdev);
5154         return err;
5155 }
5156
5157 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5158                         u16 len)
5159 {
5160         struct mgmt_cp_confirm_name *cp = data;
5161         struct inquiry_entry *e;
5162         int err;
5163
5164         bt_dev_dbg(hdev, "sock %p", sk);
5165
5166         hci_dev_lock(hdev);
5167
5168         if (!hci_discovery_active(hdev)) {
5169                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5170                                         MGMT_STATUS_FAILED, &cp->addr,
5171                                         sizeof(cp->addr));
5172                 goto failed;
5173         }
5174
5175         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5176         if (!e) {
5177                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5178                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5179                                         sizeof(cp->addr));
5180                 goto failed;
5181         }
5182
5183         if (cp->name_known) {
5184                 e->name_state = NAME_KNOWN;
5185                 list_del(&e->list);
5186         } else {
5187                 e->name_state = NAME_NEEDED;
5188                 hci_inquiry_cache_update_resolve(hdev, e);
5189         }
5190
5191         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5192                                 &cp->addr, sizeof(cp->addr));
5193
5194 failed:
5195         hci_dev_unlock(hdev);
5196         return err;
5197 }
5198
5199 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5200                         u16 len)
5201 {
5202         struct mgmt_cp_block_device *cp = data;
5203         u8 status;
5204         int err;
5205
5206         bt_dev_dbg(hdev, "sock %p", sk);
5207
5208         if (!bdaddr_type_is_valid(cp->addr.type))
5209                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5210                                          MGMT_STATUS_INVALID_PARAMS,
5211                                          &cp->addr, sizeof(cp->addr));
5212
5213         hci_dev_lock(hdev);
5214
5215         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
5216                                   cp->addr.type);
5217         if (err < 0) {
5218                 status = MGMT_STATUS_FAILED;
5219                 goto done;
5220         }
5221
5222         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5223                    sk);
5224         status = MGMT_STATUS_SUCCESS;
5225
5226 done:
5227         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5228                                 &cp->addr, sizeof(cp->addr));
5229
5230         hci_dev_unlock(hdev);
5231
5232         return err;
5233 }
5234
5235 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5236                           u16 len)
5237 {
5238         struct mgmt_cp_unblock_device *cp = data;
5239         u8 status;
5240         int err;
5241
5242         bt_dev_dbg(hdev, "sock %p", sk);
5243
5244         if (!bdaddr_type_is_valid(cp->addr.type))
5245                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5246                                          MGMT_STATUS_INVALID_PARAMS,
5247                                          &cp->addr, sizeof(cp->addr));
5248
5249         hci_dev_lock(hdev);
5250
5251         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5252                                   cp->addr.type);
5253         if (err < 0) {
5254                 status = MGMT_STATUS_INVALID_PARAMS;
5255                 goto done;
5256         }
5257
5258         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5259                    sk);
5260         status = MGMT_STATUS_SUCCESS;
5261
5262 done:
5263         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5264                                 &cp->addr, sizeof(cp->addr));
5265
5266         hci_dev_unlock(hdev);
5267
5268         return err;
5269 }
5270
5271 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5272                          u16 len)
5273 {
5274         struct mgmt_cp_set_device_id *cp = data;
5275         struct hci_request req;
5276         int err;
5277         __u16 source;
5278
5279         bt_dev_dbg(hdev, "sock %p", sk);
5280
5281         source = __le16_to_cpu(cp->source);
5282
5283         if (source > 0x0002)
5284                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5285                                        MGMT_STATUS_INVALID_PARAMS);
5286
5287         hci_dev_lock(hdev);
5288
5289         hdev->devid_source = source;
5290         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5291         hdev->devid_product = __le16_to_cpu(cp->product);
5292         hdev->devid_version = __le16_to_cpu(cp->version);
5293
5294         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5295                                 NULL, 0);
5296
5297         hci_req_init(&req, hdev);
5298         __hci_req_update_eir(&req);
5299         hci_req_run(&req, NULL);
5300
5301         hci_dev_unlock(hdev);
5302
5303         return err;
5304 }
5305
5306 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5307                                         u16 opcode)
5308 {
5309         bt_dev_dbg(hdev, "status %u", status);
5310 }
5311
5312 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5313                                      u16 opcode)
5314 {
5315         struct cmd_lookup match = { NULL, hdev };
5316         struct hci_request req;
5317         u8 instance;
5318         struct adv_info *adv_instance;
5319         int err;
5320
5321         hci_dev_lock(hdev);
5322
5323         if (status) {
5324                 u8 mgmt_err = mgmt_status(status);
5325
5326                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5327                                      cmd_status_rsp, &mgmt_err);
5328                 goto unlock;
5329         }
5330
5331         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5332                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5333         else
5334                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5335
5336         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5337                              &match);
5338
5339         new_settings(hdev, match.sk);
5340
5341         if (match.sk)
5342                 sock_put(match.sk);
5343
5344         /* Handle suspend notifier */
5345         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5346                                hdev->suspend_tasks)) {
5347                 bt_dev_dbg(hdev, "Paused advertising");
5348                 wake_up(&hdev->suspend_wait_q);
5349         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5350                                       hdev->suspend_tasks)) {
5351                 bt_dev_dbg(hdev, "Unpaused advertising");
5352                 wake_up(&hdev->suspend_wait_q);
5353         }
5354
5355         /* If "Set Advertising" was just disabled and instance advertising was
5356          * set up earlier, then re-enable multi-instance advertising.
5357          */
5358         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5359             list_empty(&hdev->adv_instances))
5360                 goto unlock;
5361
5362         instance = hdev->cur_adv_instance;
5363         if (!instance) {
5364                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5365                                                         struct adv_info, list);
5366                 if (!adv_instance)
5367                         goto unlock;
5368
5369                 instance = adv_instance->instance;
5370         }
5371
5372         hci_req_init(&req, hdev);
5373
5374         err = __hci_req_schedule_adv_instance(&req, instance, true);
5375
5376         if (!err)
5377                 err = hci_req_run(&req, enable_advertising_instance);
5378
5379         if (err)
5380                 bt_dev_err(hdev, "failed to re-configure advertising");
5381
5382 unlock:
5383         hci_dev_unlock(hdev);
5384 }
5385
5386 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5387                            u16 len)
5388 {
5389         struct mgmt_mode *cp = data;
5390         struct mgmt_pending_cmd *cmd;
5391         struct hci_request req;
5392         u8 val, status;
5393         int err;
5394
5395         bt_dev_dbg(hdev, "sock %p", sk);
5396
5397         status = mgmt_le_support(hdev);
5398         if (status)
5399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5400                                        status);
5401
5402         /* Enabling the experimental LL Privay support disables support for
5403          * advertising.
5404          */
5405         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5406                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5407                                        MGMT_STATUS_NOT_SUPPORTED);
5408
5409         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5410                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5411                                        MGMT_STATUS_INVALID_PARAMS);
5412
5413         if (hdev->advertising_paused)
5414                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5415                                        MGMT_STATUS_BUSY);
5416
5417         hci_dev_lock(hdev);
5418
5419         val = !!cp->val;
5420
5421         /* The following conditions are ones which mean that we should
5422          * not do any HCI communication but directly send a mgmt
5423          * response to user space (after toggling the flag if
5424          * necessary).
5425          */
5426         if (!hdev_is_powered(hdev) ||
5427             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5428              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5429             hci_conn_num(hdev, LE_LINK) > 0 ||
5430             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5431              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5432                 bool changed;
5433
5434                 if (cp->val) {
5435                         hdev->cur_adv_instance = 0x00;
5436                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5437                         if (cp->val == 0x02)
5438                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5439                         else
5440                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5441                 } else {
5442                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5443                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5444                 }
5445
5446                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5447                 if (err < 0)
5448                         goto unlock;
5449
5450                 if (changed)
5451                         err = new_settings(hdev, sk);
5452
5453                 goto unlock;
5454         }
5455
5456         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5457             pending_find(MGMT_OP_SET_LE, hdev)) {
5458                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5459                                       MGMT_STATUS_BUSY);
5460                 goto unlock;
5461         }
5462
5463         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5464         if (!cmd) {
5465                 err = -ENOMEM;
5466                 goto unlock;
5467         }
5468
5469         hci_req_init(&req, hdev);
5470
5471         if (cp->val == 0x02)
5472                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5473         else
5474                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5475
5476         cancel_adv_timeout(hdev);
5477
5478         if (val) {
5479                 /* Switch to instance "0" for the Set Advertising setting.
5480                  * We cannot use update_[adv|scan_rsp]_data() here as the
5481                  * HCI_ADVERTISING flag is not yet set.
5482                  */
5483                 hdev->cur_adv_instance = 0x00;
5484
5485                 if (ext_adv_capable(hdev)) {
5486                         __hci_req_start_ext_adv(&req, 0x00);
5487                 } else {
5488                         __hci_req_update_adv_data(&req, 0x00);
5489                         __hci_req_update_scan_rsp_data(&req, 0x00);
5490                         __hci_req_enable_advertising(&req);
5491                 }
5492         } else {
5493                 __hci_req_disable_advertising(&req);
5494         }
5495
5496         err = hci_req_run(&req, set_advertising_complete);
5497         if (err < 0)
5498                 mgmt_pending_remove(cmd);
5499
5500 unlock:
5501         hci_dev_unlock(hdev);
5502         return err;
5503 }
5504
5505 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5506                               void *data, u16 len)
5507 {
5508         struct mgmt_cp_set_static_address *cp = data;
5509         int err;
5510
5511         bt_dev_dbg(hdev, "sock %p", sk);
5512
5513         if (!lmp_le_capable(hdev))
5514                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5515                                        MGMT_STATUS_NOT_SUPPORTED);
5516
5517         if (hdev_is_powered(hdev))
5518                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5519                                        MGMT_STATUS_REJECTED);
5520
5521         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5522                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5523                         return mgmt_cmd_status(sk, hdev->id,
5524                                                MGMT_OP_SET_STATIC_ADDRESS,
5525                                                MGMT_STATUS_INVALID_PARAMS);
5526
5527                 /* Two most significant bits shall be set */
5528                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5529                         return mgmt_cmd_status(sk, hdev->id,
5530                                                MGMT_OP_SET_STATIC_ADDRESS,
5531                                                MGMT_STATUS_INVALID_PARAMS);
5532         }
5533
5534         hci_dev_lock(hdev);
5535
5536         bacpy(&hdev->static_addr, &cp->bdaddr);
5537
5538         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5539         if (err < 0)
5540                 goto unlock;
5541
5542         err = new_settings(hdev, sk);
5543
5544 unlock:
5545         hci_dev_unlock(hdev);
5546         return err;
5547 }
5548
5549 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5550                            void *data, u16 len)
5551 {
5552         struct mgmt_cp_set_scan_params *cp = data;
5553         __u16 interval, window;
5554         int err;
5555
5556         bt_dev_dbg(hdev, "sock %p", sk);
5557
5558         if (!lmp_le_capable(hdev))
5559                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5560                                        MGMT_STATUS_NOT_SUPPORTED);
5561
5562         interval = __le16_to_cpu(cp->interval);
5563
5564         if (interval < 0x0004 || interval > 0x4000)
5565                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5566                                        MGMT_STATUS_INVALID_PARAMS);
5567
5568         window = __le16_to_cpu(cp->window);
5569
5570         if (window < 0x0004 || window > 0x4000)
5571                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5572                                        MGMT_STATUS_INVALID_PARAMS);
5573
5574         if (window > interval)
5575                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5576                                        MGMT_STATUS_INVALID_PARAMS);
5577
5578         hci_dev_lock(hdev);
5579
5580         hdev->le_scan_interval = interval;
5581         hdev->le_scan_window = window;
5582
5583         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5584                                 NULL, 0);
5585
5586         /* If background scan is running, restart it so new parameters are
5587          * loaded.
5588          */
5589         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5590             hdev->discovery.state == DISCOVERY_STOPPED) {
5591                 struct hci_request req;
5592
5593                 hci_req_init(&req, hdev);
5594
5595                 hci_req_add_le_scan_disable(&req, false);
5596                 hci_req_add_le_passive_scan(&req);
5597
5598                 hci_req_run(&req, NULL);
5599         }
5600
5601         hci_dev_unlock(hdev);
5602
5603         return err;
5604 }
5605
5606 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5607                                       u16 opcode)
5608 {
5609         struct mgmt_pending_cmd *cmd;
5610
5611         bt_dev_dbg(hdev, "status 0x%02x", status);
5612
5613         hci_dev_lock(hdev);
5614
5615         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5616         if (!cmd)
5617                 goto unlock;
5618
5619         if (status) {
5620                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5621                                 mgmt_status(status));
5622         } else {
5623                 struct mgmt_mode *cp = cmd->param;
5624
5625                 if (cp->val)
5626                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5627                 else
5628                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5629
5630                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5631                 new_settings(hdev, cmd->sk);
5632         }
5633
5634         mgmt_pending_remove(cmd);
5635
5636 unlock:
5637         hci_dev_unlock(hdev);
5638 }
5639
5640 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5641                                 void *data, u16 len)
5642 {
5643         struct mgmt_mode *cp = data;
5644         struct mgmt_pending_cmd *cmd;
5645         struct hci_request req;
5646         int err;
5647
5648         bt_dev_dbg(hdev, "sock %p", sk);
5649
5650         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5651             hdev->hci_ver < BLUETOOTH_VER_1_2)
5652                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5653                                        MGMT_STATUS_NOT_SUPPORTED);
5654
5655         if (cp->val != 0x00 && cp->val != 0x01)
5656                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5657                                        MGMT_STATUS_INVALID_PARAMS);
5658
5659         hci_dev_lock(hdev);
5660
5661         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5662                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5663                                       MGMT_STATUS_BUSY);
5664                 goto unlock;
5665         }
5666
5667         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5668                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5669                                         hdev);
5670                 goto unlock;
5671         }
5672
5673         if (!hdev_is_powered(hdev)) {
5674                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5675                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5676                                         hdev);
5677                 new_settings(hdev, sk);
5678                 goto unlock;
5679         }
5680
5681         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5682                                data, len);
5683         if (!cmd) {
5684                 err = -ENOMEM;
5685                 goto unlock;
5686         }
5687
5688         hci_req_init(&req, hdev);
5689
5690         __hci_req_write_fast_connectable(&req, cp->val);
5691
5692         err = hci_req_run(&req, fast_connectable_complete);
5693         if (err < 0) {
5694                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5695                                       MGMT_STATUS_FAILED);
5696                 mgmt_pending_remove(cmd);
5697         }
5698
5699 unlock:
5700         hci_dev_unlock(hdev);
5701
5702         return err;
5703 }
5704
5705 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5706 {
5707         struct mgmt_pending_cmd *cmd;
5708
5709         bt_dev_dbg(hdev, "status 0x%02x", status);
5710
5711         hci_dev_lock(hdev);
5712
5713         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5714         if (!cmd)
5715                 goto unlock;
5716
5717         if (status) {
5718                 u8 mgmt_err = mgmt_status(status);
5719
5720                 /* We need to restore the flag if related HCI commands
5721                  * failed.
5722                  */
5723                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5724
5725                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5726         } else {
5727                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5728                 new_settings(hdev, cmd->sk);
5729         }
5730
5731         mgmt_pending_remove(cmd);
5732
5733 unlock:
5734         hci_dev_unlock(hdev);
5735 }
5736
5737 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5738 {
5739         struct mgmt_mode *cp = data;
5740         struct mgmt_pending_cmd *cmd;
5741         struct hci_request req;
5742         int err;
5743
5744         bt_dev_dbg(hdev, "sock %p", sk);
5745
5746         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5747                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5748                                        MGMT_STATUS_NOT_SUPPORTED);
5749
5750         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5751                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5752                                        MGMT_STATUS_REJECTED);
5753
5754         if (cp->val != 0x00 && cp->val != 0x01)
5755                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5756                                        MGMT_STATUS_INVALID_PARAMS);
5757
5758         hci_dev_lock(hdev);
5759
5760         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5761                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5762                 goto unlock;
5763         }
5764
5765         if (!hdev_is_powered(hdev)) {
5766                 if (!cp->val) {
5767                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5768                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5769                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5770                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5771                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5772                 }
5773
5774                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5775
5776                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5777                 if (err < 0)
5778                         goto unlock;
5779
5780                 err = new_settings(hdev, sk);
5781                 goto unlock;
5782         }
5783
5784         /* Reject disabling when powered on */
5785         if (!cp->val) {
5786                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5787                                       MGMT_STATUS_REJECTED);
5788                 goto unlock;
5789         } else {
5790                 /* When configuring a dual-mode controller to operate
5791                  * with LE only and using a static address, then switching
5792                  * BR/EDR back on is not allowed.
5793                  *
5794                  * Dual-mode controllers shall operate with the public
5795                  * address as its identity address for BR/EDR and LE. So
5796                  * reject the attempt to create an invalid configuration.
5797                  *
5798                  * The same restrictions applies when secure connections
5799                  * has been enabled. For BR/EDR this is a controller feature
5800                  * while for LE it is a host stack feature. This means that
5801                  * switching BR/EDR back on when secure connections has been
5802                  * enabled is not a supported transaction.
5803                  */
5804                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5805                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5806                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5807                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5808                                               MGMT_STATUS_REJECTED);
5809                         goto unlock;
5810                 }
5811         }
5812
5813         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5814                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5815                                       MGMT_STATUS_BUSY);
5816                 goto unlock;
5817         }
5818
5819         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5820         if (!cmd) {
5821                 err = -ENOMEM;
5822                 goto unlock;
5823         }
5824
5825         /* We need to flip the bit already here so that
5826          * hci_req_update_adv_data generates the correct flags.
5827          */
5828         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5829
5830         hci_req_init(&req, hdev);
5831
5832         __hci_req_write_fast_connectable(&req, false);
5833         __hci_req_update_scan(&req);
5834
5835         /* Since only the advertising data flags will change, there
5836          * is no need to update the scan response data.
5837          */
5838         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5839
5840         err = hci_req_run(&req, set_bredr_complete);
5841         if (err < 0)
5842                 mgmt_pending_remove(cmd);
5843
5844 unlock:
5845         hci_dev_unlock(hdev);
5846         return err;
5847 }
5848
5849 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5850 {
5851         struct mgmt_pending_cmd *cmd;
5852         struct mgmt_mode *cp;
5853
5854         bt_dev_dbg(hdev, "status %u", status);
5855
5856         hci_dev_lock(hdev);
5857
5858         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5859         if (!cmd)
5860                 goto unlock;
5861
5862         if (status) {
5863                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5864                                 mgmt_status(status));
5865                 goto remove;
5866         }
5867
5868         cp = cmd->param;
5869
5870         switch (cp->val) {
5871         case 0x00:
5872                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5873                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5874                 break;
5875         case 0x01:
5876                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5877                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5878                 break;
5879         case 0x02:
5880                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5881                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5882                 break;
5883         }
5884
5885         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5886         new_settings(hdev, cmd->sk);
5887
5888 remove:
5889         mgmt_pending_remove(cmd);
5890 unlock:
5891         hci_dev_unlock(hdev);
5892 }
5893
5894 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5895                            void *data, u16 len)
5896 {
5897         struct mgmt_mode *cp = data;
5898         struct mgmt_pending_cmd *cmd;
5899         struct hci_request req;
5900         u8 val;
5901         int err;
5902
5903         bt_dev_dbg(hdev, "sock %p", sk);
5904
5905         if (!lmp_sc_capable(hdev) &&
5906             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5907                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5908                                        MGMT_STATUS_NOT_SUPPORTED);
5909
5910         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5911             lmp_sc_capable(hdev) &&
5912             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5913                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5914                                        MGMT_STATUS_REJECTED);
5915
5916         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5917                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5918                                   MGMT_STATUS_INVALID_PARAMS);
5919
5920         hci_dev_lock(hdev);
5921
5922         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5923             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5924                 bool changed;
5925
5926                 if (cp->val) {
5927                         changed = !hci_dev_test_and_set_flag(hdev,
5928                                                              HCI_SC_ENABLED);
5929                         if (cp->val == 0x02)
5930                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5931                         else
5932                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5933                 } else {
5934                         changed = hci_dev_test_and_clear_flag(hdev,
5935                                                               HCI_SC_ENABLED);
5936                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5937                 }
5938
5939                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5940                 if (err < 0)
5941                         goto failed;
5942
5943                 if (changed)
5944                         err = new_settings(hdev, sk);
5945
5946                 goto failed;
5947         }
5948
5949         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5950                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5951                                       MGMT_STATUS_BUSY);
5952                 goto failed;
5953         }
5954
5955         val = !!cp->val;
5956
5957         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5958             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5959                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5960                 goto failed;
5961         }
5962
5963         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5964         if (!cmd) {
5965                 err = -ENOMEM;
5966                 goto failed;
5967         }
5968
5969         hci_req_init(&req, hdev);
5970         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5971         err = hci_req_run(&req, sc_enable_complete);
5972         if (err < 0) {
5973                 mgmt_pending_remove(cmd);
5974                 goto failed;
5975         }
5976
5977 failed:
5978         hci_dev_unlock(hdev);
5979         return err;
5980 }
5981
5982 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5983                           void *data, u16 len)
5984 {
5985         struct mgmt_mode *cp = data;
5986         bool changed, use_changed;
5987         int err;
5988
5989         bt_dev_dbg(hdev, "sock %p", sk);
5990
5991         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5992                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5993                                        MGMT_STATUS_INVALID_PARAMS);
5994
5995         hci_dev_lock(hdev);
5996
5997         if (cp->val)
5998                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5999         else
6000                 changed = hci_dev_test_and_clear_flag(hdev,
6001                                                       HCI_KEEP_DEBUG_KEYS);
6002
6003         if (cp->val == 0x02)
6004                 use_changed = !hci_dev_test_and_set_flag(hdev,
6005                                                          HCI_USE_DEBUG_KEYS);
6006         else
6007                 use_changed = hci_dev_test_and_clear_flag(hdev,
6008                                                           HCI_USE_DEBUG_KEYS);
6009
6010         if (hdev_is_powered(hdev) && use_changed &&
6011             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6012                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6013                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6014                              sizeof(mode), &mode);
6015         }
6016
6017         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6018         if (err < 0)
6019                 goto unlock;
6020
6021         if (changed)
6022                 err = new_settings(hdev, sk);
6023
6024 unlock:
6025         hci_dev_unlock(hdev);
6026         return err;
6027 }
6028
6029 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6030                        u16 len)
6031 {
6032         struct mgmt_cp_set_privacy *cp = cp_data;
6033         bool changed;
6034         int err;
6035
6036         bt_dev_dbg(hdev, "sock %p", sk);
6037
6038         if (!lmp_le_capable(hdev))
6039                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6040                                        MGMT_STATUS_NOT_SUPPORTED);
6041
6042         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6043                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6044                                        MGMT_STATUS_INVALID_PARAMS);
6045
6046         if (hdev_is_powered(hdev))
6047                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6048                                        MGMT_STATUS_REJECTED);
6049
6050         hci_dev_lock(hdev);
6051
6052         /* If user space supports this command it is also expected to
6053          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6054          */
6055         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6056
6057         if (cp->privacy) {
6058                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6059                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6060                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6061                 hci_adv_instances_set_rpa_expired(hdev, true);
6062                 if (cp->privacy == 0x02)
6063                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6064                 else
6065                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6066         } else {
6067                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6068                 memset(hdev->irk, 0, sizeof(hdev->irk));
6069                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6070                 hci_adv_instances_set_rpa_expired(hdev, false);
6071                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6072         }
6073
6074         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6075         if (err < 0)
6076                 goto unlock;
6077
6078         if (changed)
6079                 err = new_settings(hdev, sk);
6080
6081 unlock:
6082         hci_dev_unlock(hdev);
6083         return err;
6084 }
6085
6086 static bool irk_is_valid(struct mgmt_irk_info *irk)
6087 {
6088         switch (irk->addr.type) {
6089         case BDADDR_LE_PUBLIC:
6090                 return true;
6091
6092         case BDADDR_LE_RANDOM:
6093                 /* Two most significant bits shall be set */
6094                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6095                         return false;
6096                 return true;
6097         }
6098
6099         return false;
6100 }
6101
6102 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6103                      u16 len)
6104 {
6105         struct mgmt_cp_load_irks *cp = cp_data;
6106         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6107                                    sizeof(struct mgmt_irk_info));
6108         u16 irk_count, expected_len;
6109         int i, err;
6110
6111         bt_dev_dbg(hdev, "sock %p", sk);
6112
6113         if (!lmp_le_capable(hdev))
6114                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6115                                        MGMT_STATUS_NOT_SUPPORTED);
6116
6117         irk_count = __le16_to_cpu(cp->irk_count);
6118         if (irk_count > max_irk_count) {
6119                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6120                            irk_count);
6121                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6122                                        MGMT_STATUS_INVALID_PARAMS);
6123         }
6124
6125         expected_len = struct_size(cp, irks, irk_count);
6126         if (expected_len != len) {
6127                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6128                            expected_len, len);
6129                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6130                                        MGMT_STATUS_INVALID_PARAMS);
6131         }
6132
6133         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6134
6135         for (i = 0; i < irk_count; i++) {
6136                 struct mgmt_irk_info *key = &cp->irks[i];
6137
6138                 if (!irk_is_valid(key))
6139                         return mgmt_cmd_status(sk, hdev->id,
6140                                                MGMT_OP_LOAD_IRKS,
6141                                                MGMT_STATUS_INVALID_PARAMS);
6142         }
6143
6144         hci_dev_lock(hdev);
6145
6146         hci_smp_irks_clear(hdev);
6147
6148         for (i = 0; i < irk_count; i++) {
6149                 struct mgmt_irk_info *irk = &cp->irks[i];
6150
6151                 if (hci_is_blocked_key(hdev,
6152                                        HCI_BLOCKED_KEY_TYPE_IRK,
6153                                        irk->val)) {
6154                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6155                                     &irk->addr.bdaddr);
6156                         continue;
6157                 }
6158
6159                 hci_add_irk(hdev, &irk->addr.bdaddr,
6160                             le_addr_type(irk->addr.type), irk->val,
6161                             BDADDR_ANY);
6162         }
6163
6164         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6165
6166         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6167
6168         hci_dev_unlock(hdev);
6169
6170         return err;
6171 }
6172
6173 #ifdef TIZEN_BT
6174 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
6175                         void *data, u16 len)
6176 {
6177         struct mgmt_cp_set_advertising_params *cp = data;
6178         __u16 min_interval;
6179         __u16 max_interval;
6180         int err;
6181
6182         BT_DBG("%s", hdev->name);
6183
6184         if (!lmp_le_capable(hdev))
6185                 return mgmt_cmd_status(sk, hdev->id,
6186                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6187                                 MGMT_STATUS_NOT_SUPPORTED);
6188
6189         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6190                 return mgmt_cmd_status(sk, hdev->id,
6191                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6192                                 MGMT_STATUS_BUSY);
6193
6194         min_interval = __le16_to_cpu(cp->interval_min);
6195         max_interval = __le16_to_cpu(cp->interval_max);
6196
6197         if (min_interval > max_interval ||
6198             min_interval < 0x0020 || max_interval > 0x4000)
6199                 return mgmt_cmd_status(sk, hdev->id,
6200                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6201                                 MGMT_STATUS_INVALID_PARAMS);
6202
6203         hci_dev_lock(hdev);
6204
6205         hdev->le_adv_min_interval = min_interval;
6206         hdev->le_adv_max_interval = max_interval;
6207         hdev->adv_filter_policy = cp->filter_policy;
6208         hdev->adv_type = cp->type;
6209
6210         err = mgmt_cmd_complete(sk, hdev->id,
6211                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
6212
6213         hci_dev_unlock(hdev);
6214
6215         return err;
6216 }
6217
6218 static void set_advertising_data_complete(struct hci_dev *hdev,
6219                         u8 status, u16 opcode)
6220 {
6221         struct mgmt_cp_set_advertising_data *cp;
6222         struct mgmt_pending_cmd *cmd;
6223
6224         BT_DBG("status 0x%02x", status);
6225
6226         hci_dev_lock(hdev);
6227
6228         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
6229         if (!cmd)
6230                 goto unlock;
6231
6232         cp = cmd->param;
6233
6234         if (status)
6235                 mgmt_cmd_status(cmd->sk, hdev->id,
6236                                 MGMT_OP_SET_ADVERTISING_DATA,
6237                                 mgmt_status(status));
6238         else
6239                 mgmt_cmd_complete(cmd->sk, hdev->id,
6240                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
6241                                 cp, sizeof(*cp));
6242
6243         mgmt_pending_remove(cmd);
6244
6245 unlock:
6246         hci_dev_unlock(hdev);
6247 }
6248
6249 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
6250                         void *data, u16 len)
6251 {
6252         struct mgmt_pending_cmd *cmd;
6253         struct hci_request req;
6254         struct mgmt_cp_set_advertising_data *cp = data;
6255         struct hci_cp_le_set_adv_data adv;
6256         int err;
6257
6258         BT_DBG("%s", hdev->name);
6259
6260         if (!lmp_le_capable(hdev)) {
6261                 return mgmt_cmd_status(sk, hdev->id,
6262                                 MGMT_OP_SET_ADVERTISING_DATA,
6263                                 MGMT_STATUS_NOT_SUPPORTED);
6264         }
6265
6266         hci_dev_lock(hdev);
6267
6268         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
6269                 err = mgmt_cmd_status(sk, hdev->id,
6270                                 MGMT_OP_SET_ADVERTISING_DATA,
6271                                 MGMT_STATUS_BUSY);
6272                 goto unlocked;
6273         }
6274
6275         if (len > HCI_MAX_AD_LENGTH) {
6276                 err = mgmt_cmd_status(sk, hdev->id,
6277                                 MGMT_OP_SET_ADVERTISING_DATA,
6278                                 MGMT_STATUS_INVALID_PARAMS);
6279                 goto unlocked;
6280         }
6281
6282         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
6283                                hdev, data, len);
6284         if (!cmd) {
6285                 err = -ENOMEM;
6286                 goto unlocked;
6287         }
6288
6289         hci_req_init(&req, hdev);
6290
6291         memset(&adv, 0, sizeof(adv));
6292         memcpy(adv.data, cp->data, len);
6293         adv.length = len;
6294
6295         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
6296
6297         err = hci_req_run(&req, set_advertising_data_complete);
6298         if (err < 0)
6299                 mgmt_pending_remove(cmd);
6300
6301 unlocked:
6302         hci_dev_unlock(hdev);
6303
6304         return err;
6305 }
6306
6307 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
6308                         u16 opcode)
6309 {
6310         struct mgmt_cp_set_scan_rsp_data *cp;
6311         struct mgmt_pending_cmd *cmd;
6312
6313         BT_DBG("status 0x%02x", status);
6314
6315         hci_dev_lock(hdev);
6316
6317         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
6318         if (!cmd)
6319                 goto unlock;
6320
6321         cp = cmd->param;
6322
6323         if (status)
6324                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6325                                 mgmt_status(status));
6326         else
6327                 mgmt_cmd_complete(cmd->sk, hdev->id,
6328                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
6329                                 cp, sizeof(*cp));
6330
6331         mgmt_pending_remove(cmd);
6332
6333 unlock:
6334         hci_dev_unlock(hdev);
6335 }
6336
6337 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
6338                         u16 len)
6339 {
6340         struct mgmt_pending_cmd *cmd;
6341         struct hci_request req;
6342         struct mgmt_cp_set_scan_rsp_data *cp = data;
6343         struct hci_cp_le_set_scan_rsp_data rsp;
6344         int err;
6345
6346         BT_DBG("%s", hdev->name);
6347
6348         if (!lmp_le_capable(hdev))
6349                 return mgmt_cmd_status(sk, hdev->id,
6350                                 MGMT_OP_SET_SCAN_RSP_DATA,
6351                                 MGMT_STATUS_NOT_SUPPORTED);
6352
6353         hci_dev_lock(hdev);
6354
6355         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
6356                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6357                                 MGMT_STATUS_BUSY);
6358                 goto unlocked;
6359         }
6360
6361         if (len > HCI_MAX_AD_LENGTH) {
6362                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6363                                 MGMT_STATUS_INVALID_PARAMS);
6364                 goto unlocked;
6365         }
6366
6367         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
6368         if (!cmd) {
6369                 err = -ENOMEM;
6370                 goto unlocked;
6371         }
6372
6373         hci_req_init(&req, hdev);
6374
6375         memset(&rsp, 0, sizeof(rsp));
6376         memcpy(rsp.data, cp->data, len);
6377         rsp.length = len;
6378
6379         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
6380
6381         err = hci_req_run(&req, set_scan_rsp_data_complete);
6382         if (err < 0)
6383                 mgmt_pending_remove(cmd);
6384
6385 unlocked:
6386         hci_dev_unlock(hdev);
6387
6388         return err;
6389 }
6390
6391 /* Adv White List feature */
6392 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6393 {
6394         struct mgmt_cp_add_dev_white_list *cp;
6395         struct mgmt_pending_cmd *cmd;
6396
6397         BT_DBG("status 0x%02x", status);
6398
6399         hci_dev_lock(hdev);
6400
6401         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
6402         if (!cmd)
6403                 goto unlock;
6404
6405         cp = cmd->param;
6406
6407         if (status)
6408                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6409                            mgmt_status(status));
6410         else
6411                 mgmt_cmd_complete(cmd->sk, hdev->id,
6412                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
6413
6414         mgmt_pending_remove(cmd);
6415
6416 unlock:
6417         hci_dev_unlock(hdev);
6418 }
6419
6420 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
6421                            void *data, u16 len)
6422 {
6423         struct mgmt_pending_cmd *cmd;
6424         struct mgmt_cp_add_dev_white_list *cp = data;
6425         struct hci_request req;
6426         int err;
6427
6428         BT_DBG("%s", hdev->name);
6429
6430         if (!lmp_le_capable(hdev))
6431                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6432                                   MGMT_STATUS_NOT_SUPPORTED);
6433
6434         if (!hdev_is_powered(hdev))
6435                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6436                                   MGMT_STATUS_REJECTED);
6437
6438         hci_dev_lock(hdev);
6439
6440         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
6441                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6442                                 MGMT_STATUS_BUSY);
6443                 goto unlocked;
6444         }
6445
6446         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
6447         if (!cmd) {
6448                 err = -ENOMEM;
6449                 goto unlocked;
6450         }
6451
6452         hci_req_init(&req, hdev);
6453
6454         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
6455
6456         err = hci_req_run(&req, add_white_list_complete);
6457         if (err < 0) {
6458                 mgmt_pending_remove(cmd);
6459                 goto unlocked;
6460         }
6461
6462 unlocked:
6463         hci_dev_unlock(hdev);
6464
6465         return err;
6466 }
6467
6468 static void remove_from_white_list_complete(struct hci_dev *hdev,
6469                         u8 status, u16 opcode)
6470 {
6471         struct mgmt_cp_remove_dev_from_white_list *cp;
6472         struct mgmt_pending_cmd *cmd;
6473
6474         BT_DBG("status 0x%02x", status);
6475
6476         hci_dev_lock(hdev);
6477
6478         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
6479         if (!cmd)
6480                 goto unlock;
6481
6482         cp = cmd->param;
6483
6484         if (status)
6485                 mgmt_cmd_status(cmd->sk, hdev->id,
6486                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6487                         mgmt_status(status));
6488         else
6489                 mgmt_cmd_complete(cmd->sk, hdev->id,
6490                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
6491                         cp, sizeof(*cp));
6492
6493         mgmt_pending_remove(cmd);
6494
6495 unlock:
6496         hci_dev_unlock(hdev);
6497 }
6498
6499 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
6500                            void *data, u16 len)
6501 {
6502         struct mgmt_pending_cmd *cmd;
6503         struct mgmt_cp_remove_dev_from_white_list *cp = data;
6504         struct hci_request req;
6505         int err;
6506
6507         BT_DBG("%s", hdev->name);
6508
6509         if (!lmp_le_capable(hdev))
6510                 return mgmt_cmd_status(sk, hdev->id,
6511                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6512                                 MGMT_STATUS_NOT_SUPPORTED);
6513
6514         if (!hdev_is_powered(hdev))
6515                 return mgmt_cmd_status(sk, hdev->id,
6516                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6517                                 MGMT_STATUS_REJECTED);
6518
6519         hci_dev_lock(hdev);
6520
6521         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
6522                 err = mgmt_cmd_status(sk, hdev->id,
6523                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6524                                 MGMT_STATUS_BUSY);
6525                 goto unlocked;
6526         }
6527
6528         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6529                                 hdev, data, len);
6530         if (!cmd) {
6531                 err = -ENOMEM;
6532                 goto unlocked;
6533         }
6534
6535         hci_req_init(&req, hdev);
6536
6537         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
6538
6539         err = hci_req_run(&req, remove_from_white_list_complete);
6540         if (err < 0) {
6541                 mgmt_pending_remove(cmd);
6542                 goto unlocked;
6543         }
6544
6545 unlocked:
6546         hci_dev_unlock(hdev);
6547
6548         return err;
6549 }
6550
6551 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
6552                         u16 opcode)
6553 {
6554         struct mgmt_pending_cmd *cmd;
6555
6556         BT_DBG("status 0x%02x", status);
6557
6558         hci_dev_lock(hdev);
6559
6560         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
6561         if (!cmd)
6562                 goto unlock;
6563
6564         if (status)
6565                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6566                            mgmt_status(status));
6567         else
6568                 mgmt_cmd_complete(cmd->sk, hdev->id,
6569                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6570                                 0, NULL, 0);
6571
6572         mgmt_pending_remove(cmd);
6573
6574 unlock:
6575         hci_dev_unlock(hdev);
6576 }
6577
6578 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
6579                            void *data, u16 len)
6580 {
6581         struct mgmt_pending_cmd *cmd;
6582         struct hci_request req;
6583         int err;
6584
6585         BT_DBG("%s", hdev->name);
6586
6587         if (!lmp_le_capable(hdev))
6588                 return mgmt_cmd_status(sk, hdev->id,
6589                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6590                                 MGMT_STATUS_NOT_SUPPORTED);
6591
6592         if (!hdev_is_powered(hdev))
6593                 return mgmt_cmd_status(sk, hdev->id,
6594                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6595                                 MGMT_STATUS_REJECTED);
6596
6597         hci_dev_lock(hdev);
6598
6599         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
6600                 err = mgmt_cmd_status(sk, hdev->id,
6601                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6602                                 MGMT_STATUS_BUSY);
6603                 goto unlocked;
6604         }
6605
6606         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6607                                 hdev, NULL, 0);
6608         if (!cmd) {
6609                 err = -ENOMEM;
6610                 goto unlocked;
6611         }
6612
6613         hci_req_init(&req, hdev);
6614
6615         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
6616
6617         err = hci_req_run(&req, clear_white_list_complete);
6618         if (err < 0) {
6619                 mgmt_pending_remove(cmd);
6620                 goto unlocked;
6621         }
6622
6623 unlocked:
6624         hci_dev_unlock(hdev);
6625
6626         return err;
6627 }
6628
6629 static void set_rssi_threshold_complete(struct hci_dev *hdev,
6630                         u8 status, u16 opcode)
6631 {
6632         struct mgmt_pending_cmd *cmd;
6633
6634         BT_DBG("status 0x%02x", status);
6635
6636         hci_dev_lock(hdev);
6637
6638         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6639         if (!cmd)
6640                 goto unlock;
6641
6642         if (status)
6643                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6644                                 mgmt_status(status));
6645         else
6646                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6647                                 NULL, 0);
6648
6649         mgmt_pending_remove(cmd);
6650
6651 unlock:
6652         hci_dev_unlock(hdev);
6653 }
6654
6655 static void set_rssi_disable_complete(struct hci_dev *hdev,
6656                         u8 status, u16 opcode)
6657 {
6658         struct mgmt_pending_cmd *cmd;
6659
6660         BT_DBG("status 0x%02x", status);
6661
6662         hci_dev_lock(hdev);
6663
6664         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6665         if (!cmd)
6666                 goto unlock;
6667
6668         if (status)
6669                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6670                                 mgmt_status(status));
6671         else
6672                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6673                                 0, NULL, 0);
6674
6675         mgmt_pending_remove(cmd);
6676
6677 unlock:
6678         hci_dev_unlock(hdev);
6679 }
6680
6681 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6682                 void *data, u16 len)
6683 {
6684         int err = 0;
6685         struct hci_cp_set_rssi_threshold th = { 0, };
6686         struct mgmt_cp_set_enable_rssi *cp = data;
6687         struct hci_conn *conn;
6688         struct mgmt_pending_cmd *cmd;
6689         struct hci_request req;
6690         __u8 dest_type;
6691
6692         hci_dev_lock(hdev);
6693
6694         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6695         if (!cmd) {
6696                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6697                                 MGMT_STATUS_FAILED);
6698                 goto unlocked;
6699         }
6700
6701         if (!lmp_le_capable(hdev)) {
6702                 mgmt_pending_remove(cmd);
6703                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6704                                 MGMT_STATUS_NOT_SUPPORTED);
6705                 goto unlocked;
6706         }
6707
6708         if (!hdev_is_powered(hdev)) {
6709                 BT_DBG("%s", hdev->name);
6710                 mgmt_pending_remove(cmd);
6711                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6712                                 MGMT_STATUS_NOT_POWERED);
6713                 goto unlocked;
6714         }
6715
6716         if (cp->link_type == 0x01)
6717                 dest_type = LE_LINK;
6718         else
6719                 dest_type = ACL_LINK;
6720
6721         /* Get LE/ACL link handle info */
6722         conn = hci_conn_hash_lookup_ba(hdev,
6723                         dest_type, &cp->bdaddr);
6724
6725         if (!conn) {
6726                 err = mgmt_cmd_complete(sk, hdev->id,
6727                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6728                 mgmt_pending_remove(cmd);
6729                 goto unlocked;
6730         }
6731
6732         hci_req_init(&req, hdev);
6733
6734         th.hci_le_ext_opcode = 0x0B;
6735         th.mode = 0x01;
6736         th.conn_handle = conn->handle;
6737         th.alert_mask = 0x07;
6738         th.low_th = cp->low_th;
6739         th.in_range_th = cp->in_range_th;
6740         th.high_th = cp->high_th;
6741
6742         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6743         err = hci_req_run(&req, set_rssi_threshold_complete);
6744
6745         if (err < 0) {
6746                 mgmt_pending_remove(cmd);
6747                 BT_ERR("Error in requesting hci_req_run");
6748                 goto unlocked;
6749         }
6750
6751 unlocked:
6752         hci_dev_unlock(hdev);
6753         return err;
6754 }
6755
6756 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6757                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6758 {
6759         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6760         struct mgmt_cp_set_enable_rssi *cp = data;
6761         struct mgmt_pending_cmd *cmd;
6762
6763         if (!cp || !rp)
6764                 goto remove_cmd;
6765
6766         mgmt_rp.status = rp->status;
6767         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6768         mgmt_rp.bt_address = cp->bdaddr;
6769         mgmt_rp.link_type = cp->link_type;
6770
6771         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6772                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6773                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6774
6775         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6776                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6777
6778         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6779         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6780                         &mgmt_rp.bt_address, true);
6781
6782 remove_cmd:
6783         hci_dev_lock(hdev);
6784         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6785         if (cmd)
6786                 mgmt_pending_remove(cmd);
6787
6788         hci_dev_unlock(hdev);
6789 }
6790
6791 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6792                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6793 {
6794         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6795         struct mgmt_cp_disable_rssi *cp = data;
6796         struct mgmt_pending_cmd *cmd;
6797
6798         if (!cp || !rp)
6799                 goto remove_cmd;
6800
6801         mgmt_rp.status = rp->status;
6802         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6803         mgmt_rp.bt_address = cp->bdaddr;
6804         mgmt_rp.link_type = cp->link_type;
6805
6806         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6807                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6808                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6809
6810         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6811                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6812
6813         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6814                         &mgmt_rp.bt_address, false);
6815
6816 remove_cmd:
6817         hci_dev_lock(hdev);
6818         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6819         if (cmd)
6820                 mgmt_pending_remove(cmd);
6821
6822         hci_dev_unlock(hdev);
6823 }
6824
6825 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6826                 void *data, u16 len)
6827 {
6828         struct mgmt_pending_cmd *cmd;
6829         struct hci_request req;
6830         struct hci_cp_set_enable_rssi cp_en = { 0, };
6831         int err;
6832
6833         BT_DBG("Set Disable RSSI.");
6834
6835         cp_en.hci_le_ext_opcode = 0x01;
6836         cp_en.le_enable_cs_Features = 0x00;
6837         cp_en.data[0] = 0x00;
6838         cp_en.data[1] = 0x00;
6839         cp_en.data[2] = 0x00;
6840
6841         hci_dev_lock(hdev);
6842
6843         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6844         if (!cmd) {
6845                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6846                                 MGMT_STATUS_FAILED);
6847                 goto unlocked;
6848         }
6849
6850         if (!lmp_le_capable(hdev)) {
6851                 mgmt_pending_remove(cmd);
6852                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6853                                 MGMT_STATUS_NOT_SUPPORTED);
6854                 goto unlocked;
6855         }
6856
6857         if (!hdev_is_powered(hdev)) {
6858                 BT_DBG("%s", hdev->name);
6859                 mgmt_pending_remove(cmd);
6860                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6861                                 MGMT_STATUS_NOT_POWERED);
6862                 goto unlocked;
6863         }
6864
6865         hci_req_init(&req, hdev);
6866
6867         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6868                         sizeof(struct hci_cp_set_enable_rssi),
6869                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6870                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6871
6872         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6873         err = hci_req_run(&req, set_rssi_disable_complete);
6874
6875         if (err < 0) {
6876                 mgmt_pending_remove(cmd);
6877                 BT_ERR("Error in requesting hci_req_run");
6878                 goto unlocked;
6879         }
6880
6881 unlocked:
6882         hci_dev_unlock(hdev);
6883         return err;
6884 }
6885
6886 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6887 {
6888         struct hci_cc_rsp_enable_rssi *rp = response;
6889         struct mgmt_pending_cmd *cmd_enable = NULL;
6890         struct mgmt_pending_cmd *cmd_disable = NULL;
6891         struct mgmt_cp_set_enable_rssi *cp_en;
6892         struct mgmt_cp_disable_rssi *cp_dis;
6893
6894         hci_dev_lock(hdev);
6895         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6896         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6897         hci_dev_unlock(hdev);
6898
6899         if (cmd_enable)
6900                 BT_DBG("Enable Request");
6901
6902         if (cmd_disable)
6903                 BT_DBG("Disable Request");
6904
6905         if (cmd_enable) {
6906                 cp_en = cmd_enable->param;
6907
6908                 if (status != 0x00)
6909                         return;
6910
6911                 switch (rp->le_ext_opcode) {
6912                 case 0x01:
6913                         BT_DBG("RSSI enabled.. Setting Threshold...");
6914                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6915                                         cp_en, sizeof(*cp_en));
6916                         break;
6917
6918                 case 0x0B:
6919                         BT_DBG("Sending RSSI enable success");
6920                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6921                                         cp_en, rp, rp->status);
6922                         break;
6923                 }
6924
6925         } else if (cmd_disable) {
6926                 cp_dis = cmd_disable->param;
6927
6928                 if (status != 0x00)
6929                         return;
6930
6931                 switch (rp->le_ext_opcode) {
6932                 case 0x01:
6933                         BT_DBG("Sending RSSI disable success");
6934                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6935                                         cp_dis, rp, rp->status);
6936                         break;
6937
6938                 case 0x0B:
6939                         /*
6940                          * Only unset RSSI Threshold values for the Link if
6941                          * RSSI is monitored for other BREDR or LE Links
6942                          */
6943                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6944                                 BT_DBG("Unset Threshold. Other links being monitored");
6945                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6946                                                 cp_dis, rp, rp->status);
6947                         } else {
6948                                 BT_DBG("Unset Threshold. Disabling...");
6949                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6950                                                 cp_dis, sizeof(*cp_dis));
6951                         }
6952                         break;
6953                 }
6954         }
6955 }
6956
6957 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
6958                 u16 opcode)
6959 {
6960         struct mgmt_pending_cmd *cmd;
6961
6962         BT_DBG("status 0x%02x", status);
6963
6964         hci_dev_lock(hdev);
6965
6966         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6967         if (!cmd)
6968                 goto unlock;
6969
6970         if (status)
6971                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6972                                 mgmt_status(status));
6973         else
6974                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6975                                 NULL, 0);
6976
6977         mgmt_pending_remove(cmd);
6978
6979 unlock:
6980         hci_dev_unlock(hdev);
6981 }
6982
6983 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
6984                 void *data, u16 len)
6985 {
6986         struct mgmt_pending_cmd *cmd;
6987         struct hci_request req;
6988         struct mgmt_cp_set_enable_rssi *cp = data;
6989         struct hci_cp_set_enable_rssi cp_en = { 0, };
6990         int err;
6991
6992         BT_DBG("Set Enable RSSI.");
6993
6994         cp_en.hci_le_ext_opcode = 0x01;
6995         cp_en.le_enable_cs_Features = 0x04;
6996         cp_en.data[0] = 0x00;
6997         cp_en.data[1] = 0x00;
6998         cp_en.data[2] = 0x00;
6999
7000         hci_dev_lock(hdev);
7001
7002         if (!lmp_le_capable(hdev)) {
7003                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7004                                 MGMT_STATUS_NOT_SUPPORTED);
7005                 goto unlocked;
7006         }
7007
7008         if (!hdev_is_powered(hdev)) {
7009                 BT_DBG("%s", hdev->name);
7010                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7011                                 MGMT_STATUS_NOT_POWERED);
7012                 goto unlocked;
7013         }
7014
7015         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
7016                 BT_DBG("%s", hdev->name);
7017                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7018                                 MGMT_STATUS_BUSY);
7019                 goto unlocked;
7020         }
7021
7022         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
7023                         sizeof(*cp));
7024         if (!cmd) {
7025                 BT_DBG("%s", hdev->name);
7026                 err = -ENOMEM;
7027                 goto unlocked;
7028         }
7029
7030         /* If RSSI is already enabled directly set Threshold values */
7031         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
7032                 hci_dev_unlock(hdev);
7033                 BT_DBG("RSSI Enabled. Directly set Threshold");
7034                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
7035                 return err;
7036         }
7037
7038         hci_req_init(&req, hdev);
7039
7040         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7041                         sizeof(struct hci_cp_set_enable_rssi),
7042                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7043                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7044
7045         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7046         err = hci_req_run(&req, set_rssi_enable_complete);
7047
7048         if (err < 0) {
7049                 mgmt_pending_remove(cmd);
7050                 BT_ERR("Error in requesting hci_req_run");
7051                 goto unlocked;
7052         }
7053
7054 unlocked:
7055         hci_dev_unlock(hdev);
7056
7057         return err;
7058 }
7059
7060 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7061 {
7062         struct mgmt_pending_cmd *cmd;
7063
7064         BT_DBG("status 0x%02x", status);
7065
7066         hci_dev_lock(hdev);
7067
7068         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
7069         if (!cmd)
7070                 goto unlock;
7071
7072         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7073                         MGMT_STATUS_SUCCESS, &status, 1);
7074
7075         mgmt_pending_remove(cmd);
7076
7077 unlock:
7078         hci_dev_unlock(hdev);
7079 }
7080
7081 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
7082                         u16 len)
7083 {
7084         struct mgmt_pending_cmd *cmd;
7085         struct hci_request req;
7086         struct mgmt_cp_get_raw_rssi *cp = data;
7087         struct hci_cp_get_raw_rssi hci_cp;
7088
7089         struct hci_conn *conn;
7090         int err;
7091         __u8 dest_type;
7092
7093         BT_DBG("Get Raw RSSI.");
7094
7095         hci_dev_lock(hdev);
7096
7097         if (!lmp_le_capable(hdev)) {
7098                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7099                                 MGMT_STATUS_NOT_SUPPORTED);
7100                 goto unlocked;
7101         }
7102
7103         if (cp->link_type == 0x01)
7104                 dest_type = LE_LINK;
7105         else
7106                 dest_type = ACL_LINK;
7107
7108         /* Get LE/BREDR link handle info */
7109         conn = hci_conn_hash_lookup_ba(hdev,
7110                         dest_type, &cp->bt_address);
7111         if (!conn) {
7112                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7113                                                    MGMT_STATUS_NOT_CONNECTED);
7114                 goto unlocked;
7115         }
7116         hci_cp.conn_handle = conn->handle;
7117
7118         if (!hdev_is_powered(hdev)) {
7119                 BT_DBG("%s", hdev->name);
7120                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7121                                 MGMT_STATUS_NOT_POWERED);
7122                 goto unlocked;
7123         }
7124
7125         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
7126                 BT_DBG("%s", hdev->name);
7127                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7128                                 MGMT_STATUS_BUSY);
7129                 goto unlocked;
7130         }
7131
7132         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
7133         if (!cmd) {
7134                 BT_DBG("%s", hdev->name);
7135                 err = -ENOMEM;
7136                 goto unlocked;
7137         }
7138
7139         hci_req_init(&req, hdev);
7140
7141         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
7142         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
7143         err = hci_req_run(&req, get_raw_rssi_complete);
7144
7145         if (err < 0) {
7146                 mgmt_pending_remove(cmd);
7147                 BT_ERR("Error in requesting hci_req_run");
7148         }
7149
7150 unlocked:
7151         hci_dev_unlock(hdev);
7152
7153         return err;
7154 }
7155
7156 void mgmt_raw_rssi_response(struct hci_dev *hdev,
7157                 struct hci_cc_rp_get_raw_rssi *rp, int success)
7158 {
7159         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
7160         struct hci_conn *conn;
7161
7162         mgmt_rp.status = rp->status;
7163         mgmt_rp.rssi_dbm = rp->rssi_dbm;
7164
7165         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
7166         if (!conn)
7167                 return;
7168
7169         bacpy(&mgmt_rp.bt_address, &conn->dst);
7170         if (conn->type == LE_LINK)
7171                 mgmt_rp.link_type = 0x01;
7172         else
7173                 mgmt_rp.link_type = 0x00;
7174
7175         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
7176                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
7177 }
7178
7179 static void set_disable_threshold_complete(struct hci_dev *hdev,
7180                         u8 status, u16 opcode)
7181 {
7182         struct mgmt_pending_cmd *cmd;
7183
7184         BT_DBG("status 0x%02x", status);
7185
7186         hci_dev_lock(hdev);
7187
7188         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7189         if (!cmd)
7190                 goto unlock;
7191
7192         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7193                         MGMT_STATUS_SUCCESS, &status, 1);
7194
7195         mgmt_pending_remove(cmd);
7196
7197 unlock:
7198         hci_dev_unlock(hdev);
7199 }
7200
7201 /** Removes monitoring for a link*/
7202 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
7203                 void *data, u16 len)
7204 {
7205         int err = 0;
7206         struct hci_cp_set_rssi_threshold th = { 0, };
7207         struct mgmt_cp_disable_rssi *cp = data;
7208         struct hci_conn *conn;
7209         struct mgmt_pending_cmd *cmd;
7210         struct hci_request req;
7211         __u8 dest_type;
7212
7213         BT_DBG("Set Disable RSSI.");
7214
7215         hci_dev_lock(hdev);
7216
7217         if (!lmp_le_capable(hdev)) {
7218                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7219                                 MGMT_STATUS_NOT_SUPPORTED);
7220                 goto unlocked;
7221         }
7222
7223         /* Get LE/ACL link handle info*/
7224         if (cp->link_type == 0x01)
7225                 dest_type = LE_LINK;
7226         else
7227                 dest_type = ACL_LINK;
7228
7229         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
7230         if (!conn) {
7231                 err = mgmt_cmd_complete(sk, hdev->id,
7232                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
7233                 goto unlocked;
7234         }
7235
7236         th.hci_le_ext_opcode = 0x0B;
7237         th.mode = 0x01;
7238         th.conn_handle = conn->handle;
7239         th.alert_mask = 0x00;
7240         th.low_th = 0x00;
7241         th.in_range_th = 0x00;
7242         th.high_th = 0x00;
7243
7244         if (!hdev_is_powered(hdev)) {
7245                 BT_DBG("%s", hdev->name);
7246                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7247                                 0, data, len);
7248                 goto unlocked;
7249         }
7250
7251         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
7252                 BT_DBG("%s", hdev->name);
7253                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7254                                 MGMT_STATUS_BUSY);
7255                 goto unlocked;
7256         }
7257
7258         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
7259                         sizeof(*cp));
7260         if (!cmd) {
7261                 BT_DBG("%s", hdev->name);
7262                 err = -ENOMEM;
7263                 goto unlocked;
7264         }
7265
7266         hci_req_init(&req, hdev);
7267
7268         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7269         err = hci_req_run(&req, set_disable_threshold_complete);
7270         if (err < 0) {
7271                 mgmt_pending_remove(cmd);
7272                 BT_ERR("Error in requesting hci_req_run");
7273                 goto unlocked;
7274         }
7275
7276 unlocked:
7277         hci_dev_unlock(hdev);
7278
7279         return err;
7280 }
7281
7282 void mgmt_rssi_alert_evt(struct hci_dev *hdev, u16 conn_handle,
7283                 s8 alert_type, s8 rssi_dbm)
7284 {
7285         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
7286         struct hci_conn *conn;
7287
7288         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
7289                         conn_handle, alert_type, rssi_dbm);
7290
7291         conn = hci_conn_hash_lookup_handle(hdev, conn_handle);
7292
7293         if (!conn) {
7294                 BT_ERR("RSSI alert Error: Device not found for handle");
7295                 return;
7296         }
7297         bacpy(&mgmt_ev.bdaddr, &conn->dst);
7298
7299         if (conn->type == LE_LINK)
7300                 mgmt_ev.link_type = 0x01;
7301         else
7302                 mgmt_ev.link_type = 0x00;
7303
7304         mgmt_ev.alert_type = alert_type;
7305         mgmt_ev.rssi_dbm = rssi_dbm;
7306
7307         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
7308                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
7309                         NULL);
7310 }
7311
7312 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
7313 {
7314         struct mgmt_pending_cmd *cmd;
7315         u8 type;
7316         int err;
7317
7318         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7319
7320         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7321         if (!cmd)
7322                 return -ENOENT;
7323
7324         type = hdev->le_discovery.type;
7325
7326         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7327                                 mgmt_status(status), &type, sizeof(type));
7328         mgmt_pending_remove(cmd);
7329
7330         return err;
7331 }
7332
7333 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
7334                 u16 opcode)
7335 {
7336         unsigned long timeout = 0;
7337
7338         BT_DBG("status %d", status);
7339
7340         if (status) {
7341                 hci_dev_lock(hdev);
7342                 mgmt_start_le_discovery_failed(hdev, status);
7343                 hci_dev_unlock(hdev);
7344                 return;
7345         }
7346
7347         hci_dev_lock(hdev);
7348         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
7349         hci_dev_unlock(hdev);
7350
7351         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
7352                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
7353
7354         if (!timeout)
7355                 return;
7356
7357         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
7358 }
7359
7360 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
7361                 void *data, u16 len)
7362 {
7363         struct mgmt_cp_start_le_discovery *cp = data;
7364         struct mgmt_pending_cmd *cmd;
7365         struct hci_cp_le_set_scan_param param_cp;
7366         struct hci_cp_le_set_scan_enable enable_cp;
7367         struct hci_request req;
7368         u8 status, own_addr_type;
7369         int err;
7370
7371         BT_DBG("%s", hdev->name);
7372
7373         hci_dev_lock(hdev);
7374
7375         if (!hdev_is_powered(hdev)) {
7376                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7377                                 MGMT_STATUS_NOT_POWERED);
7378                 goto unlock;
7379         }
7380
7381         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
7382                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7383                                 MGMT_STATUS_BUSY);
7384                 goto unlock;
7385         }
7386
7387         if (cp->type != DISCOV_TYPE_LE) {
7388                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7389                                 MGMT_STATUS_INVALID_PARAMS);
7390                 goto unlock;
7391         }
7392
7393         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
7394         if (!cmd) {
7395                 err = -ENOMEM;
7396                 goto unlock;
7397         }
7398
7399         hdev->le_discovery.type = cp->type;
7400
7401         hci_req_init(&req, hdev);
7402
7403         status = mgmt_le_support(hdev);
7404         if (status) {
7405                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7406                                 status);
7407                 mgmt_pending_remove(cmd);
7408                 goto unlock;
7409         }
7410
7411         /* If controller is scanning, it means the background scanning
7412          * is running. Thus, we should temporarily stop it in order to
7413          * set the discovery scanning parameters.
7414          */
7415         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
7416                 hci_req_add_le_scan_disable(&req, false);
7417
7418         memset(&param_cp, 0, sizeof(param_cp));
7419
7420         /* All active scans will be done with either a resolvable
7421          * private address (when privacy feature has been enabled)
7422          * or unresolvable private address.
7423          */
7424         err = hci_update_random_address(&req, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
7425         if (err < 0) {
7426                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7427                                 MGMT_STATUS_FAILED);
7428                 mgmt_pending_remove(cmd);
7429                 goto unlock;
7430         }
7431
7432         param_cp.type = hdev->le_scan_type;
7433         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
7434         param_cp.window = cpu_to_le16(hdev->le_scan_window);
7435         param_cp.own_address_type = own_addr_type;
7436         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
7437                     &param_cp);
7438
7439         memset(&enable_cp, 0, sizeof(enable_cp));
7440         enable_cp.enable = LE_SCAN_ENABLE;
7441         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
7442
7443         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
7444                     &enable_cp);
7445
7446         err = hci_req_run(&req, start_le_discovery_complete);
7447         if (err < 0)
7448                 mgmt_pending_remove(cmd);
7449         else
7450                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
7451
7452 unlock:
7453         hci_dev_unlock(hdev);
7454         return err;
7455 }
7456
7457 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
7458 {
7459         struct mgmt_pending_cmd *cmd;
7460         int err;
7461
7462         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7463         if (!cmd)
7464                 return -ENOENT;
7465
7466         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7467                                 mgmt_status(status), &hdev->le_discovery.type,
7468                                 sizeof(hdev->le_discovery.type));
7469         mgmt_pending_remove(cmd);
7470
7471         return err;
7472 }
7473
7474 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
7475                 u16 opcode)
7476 {
7477         BT_DBG("status %d", status);
7478
7479         hci_dev_lock(hdev);
7480
7481         if (status) {
7482                 mgmt_stop_le_discovery_failed(hdev, status);
7483                 goto unlock;
7484         }
7485
7486         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7487
7488 unlock:
7489         hci_dev_unlock(hdev);
7490 }
7491
7492 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
7493                 void *data, u16 len)
7494 {
7495         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
7496         struct mgmt_pending_cmd *cmd;
7497         struct hci_request req;
7498         int err;
7499
7500         BT_DBG("%s", hdev->name);
7501
7502         hci_dev_lock(hdev);
7503
7504         if (!hci_le_discovery_active(hdev)) {
7505                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7506                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
7507                                         sizeof(mgmt_cp->type));
7508                 goto unlock;
7509         }
7510
7511         if (hdev->le_discovery.type != mgmt_cp->type) {
7512                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7513                                         MGMT_STATUS_INVALID_PARAMS,
7514                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
7515                 goto unlock;
7516         }
7517
7518         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
7519         if (!cmd) {
7520                 err = -ENOMEM;
7521                 goto unlock;
7522         }
7523
7524         hci_req_init(&req, hdev);
7525
7526         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
7527                 BT_DBG("unknown le discovery state %u",
7528                                         hdev->le_discovery.state);
7529
7530                 mgmt_pending_remove(cmd);
7531                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7532                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
7533                                         sizeof(mgmt_cp->type));
7534                 goto unlock;
7535         }
7536
7537         cancel_delayed_work(&hdev->le_scan_disable);
7538         hci_req_add_le_scan_disable(&req, false);
7539
7540         err = hci_req_run(&req, stop_le_discovery_complete);
7541         if (err < 0)
7542                 mgmt_pending_remove(cmd);
7543         else
7544                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
7545
7546 unlock:
7547         hci_dev_unlock(hdev);
7548         return err;
7549 }
7550
7551 /* Separate LE discovery */
7552 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
7553 {
7554         struct mgmt_ev_discovering ev;
7555         struct mgmt_pending_cmd *cmd;
7556
7557         BT_DBG("%s le discovering %u", hdev->name, discovering);
7558
7559         if (discovering)
7560                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7561         else
7562                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7563
7564         if (cmd) {
7565                 u8 type = hdev->le_discovery.type;
7566
7567                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
7568                                   sizeof(type));
7569                 mgmt_pending_remove(cmd);
7570         }
7571
7572         memset(&ev, 0, sizeof(ev));
7573         ev.type = hdev->le_discovery.type;
7574         ev.discovering = discovering;
7575
7576         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7577 }
7578
7579 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
7580                         void *data, u16 len)
7581 {
7582         int err;
7583
7584         BT_DBG("%s", hdev->name);
7585
7586         hci_dev_lock(hdev);
7587
7588         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
7589         if (err < 0)
7590                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
7591
7592         hci_dev_unlock(hdev);
7593
7594         return err;
7595 }
7596
7597 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
7598                 u16 to_multiplier)
7599 {
7600         u16 max_latency;
7601
7602         if (min > max || min < 6 || max > 3200)
7603                 return -EINVAL;
7604
7605         if (to_multiplier < 10 || to_multiplier > 3200)
7606                 return -EINVAL;
7607
7608         if (max >= to_multiplier * 8)
7609                 return -EINVAL;
7610
7611         max_latency = (to_multiplier * 8 / max) - 1;
7612
7613         if (latency > 499 || latency > max_latency)
7614                 return -EINVAL;
7615
7616         return 0;
7617 }
7618
7619 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
7620                 u16 len)
7621 {
7622         struct mgmt_cp_le_conn_update *cp = data;
7623
7624         struct hci_conn *conn;
7625         u16 min, max, latency, supervision_timeout;
7626         int err = -1;
7627
7628         if (!hdev_is_powered(hdev))
7629                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7630                                 MGMT_STATUS_NOT_POWERED);
7631
7632         min = __le16_to_cpu(cp->conn_interval_min);
7633         max = __le16_to_cpu(cp->conn_interval_max);
7634         latency = __le16_to_cpu(cp->conn_latency);
7635         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
7636
7637         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
7638                         min, max, latency, supervision_timeout);
7639
7640         err = check_le_conn_update_param(min, max, latency,
7641                         supervision_timeout);
7642
7643         if (err < 0)
7644                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7645                                 MGMT_STATUS_INVALID_PARAMS);
7646
7647         hci_dev_lock(hdev);
7648
7649         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
7650         if (!conn) {
7651                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7652                                 MGMT_STATUS_NOT_CONNECTED);
7653                 hci_dev_unlock(hdev);
7654                 return err;
7655         }
7656
7657         hci_dev_unlock(hdev);
7658
7659         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
7660
7661         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
7662                                  NULL, 0);
7663 }
7664
7665 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
7666                 u16 opcode)
7667 {
7668         struct mgmt_cp_set_manufacturer_data *cp;
7669         struct mgmt_pending_cmd *cmd;
7670
7671         BT_DBG("status 0x%02x", status);
7672
7673         hci_dev_lock(hdev);
7674
7675         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
7676         if (!cmd)
7677                 goto unlock;
7678
7679         cp = cmd->param;
7680
7681         if (status)
7682                 mgmt_cmd_status(cmd->sk, hdev->id,
7683                                 MGMT_OP_SET_MANUFACTURER_DATA,
7684                                 mgmt_status(status));
7685         else
7686                 mgmt_cmd_complete(cmd->sk, hdev->id,
7687                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
7688                                   cp, sizeof(*cp));
7689
7690         mgmt_pending_remove(cmd);
7691
7692 unlock:
7693         hci_dev_unlock(hdev);
7694 }
7695
7696 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
7697                 void *data, u16 len)
7698 {
7699         struct mgmt_pending_cmd *cmd;
7700         struct hci_request req;
7701         struct mgmt_cp_set_manufacturer_data *cp = data;
7702         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
7703         u8 old_len;
7704         int err;
7705
7706         BT_DBG("%s", hdev->name);
7707
7708         if (!lmp_bredr_capable(hdev))
7709                 return mgmt_cmd_status(sk, hdev->id,
7710                                 MGMT_OP_SET_MANUFACTURER_DATA,
7711                                 MGMT_STATUS_NOT_SUPPORTED);
7712
7713         if (cp->data[0] == 0 ||
7714                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
7715                 return mgmt_cmd_status(sk, hdev->id,
7716                                 MGMT_OP_SET_MANUFACTURER_DATA,
7717                                 MGMT_STATUS_INVALID_PARAMS);
7718
7719         if (cp->data[1] != 0xFF)
7720                 return mgmt_cmd_status(sk, hdev->id,
7721                                 MGMT_OP_SET_MANUFACTURER_DATA,
7722                                 MGMT_STATUS_NOT_SUPPORTED);
7723
7724         hci_dev_lock(hdev);
7725
7726         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
7727                 err = mgmt_cmd_status(sk, hdev->id,
7728                                 MGMT_OP_SET_MANUFACTURER_DATA,
7729                                 MGMT_STATUS_BUSY);
7730                 goto unlocked;
7731         }
7732
7733         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
7734                         len);
7735         if (!cmd) {
7736                 err = -ENOMEM;
7737                 goto unlocked;
7738         }
7739
7740         hci_req_init(&req, hdev);
7741
7742         /* if new data is same as previous data then return command
7743          * complete event
7744          */
7745         if (hdev->manufacturer_len == cp->data[0] - 1 &&
7746             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
7747                 mgmt_pending_remove(cmd);
7748                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
7749                                   0, cp, sizeof(*cp));
7750                 err = 0;
7751                 goto unlocked;
7752         }
7753
7754         old_len = hdev->manufacturer_len;
7755         if (old_len > 0)
7756                 memcpy(old_data, hdev->manufacturer_data, old_len);
7757
7758         hdev->manufacturer_len = cp->data[0] - 1;
7759         if (hdev->manufacturer_len > 0)
7760                 memcpy(hdev->manufacturer_data, cp->data + 2,
7761                                 hdev->manufacturer_len);
7762
7763         __hci_req_update_eir(&req);
7764
7765         err = hci_req_run(&req, set_manufacturer_data_complete);
7766         if (err < 0) {
7767                 mgmt_pending_remove(cmd);
7768                 goto failed;
7769         }
7770
7771 unlocked:
7772         hci_dev_unlock(hdev);
7773
7774         return err;
7775
7776 failed:
7777         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
7778         hdev->manufacturer_len = old_len;
7779         if (hdev->manufacturer_len > 0)
7780                 memcpy(hdev->manufacturer_data, old_data,
7781                        hdev->manufacturer_len);
7782         hci_dev_unlock(hdev);
7783         return err;
7784 }
7785
7786 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
7787                 void *data, u16 len)
7788 {
7789         struct mgmt_cp_le_set_scan_params *cp = data;
7790         __u16 interval, window;
7791         int err;
7792
7793         BT_DBG("%s", hdev->name);
7794
7795         if (!lmp_le_capable(hdev))
7796                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7797                                 MGMT_STATUS_NOT_SUPPORTED);
7798
7799         interval = __le16_to_cpu(cp->interval);
7800
7801         if (interval < 0x0004 || interval > 0x4000)
7802                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7803                                 MGMT_STATUS_INVALID_PARAMS);
7804
7805         window = __le16_to_cpu(cp->window);
7806
7807         if (window < 0x0004 || window > 0x4000)
7808                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7809                                 MGMT_STATUS_INVALID_PARAMS);
7810
7811         if (window > interval)
7812                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7813                                 MGMT_STATUS_INVALID_PARAMS);
7814
7815         hci_dev_lock(hdev);
7816
7817         hdev->le_scan_type = cp->type;
7818         hdev->le_scan_interval = interval;
7819         hdev->le_scan_window = window;
7820
7821         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
7822                                 NULL, 0);
7823
7824         /* If background scan is running, restart it so new parameters are
7825          * loaded.
7826          */
7827         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
7828             hdev->discovery.state == DISCOVERY_STOPPED) {
7829                 struct hci_request req;
7830
7831                 hci_req_init(&req, hdev);
7832
7833                 hci_req_add_le_scan_disable(&req, false);
7834                 hci_req_add_le_passive_scan(&req);
7835
7836                 hci_req_run(&req, NULL);
7837         }
7838
7839         hci_dev_unlock(hdev);
7840
7841         return err;
7842 }
7843
7844 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
7845 {
7846         struct mgmt_ev_hardware_error ev;
7847
7848         ev.error_code = err_code;
7849         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
7850 }
7851
7852 void mgmt_tx_timeout_error(struct hci_dev *hdev)
7853 {
7854         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
7855 }
7856
7857 void mgmt_multi_adv_state_change_evt(struct hci_dev *hdev, u8 adv_instance,
7858                 u8 state_change_reason, u16 connection_handle)
7859 {
7860         struct mgmt_ev_vendor_specific_multi_adv_state_changed mgmt_ev;
7861
7862         BT_DBG("Multi adv state changed [%2.2X %2.2X %2.2X]",
7863                adv_instance, state_change_reason, connection_handle);
7864
7865         mgmt_ev.adv_instance = adv_instance;
7866         mgmt_ev.state_change_reason = state_change_reason;
7867         mgmt_ev.connection_handle = connection_handle;
7868
7869         mgmt_event(MGMT_EV_MULTI_ADV_STATE_CHANGED, hdev, &mgmt_ev,
7870                 sizeof(struct mgmt_ev_vendor_specific_multi_adv_state_changed),
7871                 NULL);
7872 }
7873 #endif /* TIZEN_BT */
7874
7875 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7876 {
7877         if (key->initiator != 0x00 && key->initiator != 0x01)
7878                 return false;
7879
7880         switch (key->addr.type) {
7881         case BDADDR_LE_PUBLIC:
7882                 return true;
7883
7884         case BDADDR_LE_RANDOM:
7885                 /* Two most significant bits shall be set */
7886                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7887                         return false;
7888                 return true;
7889         }
7890
7891         return false;
7892 }
7893
7894 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7895                                void *cp_data, u16 len)
7896 {
7897         struct mgmt_cp_load_long_term_keys *cp = cp_data;
7898         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7899                                    sizeof(struct mgmt_ltk_info));
7900         u16 key_count, expected_len;
7901         int i, err;
7902
7903         bt_dev_dbg(hdev, "sock %p", sk);
7904
7905         if (!lmp_le_capable(hdev))
7906                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7907                                        MGMT_STATUS_NOT_SUPPORTED);
7908
7909         key_count = __le16_to_cpu(cp->key_count);
7910         if (key_count > max_key_count) {
7911                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7912                            key_count);
7913                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7914                                        MGMT_STATUS_INVALID_PARAMS);
7915         }
7916
7917         expected_len = struct_size(cp, keys, key_count);
7918         if (expected_len != len) {
7919                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7920                            expected_len, len);
7921                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7922                                        MGMT_STATUS_INVALID_PARAMS);
7923         }
7924
7925         bt_dev_dbg(hdev, "key_count %u", key_count);
7926
7927         for (i = 0; i < key_count; i++) {
7928                 struct mgmt_ltk_info *key = &cp->keys[i];
7929
7930                 if (!ltk_is_valid(key))
7931                         return mgmt_cmd_status(sk, hdev->id,
7932                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
7933                                                MGMT_STATUS_INVALID_PARAMS);
7934         }
7935
7936         hci_dev_lock(hdev);
7937
7938         hci_smp_ltks_clear(hdev);
7939
7940         for (i = 0; i < key_count; i++) {
7941                 struct mgmt_ltk_info *key = &cp->keys[i];
7942                 u8 type, authenticated;
7943
7944                 if (hci_is_blocked_key(hdev,
7945                                        HCI_BLOCKED_KEY_TYPE_LTK,
7946                                        key->val)) {
7947                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7948                                     &key->addr.bdaddr);
7949                         continue;
7950                 }
7951
7952                 switch (key->type) {
7953                 case MGMT_LTK_UNAUTHENTICATED:
7954                         authenticated = 0x00;
7955                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7956                         break;
7957                 case MGMT_LTK_AUTHENTICATED:
7958                         authenticated = 0x01;
7959                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7960                         break;
7961                 case MGMT_LTK_P256_UNAUTH:
7962                         authenticated = 0x00;
7963                         type = SMP_LTK_P256;
7964                         break;
7965                 case MGMT_LTK_P256_AUTH:
7966                         authenticated = 0x01;
7967                         type = SMP_LTK_P256;
7968                         break;
7969                 case MGMT_LTK_P256_DEBUG:
7970                         authenticated = 0x00;
7971                         type = SMP_LTK_P256_DEBUG;
7972                         fallthrough;
7973                 default:
7974                         continue;
7975                 }
7976
7977                 hci_add_ltk(hdev, &key->addr.bdaddr,
7978                             le_addr_type(key->addr.type), type, authenticated,
7979                             key->val, key->enc_size, key->ediv, key->rand);
7980         }
7981
7982         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7983                            NULL, 0);
7984
7985         hci_dev_unlock(hdev);
7986
7987         return err;
7988 }
7989
7990 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7991 {
7992         struct hci_conn *conn = cmd->user_data;
7993         struct mgmt_rp_get_conn_info rp;
7994         int err;
7995
7996         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
7997
7998         if (status == MGMT_STATUS_SUCCESS) {
7999                 rp.rssi = conn->rssi;
8000                 rp.tx_power = conn->tx_power;
8001                 rp.max_tx_power = conn->max_tx_power;
8002         } else {
8003                 rp.rssi = HCI_RSSI_INVALID;
8004                 rp.tx_power = HCI_TX_POWER_INVALID;
8005                 rp.max_tx_power = HCI_TX_POWER_INVALID;
8006         }
8007
8008         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
8009                                 status, &rp, sizeof(rp));
8010
8011         hci_conn_drop(conn);
8012         hci_conn_put(conn);
8013
8014         return err;
8015 }
8016
8017 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
8018                                        u16 opcode)
8019 {
8020         struct hci_cp_read_rssi *cp;
8021         struct mgmt_pending_cmd *cmd;
8022         struct hci_conn *conn;
8023         u16 handle;
8024         u8 status;
8025
8026         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
8027
8028         hci_dev_lock(hdev);
8029
8030         /* Commands sent in request are either Read RSSI or Read Transmit Power
8031          * Level so we check which one was last sent to retrieve connection
8032          * handle.  Both commands have handle as first parameter so it's safe to
8033          * cast data on the same command struct.
8034          *
8035          * First command sent is always Read RSSI and we fail only if it fails.
8036          * In other case we simply override error to indicate success as we
8037          * already remembered if TX power value is actually valid.
8038          */
8039         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
8040         if (!cp) {
8041                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
8042                 status = MGMT_STATUS_SUCCESS;
8043         } else {
8044                 status = mgmt_status(hci_status);
8045         }
8046
8047         if (!cp) {
8048                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
8049                 goto unlock;
8050         }
8051
8052         handle = __le16_to_cpu(cp->handle);
8053         conn = hci_conn_hash_lookup_handle(hdev, handle);
8054         if (!conn) {
8055                 bt_dev_err(hdev, "unknown handle (%u) in conn_info response",
8056                            handle);
8057                 goto unlock;
8058         }
8059
8060         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
8061         if (!cmd)
8062                 goto unlock;
8063
8064         cmd->cmd_complete(cmd, status);
8065         mgmt_pending_remove(cmd);
8066
8067 unlock:
8068         hci_dev_unlock(hdev);
8069 }
8070
8071 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
8072                          u16 len)
8073 {
8074         struct mgmt_cp_get_conn_info *cp = data;
8075         struct mgmt_rp_get_conn_info rp;
8076         struct hci_conn *conn;
8077         unsigned long conn_info_age;
8078         int err = 0;
8079
8080         bt_dev_dbg(hdev, "sock %p", sk);
8081
8082         memset(&rp, 0, sizeof(rp));
8083         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8084         rp.addr.type = cp->addr.type;
8085
8086         if (!bdaddr_type_is_valid(cp->addr.type))
8087                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8088                                          MGMT_STATUS_INVALID_PARAMS,
8089                                          &rp, sizeof(rp));
8090
8091         hci_dev_lock(hdev);
8092
8093         if (!hdev_is_powered(hdev)) {
8094                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8095                                         MGMT_STATUS_NOT_POWERED, &rp,
8096                                         sizeof(rp));
8097                 goto unlock;
8098         }
8099
8100         if (cp->addr.type == BDADDR_BREDR)
8101                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8102                                                &cp->addr.bdaddr);
8103         else
8104                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8105
8106         if (!conn || conn->state != BT_CONNECTED) {
8107                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8108                                         MGMT_STATUS_NOT_CONNECTED, &rp,
8109                                         sizeof(rp));
8110                 goto unlock;
8111         }
8112
8113         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
8114                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8115                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
8116                 goto unlock;
8117         }
8118
8119         /* To avoid client trying to guess when to poll again for information we
8120          * calculate conn info age as random value between min/max set in hdev.
8121          */
8122         conn_info_age = hdev->conn_info_min_age +
8123                         prandom_u32_max(hdev->conn_info_max_age -
8124                                         hdev->conn_info_min_age);
8125
8126         /* Query controller to refresh cached values if they are too old or were
8127          * never read.
8128          */
8129         if (time_after(jiffies, conn->conn_info_timestamp +
8130                        msecs_to_jiffies(conn_info_age)) ||
8131             !conn->conn_info_timestamp) {
8132                 struct hci_request req;
8133                 struct hci_cp_read_tx_power req_txp_cp;
8134                 struct hci_cp_read_rssi req_rssi_cp;
8135                 struct mgmt_pending_cmd *cmd;
8136
8137                 hci_req_init(&req, hdev);
8138                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
8139                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
8140                             &req_rssi_cp);
8141
8142                 /* For LE links TX power does not change thus we don't need to
8143                  * query for it once value is known.
8144                  */
8145                 if (!bdaddr_type_is_le(cp->addr.type) ||
8146                     conn->tx_power == HCI_TX_POWER_INVALID) {
8147                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8148                         req_txp_cp.type = 0x00;
8149                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8150                                     sizeof(req_txp_cp), &req_txp_cp);
8151                 }
8152
8153                 /* Max TX power needs to be read only once per connection */
8154                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
8155                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8156                         req_txp_cp.type = 0x01;
8157                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8158                                     sizeof(req_txp_cp), &req_txp_cp);
8159                 }
8160
8161                 err = hci_req_run(&req, conn_info_refresh_complete);
8162                 if (err < 0)
8163                         goto unlock;
8164
8165                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
8166                                        data, len);
8167                 if (!cmd) {
8168                         err = -ENOMEM;
8169                         goto unlock;
8170                 }
8171
8172                 hci_conn_hold(conn);
8173                 cmd->user_data = hci_conn_get(conn);
8174                 cmd->cmd_complete = conn_info_cmd_complete;
8175
8176                 conn->conn_info_timestamp = jiffies;
8177         } else {
8178                 /* Cache is valid, just reply with values cached in hci_conn */
8179                 rp.rssi = conn->rssi;
8180                 rp.tx_power = conn->tx_power;
8181                 rp.max_tx_power = conn->max_tx_power;
8182
8183                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8184                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8185         }
8186
8187 unlock:
8188         hci_dev_unlock(hdev);
8189         return err;
8190 }
8191
8192 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8193 {
8194         struct hci_conn *conn = cmd->user_data;
8195         struct mgmt_rp_get_clock_info rp;
8196         struct hci_dev *hdev;
8197         int err;
8198
8199         memset(&rp, 0, sizeof(rp));
8200         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8201
8202         if (status)
8203                 goto complete;
8204
8205         hdev = hci_dev_get(cmd->index);
8206         if (hdev) {
8207                 rp.local_clock = cpu_to_le32(hdev->clock);
8208                 hci_dev_put(hdev);
8209         }
8210
8211         if (conn) {
8212                 rp.piconet_clock = cpu_to_le32(conn->clock);
8213                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
8214         }
8215
8216 complete:
8217         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
8218                                 sizeof(rp));
8219
8220         if (conn) {
8221                 hci_conn_drop(conn);
8222                 hci_conn_put(conn);
8223         }
8224
8225         return err;
8226 }
8227
8228 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8229 {
8230         struct hci_cp_read_clock *hci_cp;
8231         struct mgmt_pending_cmd *cmd;
8232         struct hci_conn *conn;
8233
8234         bt_dev_dbg(hdev, "status %u", status);
8235
8236         hci_dev_lock(hdev);
8237
8238         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
8239         if (!hci_cp)
8240                 goto unlock;
8241
8242         if (hci_cp->which) {
8243                 u16 handle = __le16_to_cpu(hci_cp->handle);
8244                 conn = hci_conn_hash_lookup_handle(hdev, handle);
8245         } else {
8246                 conn = NULL;
8247         }
8248
8249         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
8250         if (!cmd)
8251                 goto unlock;
8252
8253         cmd->cmd_complete(cmd, mgmt_status(status));
8254         mgmt_pending_remove(cmd);
8255
8256 unlock:
8257         hci_dev_unlock(hdev);
8258 }
8259
8260 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8261                          u16 len)
8262 {
8263         struct mgmt_cp_get_clock_info *cp = data;
8264         struct mgmt_rp_get_clock_info rp;
8265         struct hci_cp_read_clock hci_cp;
8266         struct mgmt_pending_cmd *cmd;
8267         struct hci_request req;
8268         struct hci_conn *conn;
8269         int err;
8270
8271         bt_dev_dbg(hdev, "sock %p", sk);
8272
8273         memset(&rp, 0, sizeof(rp));
8274         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8275         rp.addr.type = cp->addr.type;
8276
8277         if (cp->addr.type != BDADDR_BREDR)
8278                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8279                                          MGMT_STATUS_INVALID_PARAMS,
8280                                          &rp, sizeof(rp));
8281
8282         hci_dev_lock(hdev);
8283
8284         if (!hdev_is_powered(hdev)) {
8285                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8286                                         MGMT_STATUS_NOT_POWERED, &rp,
8287                                         sizeof(rp));
8288                 goto unlock;
8289         }
8290
8291         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8292                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8293                                                &cp->addr.bdaddr);
8294                 if (!conn || conn->state != BT_CONNECTED) {
8295                         err = mgmt_cmd_complete(sk, hdev->id,
8296                                                 MGMT_OP_GET_CLOCK_INFO,
8297                                                 MGMT_STATUS_NOT_CONNECTED,
8298                                                 &rp, sizeof(rp));
8299                         goto unlock;
8300                 }
8301         } else {
8302                 conn = NULL;
8303         }
8304
8305         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8306         if (!cmd) {
8307                 err = -ENOMEM;
8308                 goto unlock;
8309         }
8310
8311         cmd->cmd_complete = clock_info_cmd_complete;
8312
8313         hci_req_init(&req, hdev);
8314
8315         memset(&hci_cp, 0, sizeof(hci_cp));
8316         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8317
8318         if (conn) {
8319                 hci_conn_hold(conn);
8320                 cmd->user_data = hci_conn_get(conn);
8321
8322                 hci_cp.handle = cpu_to_le16(conn->handle);
8323                 hci_cp.which = 0x01; /* Piconet clock */
8324                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8325         }
8326
8327         err = hci_req_run(&req, get_clock_info_complete);
8328         if (err < 0)
8329                 mgmt_pending_remove(cmd);
8330
8331 unlock:
8332         hci_dev_unlock(hdev);
8333         return err;
8334 }
8335
8336 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8337 {
8338         struct hci_conn *conn;
8339
8340         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8341         if (!conn)
8342                 return false;
8343
8344         if (conn->dst_type != type)
8345                 return false;
8346
8347         if (conn->state != BT_CONNECTED)
8348                 return false;
8349
8350         return true;
8351 }
8352
8353 /* This function requires the caller holds hdev->lock */
8354 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
8355                                u8 addr_type, u8 auto_connect)
8356 {
8357         struct hci_conn_params *params;
8358
8359         params = hci_conn_params_add(hdev, addr, addr_type);
8360         if (!params)
8361                 return -EIO;
8362
8363         if (params->auto_connect == auto_connect)
8364                 return 0;
8365
8366         list_del_init(&params->action);
8367
8368         switch (auto_connect) {
8369         case HCI_AUTO_CONN_DISABLED:
8370         case HCI_AUTO_CONN_LINK_LOSS:
8371                 /* If auto connect is being disabled when we're trying to
8372                  * connect to device, keep connecting.
8373                  */
8374                 if (params->explicit_connect)
8375                         list_add(&params->action, &hdev->pend_le_conns);
8376                 break;
8377         case HCI_AUTO_CONN_REPORT:
8378                 if (params->explicit_connect)
8379                         list_add(&params->action, &hdev->pend_le_conns);
8380                 else
8381                         list_add(&params->action, &hdev->pend_le_reports);
8382                 break;
8383         case HCI_AUTO_CONN_DIRECT:
8384         case HCI_AUTO_CONN_ALWAYS:
8385                 if (!is_connected(hdev, addr, addr_type))
8386                         list_add(&params->action, &hdev->pend_le_conns);
8387                 break;
8388         }
8389
8390         params->auto_connect = auto_connect;
8391
8392         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
8393                    addr, addr_type, auto_connect);
8394
8395         return 0;
8396 }
8397
8398 static void device_added(struct sock *sk, struct hci_dev *hdev,
8399                          bdaddr_t *bdaddr, u8 type, u8 action)
8400 {
8401         struct mgmt_ev_device_added ev;
8402
8403         bacpy(&ev.addr.bdaddr, bdaddr);
8404         ev.addr.type = type;
8405         ev.action = action;
8406
8407         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
8408 }
8409
8410 static int add_device(struct sock *sk, struct hci_dev *hdev,
8411                       void *data, u16 len)
8412 {
8413         struct mgmt_cp_add_device *cp = data;
8414         u8 auto_conn, addr_type;
8415         struct hci_conn_params *params;
8416         int err;
8417         u32 current_flags = 0;
8418
8419         bt_dev_dbg(hdev, "sock %p", sk);
8420
8421         if (!bdaddr_type_is_valid(cp->addr.type) ||
8422             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
8423                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8424                                          MGMT_STATUS_INVALID_PARAMS,
8425                                          &cp->addr, sizeof(cp->addr));
8426
8427         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
8428                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8429                                          MGMT_STATUS_INVALID_PARAMS,
8430                                          &cp->addr, sizeof(cp->addr));
8431
8432         hci_dev_lock(hdev);
8433
8434         if (cp->addr.type == BDADDR_BREDR) {
8435                 /* Only incoming connections action is supported for now */
8436                 if (cp->action != 0x01) {
8437                         err = mgmt_cmd_complete(sk, hdev->id,
8438                                                 MGMT_OP_ADD_DEVICE,
8439                                                 MGMT_STATUS_INVALID_PARAMS,
8440                                                 &cp->addr, sizeof(cp->addr));
8441                         goto unlock;
8442                 }
8443
8444                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
8445                                                      &cp->addr.bdaddr,
8446                                                      cp->addr.type, 0);
8447                 if (err)
8448                         goto unlock;
8449
8450                 hci_req_update_scan(hdev);
8451
8452                 goto added;
8453         }
8454
8455         addr_type = le_addr_type(cp->addr.type);
8456
8457         if (cp->action == 0x02)
8458                 auto_conn = HCI_AUTO_CONN_ALWAYS;
8459         else if (cp->action == 0x01)
8460                 auto_conn = HCI_AUTO_CONN_DIRECT;
8461         else
8462                 auto_conn = HCI_AUTO_CONN_REPORT;
8463
8464         /* Kernel internally uses conn_params with resolvable private
8465          * address, but Add Device allows only identity addresses.
8466          * Make sure it is enforced before calling
8467          * hci_conn_params_lookup.
8468          */
8469         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8470                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8471                                         MGMT_STATUS_INVALID_PARAMS,
8472                                         &cp->addr, sizeof(cp->addr));
8473                 goto unlock;
8474         }
8475
8476         /* If the connection parameters don't exist for this device,
8477          * they will be created and configured with defaults.
8478          */
8479         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
8480                                 auto_conn) < 0) {
8481                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8482                                         MGMT_STATUS_FAILED, &cp->addr,
8483                                         sizeof(cp->addr));
8484                 goto unlock;
8485         } else {
8486                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8487                                                 addr_type);
8488                 if (params)
8489                         current_flags = params->current_flags;
8490         }
8491
8492         hci_update_background_scan(hdev);
8493
8494 added:
8495         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
8496         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
8497                              SUPPORTED_DEVICE_FLAGS(), current_flags);
8498
8499         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8500                                 MGMT_STATUS_SUCCESS, &cp->addr,
8501                                 sizeof(cp->addr));
8502
8503 unlock:
8504         hci_dev_unlock(hdev);
8505         return err;
8506 }
8507
8508 static void device_removed(struct sock *sk, struct hci_dev *hdev,
8509                            bdaddr_t *bdaddr, u8 type)
8510 {
8511         struct mgmt_ev_device_removed ev;
8512
8513         bacpy(&ev.addr.bdaddr, bdaddr);
8514         ev.addr.type = type;
8515
8516         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
8517 }
8518
8519 static int remove_device(struct sock *sk, struct hci_dev *hdev,
8520                          void *data, u16 len)
8521 {
8522         struct mgmt_cp_remove_device *cp = data;
8523         int err;
8524
8525         bt_dev_dbg(hdev, "sock %p", sk);
8526
8527         hci_dev_lock(hdev);
8528
8529         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8530                 struct hci_conn_params *params;
8531                 u8 addr_type;
8532
8533                 if (!bdaddr_type_is_valid(cp->addr.type)) {
8534                         err = mgmt_cmd_complete(sk, hdev->id,
8535                                                 MGMT_OP_REMOVE_DEVICE,
8536                                                 MGMT_STATUS_INVALID_PARAMS,
8537                                                 &cp->addr, sizeof(cp->addr));
8538                         goto unlock;
8539                 }
8540
8541                 if (cp->addr.type == BDADDR_BREDR) {
8542                         err = hci_bdaddr_list_del(&hdev->accept_list,
8543                                                   &cp->addr.bdaddr,
8544                                                   cp->addr.type);
8545                         if (err) {
8546                                 err = mgmt_cmd_complete(sk, hdev->id,
8547                                                         MGMT_OP_REMOVE_DEVICE,
8548                                                         MGMT_STATUS_INVALID_PARAMS,
8549                                                         &cp->addr,
8550                                                         sizeof(cp->addr));
8551                                 goto unlock;
8552                         }
8553
8554                         hci_req_update_scan(hdev);
8555
8556                         device_removed(sk, hdev, &cp->addr.bdaddr,
8557                                        cp->addr.type);
8558                         goto complete;
8559                 }
8560
8561                 addr_type = le_addr_type(cp->addr.type);
8562
8563                 /* Kernel internally uses conn_params with resolvable private
8564                  * address, but Remove Device allows only identity addresses.
8565                  * Make sure it is enforced before calling
8566                  * hci_conn_params_lookup.
8567                  */
8568                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8569                         err = mgmt_cmd_complete(sk, hdev->id,
8570                                                 MGMT_OP_REMOVE_DEVICE,
8571                                                 MGMT_STATUS_INVALID_PARAMS,
8572                                                 &cp->addr, sizeof(cp->addr));
8573                         goto unlock;
8574                 }
8575
8576                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8577                                                 addr_type);
8578                 if (!params) {
8579                         err = mgmt_cmd_complete(sk, hdev->id,
8580                                                 MGMT_OP_REMOVE_DEVICE,
8581                                                 MGMT_STATUS_INVALID_PARAMS,
8582                                                 &cp->addr, sizeof(cp->addr));
8583                         goto unlock;
8584                 }
8585
8586                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
8587                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
8588                         err = mgmt_cmd_complete(sk, hdev->id,
8589                                                 MGMT_OP_REMOVE_DEVICE,
8590                                                 MGMT_STATUS_INVALID_PARAMS,
8591                                                 &cp->addr, sizeof(cp->addr));
8592                         goto unlock;
8593                 }
8594
8595                 list_del(&params->action);
8596                 list_del(&params->list);
8597                 kfree(params);
8598                 hci_update_background_scan(hdev);
8599
8600                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8601         } else {
8602                 struct hci_conn_params *p, *tmp;
8603                 struct bdaddr_list *b, *btmp;
8604
8605                 if (cp->addr.type) {
8606                         err = mgmt_cmd_complete(sk, hdev->id,
8607                                                 MGMT_OP_REMOVE_DEVICE,
8608                                                 MGMT_STATUS_INVALID_PARAMS,
8609                                                 &cp->addr, sizeof(cp->addr));
8610                         goto unlock;
8611                 }
8612
8613                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
8614                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8615                         list_del(&b->list);
8616                         kfree(b);
8617                 }
8618
8619                 hci_req_update_scan(hdev);
8620
8621                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8622                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8623                                 continue;
8624                         device_removed(sk, hdev, &p->addr, p->addr_type);
8625                         if (p->explicit_connect) {
8626                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8627                                 continue;
8628                         }
8629                         list_del(&p->action);
8630                         list_del(&p->list);
8631                         kfree(p);
8632                 }
8633
8634                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8635
8636                 hci_update_background_scan(hdev);
8637         }
8638
8639 complete:
8640         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
8641                                 MGMT_STATUS_SUCCESS, &cp->addr,
8642                                 sizeof(cp->addr));
8643 unlock:
8644         hci_dev_unlock(hdev);
8645         return err;
8646 }
8647
8648 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
8649                            u16 len)
8650 {
8651         struct mgmt_cp_load_conn_param *cp = data;
8652         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8653                                      sizeof(struct mgmt_conn_param));
8654         u16 param_count, expected_len;
8655         int i;
8656
8657         if (!lmp_le_capable(hdev))
8658                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8659                                        MGMT_STATUS_NOT_SUPPORTED);
8660
8661         param_count = __le16_to_cpu(cp->param_count);
8662         if (param_count > max_param_count) {
8663                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
8664                            param_count);
8665                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8666                                        MGMT_STATUS_INVALID_PARAMS);
8667         }
8668
8669         expected_len = struct_size(cp, params, param_count);
8670         if (expected_len != len) {
8671                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
8672                            expected_len, len);
8673                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8674                                        MGMT_STATUS_INVALID_PARAMS);
8675         }
8676
8677         bt_dev_dbg(hdev, "param_count %u", param_count);
8678
8679         hci_dev_lock(hdev);
8680
8681         hci_conn_params_clear_disabled(hdev);
8682
8683         for (i = 0; i < param_count; i++) {
8684                 struct mgmt_conn_param *param = &cp->params[i];
8685                 struct hci_conn_params *hci_param;
8686                 u16 min, max, latency, timeout;
8687                 u8 addr_type;
8688
8689                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
8690                            param->addr.type);
8691
8692                 if (param->addr.type == BDADDR_LE_PUBLIC) {
8693                         addr_type = ADDR_LE_DEV_PUBLIC;
8694                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8695                         addr_type = ADDR_LE_DEV_RANDOM;
8696                 } else {
8697                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8698                         continue;
8699                 }
8700
8701                 min = le16_to_cpu(param->min_interval);
8702                 max = le16_to_cpu(param->max_interval);
8703                 latency = le16_to_cpu(param->latency);
8704                 timeout = le16_to_cpu(param->timeout);
8705
8706                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
8707                            min, max, latency, timeout);
8708
8709                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
8710                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8711                         continue;
8712                 }
8713
8714                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
8715                                                 addr_type);
8716                 if (!hci_param) {
8717                         bt_dev_err(hdev, "failed to add connection parameters");
8718                         continue;
8719                 }
8720
8721                 hci_param->conn_min_interval = min;
8722                 hci_param->conn_max_interval = max;
8723                 hci_param->conn_latency = latency;
8724                 hci_param->supervision_timeout = timeout;
8725         }
8726
8727         hci_dev_unlock(hdev);
8728
8729         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
8730                                  NULL, 0);
8731 }
8732
8733 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
8734                                void *data, u16 len)
8735 {
8736         struct mgmt_cp_set_external_config *cp = data;
8737         bool changed;
8738         int err;
8739
8740         bt_dev_dbg(hdev, "sock %p", sk);
8741
8742         if (hdev_is_powered(hdev))
8743                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8744                                        MGMT_STATUS_REJECTED);
8745
8746         if (cp->config != 0x00 && cp->config != 0x01)
8747                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8748                                          MGMT_STATUS_INVALID_PARAMS);
8749
8750         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
8751                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8752                                        MGMT_STATUS_NOT_SUPPORTED);
8753
8754         hci_dev_lock(hdev);
8755
8756         if (cp->config)
8757                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
8758         else
8759                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
8760
8761         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
8762         if (err < 0)
8763                 goto unlock;
8764
8765         if (!changed)
8766                 goto unlock;
8767
8768         err = new_options(hdev, sk);
8769
8770         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
8771                 mgmt_index_removed(hdev);
8772
8773                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
8774                         hci_dev_set_flag(hdev, HCI_CONFIG);
8775                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8776
8777                         queue_work(hdev->req_workqueue, &hdev->power_on);
8778                 } else {
8779                         set_bit(HCI_RAW, &hdev->flags);
8780                         mgmt_index_added(hdev);
8781                 }
8782         }
8783
8784 unlock:
8785         hci_dev_unlock(hdev);
8786         return err;
8787 }
8788
8789 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8790                               void *data, u16 len)
8791 {
8792         struct mgmt_cp_set_public_address *cp = data;
8793         bool changed;
8794         int err;
8795
8796         bt_dev_dbg(hdev, "sock %p", sk);
8797
8798         if (hdev_is_powered(hdev))
8799                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8800                                        MGMT_STATUS_REJECTED);
8801
8802         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8803                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8804                                        MGMT_STATUS_INVALID_PARAMS);
8805
8806         if (!hdev->set_bdaddr)
8807                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8808                                        MGMT_STATUS_NOT_SUPPORTED);
8809
8810         hci_dev_lock(hdev);
8811
8812         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8813         bacpy(&hdev->public_addr, &cp->bdaddr);
8814
8815         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8816         if (err < 0)
8817                 goto unlock;
8818
8819         if (!changed)
8820                 goto unlock;
8821
8822         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8823                 err = new_options(hdev, sk);
8824
8825         if (is_configured(hdev)) {
8826                 mgmt_index_removed(hdev);
8827
8828                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8829
8830                 hci_dev_set_flag(hdev, HCI_CONFIG);
8831                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8832
8833                 queue_work(hdev->req_workqueue, &hdev->power_on);
8834         }
8835
8836 unlock:
8837         hci_dev_unlock(hdev);
8838         return err;
8839 }
8840
8841 #ifdef TIZEN_BT
8842 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
8843                             u8 name_len)
8844 {
8845         char buf[512];
8846         struct mgmt_ev_device_name_update *ev = (void *)buf;
8847         u16 eir_len = 0;
8848
8849         if (name_len <= 0)
8850                 return -EINVAL;
8851
8852         bacpy(&ev->addr.bdaddr, bdaddr);
8853         ev->addr.type = BDADDR_BREDR;
8854
8855         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8856                                   name_len);
8857
8858         ev->eir_len = cpu_to_le16(eir_len);
8859
8860         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
8861                           sizeof(*ev) + eir_len, NULL);
8862 }
8863
8864 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8865                                u8 link_type, u8 addr_type, u8 status)
8866 {
8867         struct mgmt_ev_conn_update_failed ev;
8868
8869         bacpy(&ev.addr.bdaddr, bdaddr);
8870         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8871         ev.status = status;
8872
8873         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
8874                                 &ev, sizeof(ev), NULL);
8875 }
8876
8877 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
8878                          u8 link_type, u8 addr_type, u16 conn_interval,
8879                          u16 conn_latency, u16 supervision_timeout)
8880 {
8881         struct mgmt_ev_conn_updated ev;
8882
8883         bacpy(&ev.addr.bdaddr, bdaddr);
8884         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8885         ev.conn_interval = cpu_to_le16(conn_interval);
8886         ev.conn_latency = cpu_to_le16(conn_latency);
8887         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
8888
8889         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
8890                                 &ev, sizeof(ev), NULL);
8891 }
8892
8893 /* le device found event - Pass adv type */
8894 void mgmt_le_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8895                 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, u8 *eir,
8896                 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, u8 adv_type)
8897 {
8898         char buf[512];
8899         struct mgmt_ev_le_device_found *ev = (void *)buf;
8900         size_t ev_size;
8901
8902         if (!hci_discovery_active(hdev) && !hci_le_discovery_active(hdev))
8903                 return;
8904
8905         /* Make sure that the buffer is big enough. The 5 extra bytes
8906          * are for the potential CoD field.
8907          */
8908         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
8909                 return;
8910
8911         memset(buf, 0, sizeof(buf));
8912
8913         bacpy(&ev->addr.bdaddr, bdaddr);
8914         ev->addr.type = link_to_bdaddr(link_type, addr_type);
8915         ev->rssi = rssi;
8916         ev->flags = cpu_to_le32(flags);
8917         ev->adv_type = adv_type;
8918
8919         if (eir_len > 0)
8920                 memcpy(ev->eir, eir, eir_len);
8921
8922         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, NULL))
8923                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8924                                           dev_class, 3);
8925
8926         if (scan_rsp_len > 0)
8927                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8928
8929         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8930         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
8931
8932         mgmt_event(MGMT_EV_LE_DEVICE_FOUND, hdev, ev, ev_size, NULL);
8933 }
8934 #endif
8935
8936 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
8937                                              u16 opcode, struct sk_buff *skb)
8938 {
8939         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8940         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8941         u8 *h192, *r192, *h256, *r256;
8942         struct mgmt_pending_cmd *cmd;
8943         u16 eir_len;
8944         int err;
8945
8946         bt_dev_dbg(hdev, "status %u", status);
8947
8948         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
8949         if (!cmd)
8950                 return;
8951
8952         mgmt_cp = cmd->param;
8953
8954         if (status) {
8955                 status = mgmt_status(status);
8956                 eir_len = 0;
8957
8958                 h192 = NULL;
8959                 r192 = NULL;
8960                 h256 = NULL;
8961                 r256 = NULL;
8962         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
8963                 struct hci_rp_read_local_oob_data *rp;
8964
8965                 if (skb->len != sizeof(*rp)) {
8966                         status = MGMT_STATUS_FAILED;
8967                         eir_len = 0;
8968                 } else {
8969                         status = MGMT_STATUS_SUCCESS;
8970                         rp = (void *)skb->data;
8971
8972                         eir_len = 5 + 18 + 18;
8973                         h192 = rp->hash;
8974                         r192 = rp->rand;
8975                         h256 = NULL;
8976                         r256 = NULL;
8977                 }
8978         } else {
8979                 struct hci_rp_read_local_oob_ext_data *rp;
8980
8981                 if (skb->len != sizeof(*rp)) {
8982                         status = MGMT_STATUS_FAILED;
8983                         eir_len = 0;
8984                 } else {
8985                         status = MGMT_STATUS_SUCCESS;
8986                         rp = (void *)skb->data;
8987
8988                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8989                                 eir_len = 5 + 18 + 18;
8990                                 h192 = NULL;
8991                                 r192 = NULL;
8992                         } else {
8993                                 eir_len = 5 + 18 + 18 + 18 + 18;
8994                                 h192 = rp->hash192;
8995                                 r192 = rp->rand192;
8996                         }
8997
8998                         h256 = rp->hash256;
8999                         r256 = rp->rand256;
9000                 }
9001         }
9002
9003         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
9004         if (!mgmt_rp)
9005                 goto done;
9006
9007         if (eir_len == 0)
9008                 goto send_rsp;
9009
9010         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
9011                                   hdev->dev_class, 3);
9012
9013         if (h192 && r192) {
9014                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9015                                           EIR_SSP_HASH_C192, h192, 16);
9016                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9017                                           EIR_SSP_RAND_R192, r192, 16);
9018         }
9019
9020         if (h256 && r256) {
9021                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9022                                           EIR_SSP_HASH_C256, h256, 16);
9023                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9024                                           EIR_SSP_RAND_R256, r256, 16);
9025         }
9026
9027 send_rsp:
9028         mgmt_rp->type = mgmt_cp->type;
9029         mgmt_rp->eir_len = cpu_to_le16(eir_len);
9030
9031         err = mgmt_cmd_complete(cmd->sk, hdev->id,
9032                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
9033                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
9034         if (err < 0 || status)
9035                 goto done;
9036
9037         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
9038
9039         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9040                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
9041                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
9042 done:
9043         kfree(mgmt_rp);
9044         mgmt_pending_remove(cmd);
9045 }
9046
9047 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
9048                                   struct mgmt_cp_read_local_oob_ext_data *cp)
9049 {
9050         struct mgmt_pending_cmd *cmd;
9051         struct hci_request req;
9052         int err;
9053
9054         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
9055                                cp, sizeof(*cp));
9056         if (!cmd)
9057                 return -ENOMEM;
9058
9059         hci_req_init(&req, hdev);
9060
9061         if (bredr_sc_enabled(hdev))
9062                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
9063         else
9064                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
9065
9066         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
9067         if (err < 0) {
9068                 mgmt_pending_remove(cmd);
9069                 return err;
9070         }
9071
9072         return 0;
9073 }
9074
9075 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
9076                                    void *data, u16 data_len)
9077 {
9078         struct mgmt_cp_read_local_oob_ext_data *cp = data;
9079         struct mgmt_rp_read_local_oob_ext_data *rp;
9080         size_t rp_len;
9081         u16 eir_len;
9082         u8 status, flags, role, addr[7], hash[16], rand[16];
9083         int err;
9084
9085         bt_dev_dbg(hdev, "sock %p", sk);
9086
9087         if (hdev_is_powered(hdev)) {
9088                 switch (cp->type) {
9089                 case BIT(BDADDR_BREDR):
9090                         status = mgmt_bredr_support(hdev);
9091                         if (status)
9092                                 eir_len = 0;
9093                         else
9094                                 eir_len = 5;
9095                         break;
9096                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9097                         status = mgmt_le_support(hdev);
9098                         if (status)
9099                                 eir_len = 0;
9100                         else
9101                                 eir_len = 9 + 3 + 18 + 18 + 3;
9102                         break;
9103                 default:
9104                         status = MGMT_STATUS_INVALID_PARAMS;
9105                         eir_len = 0;
9106                         break;
9107                 }
9108         } else {
9109                 status = MGMT_STATUS_NOT_POWERED;
9110                 eir_len = 0;
9111         }
9112
9113         rp_len = sizeof(*rp) + eir_len;
9114         rp = kmalloc(rp_len, GFP_ATOMIC);
9115         if (!rp)
9116                 return -ENOMEM;
9117
9118         if (status)
9119                 goto complete;
9120
9121         hci_dev_lock(hdev);
9122
9123         eir_len = 0;
9124         switch (cp->type) {
9125         case BIT(BDADDR_BREDR):
9126                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9127                         err = read_local_ssp_oob_req(hdev, sk, cp);
9128                         hci_dev_unlock(hdev);
9129                         if (!err)
9130                                 goto done;
9131
9132                         status = MGMT_STATUS_FAILED;
9133                         goto complete;
9134                 } else {
9135                         eir_len = eir_append_data(rp->eir, eir_len,
9136                                                   EIR_CLASS_OF_DEV,
9137                                                   hdev->dev_class, 3);
9138                 }
9139                 break;
9140         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9141                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
9142                     smp_generate_oob(hdev, hash, rand) < 0) {
9143                         hci_dev_unlock(hdev);
9144                         status = MGMT_STATUS_FAILED;
9145                         goto complete;
9146                 }
9147
9148                 /* This should return the active RPA, but since the RPA
9149                  * is only programmed on demand, it is really hard to fill
9150                  * this in at the moment. For now disallow retrieving
9151                  * local out-of-band data when privacy is in use.
9152                  *
9153                  * Returning the identity address will not help here since
9154                  * pairing happens before the identity resolving key is
9155                  * known and thus the connection establishment happens
9156                  * based on the RPA and not the identity address.
9157                  */
9158                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
9159                         hci_dev_unlock(hdev);
9160                         status = MGMT_STATUS_REJECTED;
9161                         goto complete;
9162                 }
9163
9164                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
9165                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
9166                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
9167                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
9168                         memcpy(addr, &hdev->static_addr, 6);
9169                         addr[6] = 0x01;
9170                 } else {
9171                         memcpy(addr, &hdev->bdaddr, 6);
9172                         addr[6] = 0x00;
9173                 }
9174
9175                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
9176                                           addr, sizeof(addr));
9177
9178                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
9179                         role = 0x02;
9180                 else
9181                         role = 0x01;
9182
9183                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
9184                                           &role, sizeof(role));
9185
9186                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
9187                         eir_len = eir_append_data(rp->eir, eir_len,
9188                                                   EIR_LE_SC_CONFIRM,
9189                                                   hash, sizeof(hash));
9190
9191                         eir_len = eir_append_data(rp->eir, eir_len,
9192                                                   EIR_LE_SC_RANDOM,
9193                                                   rand, sizeof(rand));
9194                 }
9195
9196                 flags = mgmt_get_adv_discov_flags(hdev);
9197
9198                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9199                         flags |= LE_AD_NO_BREDR;
9200
9201                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
9202                                           &flags, sizeof(flags));
9203                 break;
9204         }
9205
9206         hci_dev_unlock(hdev);
9207
9208         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
9209
9210         status = MGMT_STATUS_SUCCESS;
9211
9212 complete:
9213         rp->type = cp->type;
9214         rp->eir_len = cpu_to_le16(eir_len);
9215
9216         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
9217                                 status, rp, sizeof(*rp) + eir_len);
9218         if (err < 0 || status)
9219                 goto done;
9220
9221         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9222                                  rp, sizeof(*rp) + eir_len,
9223                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
9224
9225 done:
9226         kfree(rp);
9227
9228         return err;
9229 }
9230
9231 static u32 get_supported_adv_flags(struct hci_dev *hdev)
9232 {
9233         u32 flags = 0;
9234
9235         flags |= MGMT_ADV_FLAG_CONNECTABLE;
9236         flags |= MGMT_ADV_FLAG_DISCOV;
9237         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
9238         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
9239         flags |= MGMT_ADV_FLAG_APPEARANCE;
9240         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
9241         flags |= MGMT_ADV_PARAM_DURATION;
9242         flags |= MGMT_ADV_PARAM_TIMEOUT;
9243         flags |= MGMT_ADV_PARAM_INTERVALS;
9244         flags |= MGMT_ADV_PARAM_TX_POWER;
9245         flags |= MGMT_ADV_PARAM_SCAN_RSP;
9246
9247         /* In extended adv TX_POWER returned from Set Adv Param
9248          * will be always valid.
9249          */
9250         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
9251             ext_adv_capable(hdev))
9252                 flags |= MGMT_ADV_FLAG_TX_POWER;
9253
9254         if (ext_adv_capable(hdev)) {
9255                 flags |= MGMT_ADV_FLAG_SEC_1M;
9256                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
9257                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
9258
9259                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
9260                         flags |= MGMT_ADV_FLAG_SEC_2M;
9261
9262                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
9263                         flags |= MGMT_ADV_FLAG_SEC_CODED;
9264         }
9265
9266         return flags;
9267 }
9268
9269 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
9270                              void *data, u16 data_len)
9271 {
9272         struct mgmt_rp_read_adv_features *rp;
9273         size_t rp_len;
9274         int err;
9275         struct adv_info *adv_instance;
9276         u32 supported_flags;
9277         u8 *instance;
9278
9279         bt_dev_dbg(hdev, "sock %p", sk);
9280
9281         if (!lmp_le_capable(hdev))
9282                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9283                                        MGMT_STATUS_REJECTED);
9284
9285         /* Enabling the experimental LL Privay support disables support for
9286          * advertising.
9287          */
9288         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9289                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9290                                        MGMT_STATUS_NOT_SUPPORTED);
9291
9292         hci_dev_lock(hdev);
9293
9294         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
9295         rp = kmalloc(rp_len, GFP_ATOMIC);
9296         if (!rp) {
9297                 hci_dev_unlock(hdev);
9298                 return -ENOMEM;
9299         }
9300
9301         supported_flags = get_supported_adv_flags(hdev);
9302
9303         rp->supported_flags = cpu_to_le32(supported_flags);
9304         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
9305         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
9306         rp->max_instances = hdev->le_num_of_adv_sets;
9307         rp->num_instances = hdev->adv_instance_cnt;
9308
9309         instance = rp->instance;
9310         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9311                 *instance = adv_instance->instance;
9312                 instance++;
9313         }
9314
9315         hci_dev_unlock(hdev);
9316
9317         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9318                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9319
9320         kfree(rp);
9321
9322         return err;
9323 }
9324
9325 static u8 calculate_name_len(struct hci_dev *hdev)
9326 {
9327         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9328
9329         return append_local_name(hdev, buf, 0);
9330 }
9331
9332 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9333                            bool is_adv_data)
9334 {
9335         u8 max_len = HCI_MAX_AD_LENGTH;
9336
9337         if (is_adv_data) {
9338                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9339                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9340                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9341                         max_len -= 3;
9342
9343                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9344                         max_len -= 3;
9345         } else {
9346                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9347                         max_len -= calculate_name_len(hdev);
9348
9349                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9350                         max_len -= 4;
9351         }
9352
9353         return max_len;
9354 }
9355
9356 static bool flags_managed(u32 adv_flags)
9357 {
9358         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
9359                             MGMT_ADV_FLAG_LIMITED_DISCOV |
9360                             MGMT_ADV_FLAG_MANAGED_FLAGS);
9361 }
9362
9363 static bool tx_power_managed(u32 adv_flags)
9364 {
9365         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
9366 }
9367
9368 static bool name_managed(u32 adv_flags)
9369 {
9370         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
9371 }
9372
9373 static bool appearance_managed(u32 adv_flags)
9374 {
9375         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
9376 }
9377
9378 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
9379                               u8 len, bool is_adv_data)
9380 {
9381         int i, cur_len;
9382         u8 max_len;
9383
9384         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
9385
9386         if (len > max_len)
9387                 return false;
9388
9389         /* Make sure that the data is correctly formatted. */
9390         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
9391                 cur_len = data[i];
9392
9393                 if (!cur_len)
9394                         continue;
9395
9396                 if (data[i + 1] == EIR_FLAGS &&
9397                     (!is_adv_data || flags_managed(adv_flags)))
9398                         return false;
9399
9400                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
9401                         return false;
9402
9403                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
9404                         return false;
9405
9406                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
9407                         return false;
9408
9409                 if (data[i + 1] == EIR_APPEARANCE &&
9410                     appearance_managed(adv_flags))
9411                         return false;
9412
9413                 /* If the current field length would exceed the total data
9414                  * length, then it's invalid.
9415                  */
9416                 if (i + cur_len >= len)
9417                         return false;
9418         }
9419
9420         return true;
9421 }
9422
9423 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
9424 {
9425         u32 supported_flags, phy_flags;
9426
9427         /* The current implementation only supports a subset of the specified
9428          * flags. Also need to check mutual exclusiveness of sec flags.
9429          */
9430         supported_flags = get_supported_adv_flags(hdev);
9431         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
9432         if (adv_flags & ~supported_flags ||
9433             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
9434                 return false;
9435
9436         return true;
9437 }
9438
9439 static bool adv_busy(struct hci_dev *hdev)
9440 {
9441         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
9442                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
9443                 pending_find(MGMT_OP_SET_LE, hdev) ||
9444                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
9445                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
9446 }
9447
9448 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
9449                                      u16 opcode)
9450 {
9451         struct mgmt_pending_cmd *cmd;
9452         struct mgmt_cp_add_advertising *cp;
9453         struct mgmt_rp_add_advertising rp;
9454         struct adv_info *adv_instance, *n;
9455         u8 instance;
9456
9457         bt_dev_dbg(hdev, "status %u", status);
9458
9459         hci_dev_lock(hdev);
9460
9461         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
9462         if (!cmd)
9463                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
9464
9465         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
9466                 if (!adv_instance->pending)
9467                         continue;
9468
9469                 if (!status) {
9470                         adv_instance->pending = false;
9471                         continue;
9472                 }
9473
9474                 instance = adv_instance->instance;
9475
9476                 if (hdev->cur_adv_instance == instance)
9477                         cancel_adv_timeout(hdev);
9478
9479                 hci_remove_adv_instance(hdev, instance);
9480                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
9481         }
9482
9483         if (!cmd)
9484                 goto unlock;
9485
9486         cp = cmd->param;
9487         rp.instance = cp->instance;
9488
9489         if (status)
9490                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9491                                 mgmt_status(status));
9492         else
9493                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9494                                   mgmt_status(status), &rp, sizeof(rp));
9495
9496         mgmt_pending_remove(cmd);
9497
9498 unlock:
9499         hci_dev_unlock(hdev);
9500 }
9501
9502 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
9503                            void *data, u16 data_len)
9504 {
9505         struct mgmt_cp_add_advertising *cp = data;
9506         struct mgmt_rp_add_advertising rp;
9507         u32 flags;
9508         u8 status;
9509         u16 timeout, duration;
9510         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
9511         u8 schedule_instance = 0;
9512         struct adv_info *next_instance;
9513         int err;
9514         struct mgmt_pending_cmd *cmd;
9515         struct hci_request req;
9516
9517         bt_dev_dbg(hdev, "sock %p", sk);
9518
9519         status = mgmt_le_support(hdev);
9520         if (status)
9521                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9522                                        status);
9523
9524         /* Enabling the experimental LL Privay support disables support for
9525          * advertising.
9526          */
9527         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9528                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9529                                        MGMT_STATUS_NOT_SUPPORTED);
9530
9531         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9532                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9533                                        MGMT_STATUS_INVALID_PARAMS);
9534
9535         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9536                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9537                                        MGMT_STATUS_INVALID_PARAMS);
9538
9539         flags = __le32_to_cpu(cp->flags);
9540         timeout = __le16_to_cpu(cp->timeout);
9541         duration = __le16_to_cpu(cp->duration);
9542
9543         if (!requested_adv_flags_are_valid(hdev, flags))
9544                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9545                                        MGMT_STATUS_INVALID_PARAMS);
9546
9547         hci_dev_lock(hdev);
9548
9549         if (timeout && !hdev_is_powered(hdev)) {
9550                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9551                                       MGMT_STATUS_REJECTED);
9552                 goto unlock;
9553         }
9554
9555         if (adv_busy(hdev)) {
9556                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9557                                       MGMT_STATUS_BUSY);
9558                 goto unlock;
9559         }
9560
9561         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9562             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9563                                cp->scan_rsp_len, false)) {
9564                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9565                                       MGMT_STATUS_INVALID_PARAMS);
9566                 goto unlock;
9567         }
9568
9569         err = hci_add_adv_instance(hdev, cp->instance, flags,
9570                                    cp->adv_data_len, cp->data,
9571                                    cp->scan_rsp_len,
9572                                    cp->data + cp->adv_data_len,
9573                                    timeout, duration,
9574                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
9575                                    hdev->le_adv_min_interval,
9576                                    hdev->le_adv_max_interval);
9577         if (err < 0) {
9578                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9579                                       MGMT_STATUS_FAILED);
9580                 goto unlock;
9581         }
9582
9583         /* Only trigger an advertising added event if a new instance was
9584          * actually added.
9585          */
9586         if (hdev->adv_instance_cnt > prev_instance_cnt)
9587                 mgmt_advertising_added(sk, hdev, cp->instance);
9588
9589         if (hdev->cur_adv_instance == cp->instance) {
9590                 /* If the currently advertised instance is being changed then
9591                  * cancel the current advertising and schedule the next
9592                  * instance. If there is only one instance then the overridden
9593                  * advertising data will be visible right away.
9594                  */
9595                 cancel_adv_timeout(hdev);
9596
9597                 next_instance = hci_get_next_instance(hdev, cp->instance);
9598                 if (next_instance)
9599                         schedule_instance = next_instance->instance;
9600         } else if (!hdev->adv_instance_timeout) {
9601                 /* Immediately advertise the new instance if no other
9602                  * instance is currently being advertised.
9603                  */
9604                 schedule_instance = cp->instance;
9605         }
9606
9607         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9608          * there is no instance to be advertised then we have no HCI
9609          * communication to make. Simply return.
9610          */
9611         if (!hdev_is_powered(hdev) ||
9612             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9613             !schedule_instance) {
9614                 rp.instance = cp->instance;
9615                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9616                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9617                 goto unlock;
9618         }
9619
9620         /* We're good to go, update advertising data, parameters, and start
9621          * advertising.
9622          */
9623         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9624                                data_len);
9625         if (!cmd) {
9626                 err = -ENOMEM;
9627                 goto unlock;
9628         }
9629
9630         hci_req_init(&req, hdev);
9631
9632         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
9633
9634         if (!err)
9635                 err = hci_req_run(&req, add_advertising_complete);
9636
9637         if (err < 0) {
9638                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9639                                       MGMT_STATUS_FAILED);
9640                 mgmt_pending_remove(cmd);
9641         }
9642
9643 unlock:
9644         hci_dev_unlock(hdev);
9645
9646         return err;
9647 }
9648
9649 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
9650                                         u16 opcode)
9651 {
9652         struct mgmt_pending_cmd *cmd;
9653         struct mgmt_cp_add_ext_adv_params *cp;
9654         struct mgmt_rp_add_ext_adv_params rp;
9655         struct adv_info *adv_instance;
9656         u32 flags;
9657
9658         BT_DBG("%s", hdev->name);
9659
9660         hci_dev_lock(hdev);
9661
9662         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
9663         if (!cmd)
9664                 goto unlock;
9665
9666         cp = cmd->param;
9667         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9668         if (!adv_instance)
9669                 goto unlock;
9670
9671         rp.instance = cp->instance;
9672         rp.tx_power = adv_instance->tx_power;
9673
9674         /* While we're at it, inform userspace of the available space for this
9675          * advertisement, given the flags that will be used.
9676          */
9677         flags = __le32_to_cpu(cp->flags);
9678         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9679         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9680
9681         if (status) {
9682                 /* If this advertisement was previously advertising and we
9683                  * failed to update it, we signal that it has been removed and
9684                  * delete its structure
9685                  */
9686                 if (!adv_instance->pending)
9687                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
9688
9689                 hci_remove_adv_instance(hdev, cp->instance);
9690
9691                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9692                                 mgmt_status(status));
9693
9694         } else {
9695                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9696                                   mgmt_status(status), &rp, sizeof(rp));
9697         }
9698
9699 unlock:
9700         if (cmd)
9701                 mgmt_pending_remove(cmd);
9702
9703         hci_dev_unlock(hdev);
9704 }
9705
9706 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
9707                               void *data, u16 data_len)
9708 {
9709         struct mgmt_cp_add_ext_adv_params *cp = data;
9710         struct mgmt_rp_add_ext_adv_params rp;
9711         struct mgmt_pending_cmd *cmd = NULL;
9712         struct adv_info *adv_instance;
9713         struct hci_request req;
9714         u32 flags, min_interval, max_interval;
9715         u16 timeout, duration;
9716         u8 status;
9717         s8 tx_power;
9718         int err;
9719
9720         BT_DBG("%s", hdev->name);
9721
9722         status = mgmt_le_support(hdev);
9723         if (status)
9724                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9725                                        status);
9726
9727         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9728                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9729                                        MGMT_STATUS_INVALID_PARAMS);
9730
9731         /* The purpose of breaking add_advertising into two separate MGMT calls
9732          * for params and data is to allow more parameters to be added to this
9733          * structure in the future. For this reason, we verify that we have the
9734          * bare minimum structure we know of when the interface was defined. Any
9735          * extra parameters we don't know about will be ignored in this request.
9736          */
9737         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
9738                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9739                                        MGMT_STATUS_INVALID_PARAMS);
9740
9741         flags = __le32_to_cpu(cp->flags);
9742
9743         if (!requested_adv_flags_are_valid(hdev, flags))
9744                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9745                                        MGMT_STATUS_INVALID_PARAMS);
9746
9747         hci_dev_lock(hdev);
9748
9749         /* In new interface, we require that we are powered to register */
9750         if (!hdev_is_powered(hdev)) {
9751                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9752                                       MGMT_STATUS_REJECTED);
9753                 goto unlock;
9754         }
9755
9756         if (adv_busy(hdev)) {
9757                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9758                                       MGMT_STATUS_BUSY);
9759                 goto unlock;
9760         }
9761
9762         /* Parse defined parameters from request, use defaults otherwise */
9763         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
9764                   __le16_to_cpu(cp->timeout) : 0;
9765
9766         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
9767                    __le16_to_cpu(cp->duration) :
9768                    hdev->def_multi_adv_rotation_duration;
9769
9770         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9771                        __le32_to_cpu(cp->min_interval) :
9772                        hdev->le_adv_min_interval;
9773
9774         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9775                        __le32_to_cpu(cp->max_interval) :
9776                        hdev->le_adv_max_interval;
9777
9778         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
9779                    cp->tx_power :
9780                    HCI_ADV_TX_POWER_NO_PREFERENCE;
9781
9782         /* Create advertising instance with no advertising or response data */
9783         err = hci_add_adv_instance(hdev, cp->instance, flags,
9784                                    0, NULL, 0, NULL, timeout, duration,
9785                                    tx_power, min_interval, max_interval);
9786
9787         if (err < 0) {
9788                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9789                                       MGMT_STATUS_FAILED);
9790                 goto unlock;
9791         }
9792
9793         /* Submit request for advertising params if ext adv available */
9794         if (ext_adv_capable(hdev)) {
9795                 hci_req_init(&req, hdev);
9796                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
9797
9798                 /* Updating parameters of an active instance will return a
9799                  * Command Disallowed error, so we must first disable the
9800                  * instance if it is active.
9801                  */
9802                 if (!adv_instance->pending)
9803                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
9804
9805                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
9806
9807                 err = hci_req_run(&req, add_ext_adv_params_complete);
9808
9809                 if (!err)
9810                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
9811                                                hdev, data, data_len);
9812                 if (!cmd) {
9813                         err = -ENOMEM;
9814                         hci_remove_adv_instance(hdev, cp->instance);
9815                         goto unlock;
9816                 }
9817
9818         } else {
9819                 rp.instance = cp->instance;
9820                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
9821                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9822                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9823                 err = mgmt_cmd_complete(sk, hdev->id,
9824                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
9825                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9826         }
9827
9828 unlock:
9829         hci_dev_unlock(hdev);
9830
9831         return err;
9832 }
9833
9834 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
9835                             u16 data_len)
9836 {
9837         struct mgmt_cp_add_ext_adv_data *cp = data;
9838         struct mgmt_rp_add_ext_adv_data rp;
9839         u8 schedule_instance = 0;
9840         struct adv_info *next_instance;
9841         struct adv_info *adv_instance;
9842         int err = 0;
9843         struct mgmt_pending_cmd *cmd;
9844         struct hci_request req;
9845
9846         BT_DBG("%s", hdev->name);
9847
9848         hci_dev_lock(hdev);
9849
9850         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9851
9852         if (!adv_instance) {
9853                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9854                                       MGMT_STATUS_INVALID_PARAMS);
9855                 goto unlock;
9856         }
9857
9858         /* In new interface, we require that we are powered to register */
9859         if (!hdev_is_powered(hdev)) {
9860                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9861                                       MGMT_STATUS_REJECTED);
9862                 goto clear_new_instance;
9863         }
9864
9865         if (adv_busy(hdev)) {
9866                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9867                                       MGMT_STATUS_BUSY);
9868                 goto clear_new_instance;
9869         }
9870
9871         /* Validate new data */
9872         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
9873                                cp->adv_data_len, true) ||
9874             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
9875                                cp->adv_data_len, cp->scan_rsp_len, false)) {
9876                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9877                                       MGMT_STATUS_INVALID_PARAMS);
9878                 goto clear_new_instance;
9879         }
9880
9881         /* Set the data in the advertising instance */
9882         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
9883                                   cp->data, cp->scan_rsp_len,
9884                                   cp->data + cp->adv_data_len);
9885
9886         /* We're good to go, update advertising data, parameters, and start
9887          * advertising.
9888          */
9889
9890         hci_req_init(&req, hdev);
9891
9892         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
9893
9894         if (ext_adv_capable(hdev)) {
9895                 __hci_req_update_adv_data(&req, cp->instance);
9896                 __hci_req_update_scan_rsp_data(&req, cp->instance);
9897                 __hci_req_enable_ext_advertising(&req, cp->instance);
9898
9899         } else {
9900                 /* If using software rotation, determine next instance to use */
9901
9902                 if (hdev->cur_adv_instance == cp->instance) {
9903                         /* If the currently advertised instance is being changed
9904                          * then cancel the current advertising and schedule the
9905                          * next instance. If there is only one instance then the
9906                          * overridden advertising data will be visible right
9907                          * away
9908                          */
9909                         cancel_adv_timeout(hdev);
9910
9911                         next_instance = hci_get_next_instance(hdev,
9912                                                               cp->instance);
9913                         if (next_instance)
9914                                 schedule_instance = next_instance->instance;
9915                 } else if (!hdev->adv_instance_timeout) {
9916                         /* Immediately advertise the new instance if no other
9917                          * instance is currently being advertised.
9918                          */
9919                         schedule_instance = cp->instance;
9920                 }
9921
9922                 /* If the HCI_ADVERTISING flag is set or there is no instance to
9923                  * be advertised then we have no HCI communication to make.
9924                  * Simply return.
9925                  */
9926                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9927                     !schedule_instance) {
9928                         if (adv_instance->pending) {
9929                                 mgmt_advertising_added(sk, hdev, cp->instance);
9930                                 adv_instance->pending = false;
9931                         }
9932                         rp.instance = cp->instance;
9933                         err = mgmt_cmd_complete(sk, hdev->id,
9934                                                 MGMT_OP_ADD_EXT_ADV_DATA,
9935                                                 MGMT_STATUS_SUCCESS, &rp,
9936                                                 sizeof(rp));
9937                         goto unlock;
9938                 }
9939
9940                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
9941                                                       true);
9942         }
9943
9944         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
9945                                data_len);
9946         if (!cmd) {
9947                 err = -ENOMEM;
9948                 goto clear_new_instance;
9949         }
9950
9951         if (!err)
9952                 err = hci_req_run(&req, add_advertising_complete);
9953
9954         if (err < 0) {
9955                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9956                                       MGMT_STATUS_FAILED);
9957                 mgmt_pending_remove(cmd);
9958                 goto clear_new_instance;
9959         }
9960
9961         /* We were successful in updating data, so trigger advertising_added
9962          * event if this is an instance that wasn't previously advertising. If
9963          * a failure occurs in the requests we initiated, we will remove the
9964          * instance again in add_advertising_complete
9965          */
9966         if (adv_instance->pending)
9967                 mgmt_advertising_added(sk, hdev, cp->instance);
9968
9969         goto unlock;
9970
9971 clear_new_instance:
9972         hci_remove_adv_instance(hdev, cp->instance);
9973
9974 unlock:
9975         hci_dev_unlock(hdev);
9976
9977         return err;
9978 }
9979
9980 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
9981                                         u16 opcode)
9982 {
9983         struct mgmt_pending_cmd *cmd;
9984         struct mgmt_cp_remove_advertising *cp;
9985         struct mgmt_rp_remove_advertising rp;
9986
9987         bt_dev_dbg(hdev, "status %u", status);
9988
9989         hci_dev_lock(hdev);
9990
9991         /* A failure status here only means that we failed to disable
9992          * advertising. Otherwise, the advertising instance has been removed,
9993          * so report success.
9994          */
9995         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
9996         if (!cmd)
9997                 goto unlock;
9998
9999         cp = cmd->param;
10000         rp.instance = cp->instance;
10001
10002         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
10003                           &rp, sizeof(rp));
10004         mgmt_pending_remove(cmd);
10005
10006 unlock:
10007         hci_dev_unlock(hdev);
10008 }
10009
10010 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
10011                               void *data, u16 data_len)
10012 {
10013         struct mgmt_cp_remove_advertising *cp = data;
10014         struct mgmt_rp_remove_advertising rp;
10015         struct mgmt_pending_cmd *cmd;
10016         struct hci_request req;
10017         int err;
10018
10019         bt_dev_dbg(hdev, "sock %p", sk);
10020
10021         /* Enabling the experimental LL Privay support disables support for
10022          * advertising.
10023          */
10024         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
10025                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
10026                                        MGMT_STATUS_NOT_SUPPORTED);
10027
10028         hci_dev_lock(hdev);
10029
10030         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
10031                 err = mgmt_cmd_status(sk, hdev->id,
10032                                       MGMT_OP_REMOVE_ADVERTISING,
10033                                       MGMT_STATUS_INVALID_PARAMS);
10034                 goto unlock;
10035         }
10036
10037         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
10038             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
10039             pending_find(MGMT_OP_SET_LE, hdev)) {
10040                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10041                                       MGMT_STATUS_BUSY);
10042                 goto unlock;
10043         }
10044
10045         if (list_empty(&hdev->adv_instances)) {
10046                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10047                                       MGMT_STATUS_INVALID_PARAMS);
10048                 goto unlock;
10049         }
10050
10051         hci_req_init(&req, hdev);
10052
10053         /* If we use extended advertising, instance is disabled and removed */
10054         if (ext_adv_capable(hdev)) {
10055                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
10056                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
10057         }
10058
10059         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
10060
10061         if (list_empty(&hdev->adv_instances))
10062                 __hci_req_disable_advertising(&req);
10063
10064         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
10065          * flag is set or the device isn't powered then we have no HCI
10066          * communication to make. Simply return.
10067          */
10068         if (skb_queue_empty(&req.cmd_q) ||
10069             !hdev_is_powered(hdev) ||
10070             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
10071                 hci_req_purge(&req);
10072                 rp.instance = cp->instance;
10073                 err = mgmt_cmd_complete(sk, hdev->id,
10074                                         MGMT_OP_REMOVE_ADVERTISING,
10075                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10076                 goto unlock;
10077         }
10078
10079         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
10080                                data_len);
10081         if (!cmd) {
10082                 err = -ENOMEM;
10083                 goto unlock;
10084         }
10085
10086         err = hci_req_run(&req, remove_advertising_complete);
10087         if (err < 0)
10088                 mgmt_pending_remove(cmd);
10089
10090 unlock:
10091         hci_dev_unlock(hdev);
10092
10093         return err;
10094 }
10095
10096 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
10097                              void *data, u16 data_len)
10098 {
10099         struct mgmt_cp_get_adv_size_info *cp = data;
10100         struct mgmt_rp_get_adv_size_info rp;
10101         u32 flags, supported_flags;
10102         int err;
10103
10104         bt_dev_dbg(hdev, "sock %p", sk);
10105
10106         if (!lmp_le_capable(hdev))
10107                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10108                                        MGMT_STATUS_REJECTED);
10109
10110         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10111                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10112                                        MGMT_STATUS_INVALID_PARAMS);
10113
10114         flags = __le32_to_cpu(cp->flags);
10115
10116         /* The current implementation only supports a subset of the specified
10117          * flags.
10118          */
10119         supported_flags = get_supported_adv_flags(hdev);
10120         if (flags & ~supported_flags)
10121                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10122                                        MGMT_STATUS_INVALID_PARAMS);
10123
10124         rp.instance = cp->instance;
10125         rp.flags = cp->flags;
10126         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10127         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10128
10129         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10130                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10131
10132         return err;
10133 }
10134
10135 static const struct hci_mgmt_handler mgmt_handlers[] = {
10136         { NULL }, /* 0x0000 (no command) */
10137         { read_version,            MGMT_READ_VERSION_SIZE,
10138                                                 HCI_MGMT_NO_HDEV |
10139                                                 HCI_MGMT_UNTRUSTED },
10140         { read_commands,           MGMT_READ_COMMANDS_SIZE,
10141                                                 HCI_MGMT_NO_HDEV |
10142                                                 HCI_MGMT_UNTRUSTED },
10143         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
10144                                                 HCI_MGMT_NO_HDEV |
10145                                                 HCI_MGMT_UNTRUSTED },
10146         { read_controller_info,    MGMT_READ_INFO_SIZE,
10147                                                 HCI_MGMT_UNTRUSTED },
10148         { set_powered,             MGMT_SETTING_SIZE },
10149         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
10150         { set_connectable,         MGMT_SETTING_SIZE },
10151         { set_fast_connectable,    MGMT_SETTING_SIZE },
10152         { set_bondable,            MGMT_SETTING_SIZE },
10153         { set_link_security,       MGMT_SETTING_SIZE },
10154         { set_ssp,                 MGMT_SETTING_SIZE },
10155         { set_hs,                  MGMT_SETTING_SIZE },
10156         { set_le,                  MGMT_SETTING_SIZE },
10157         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
10158         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
10159         { add_uuid,                MGMT_ADD_UUID_SIZE },
10160         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
10161         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
10162                                                 HCI_MGMT_VAR_LEN },
10163         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
10164                                                 HCI_MGMT_VAR_LEN },
10165         { disconnect,              MGMT_DISCONNECT_SIZE },
10166         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
10167         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
10168         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
10169         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
10170         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
10171         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
10172         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
10173         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
10174         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
10175         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
10176         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
10177         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
10178         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
10179                                                 HCI_MGMT_VAR_LEN },
10180         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
10181         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
10182         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
10183         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
10184         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
10185         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
10186         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
10187         { set_advertising,         MGMT_SETTING_SIZE },
10188         { set_bredr,               MGMT_SETTING_SIZE },
10189         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
10190         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
10191         { set_secure_conn,         MGMT_SETTING_SIZE },
10192         { set_debug_keys,          MGMT_SETTING_SIZE },
10193         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
10194         { load_irks,               MGMT_LOAD_IRKS_SIZE,
10195                                                 HCI_MGMT_VAR_LEN },
10196         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
10197         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
10198         { add_device,              MGMT_ADD_DEVICE_SIZE },
10199         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
10200         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
10201                                                 HCI_MGMT_VAR_LEN },
10202         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
10203                                                 HCI_MGMT_NO_HDEV |
10204                                                 HCI_MGMT_UNTRUSTED },
10205         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
10206                                                 HCI_MGMT_UNCONFIGURED |
10207                                                 HCI_MGMT_UNTRUSTED },
10208         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
10209                                                 HCI_MGMT_UNCONFIGURED },
10210         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
10211                                                 HCI_MGMT_UNCONFIGURED },
10212         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
10213                                                 HCI_MGMT_VAR_LEN },
10214         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
10215         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
10216                                                 HCI_MGMT_NO_HDEV |
10217                                                 HCI_MGMT_UNTRUSTED },
10218         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
10219         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
10220                                                 HCI_MGMT_VAR_LEN },
10221         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
10222         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
10223         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
10224         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
10225                                                 HCI_MGMT_UNTRUSTED },
10226         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
10227         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
10228         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
10229         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
10230                                                 HCI_MGMT_VAR_LEN },
10231         { set_wideband_speech,     MGMT_SETTING_SIZE },
10232         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
10233                                                 HCI_MGMT_UNTRUSTED },
10234         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
10235                                                 HCI_MGMT_UNTRUSTED |
10236                                                 HCI_MGMT_HDEV_OPTIONAL },
10237         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
10238                                                 HCI_MGMT_VAR_LEN |
10239                                                 HCI_MGMT_HDEV_OPTIONAL },
10240         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
10241                                                 HCI_MGMT_UNTRUSTED },
10242         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
10243                                                 HCI_MGMT_VAR_LEN },
10244         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
10245                                                 HCI_MGMT_UNTRUSTED },
10246         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
10247                                                 HCI_MGMT_VAR_LEN },
10248         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
10249         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
10250         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
10251         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
10252                                                 HCI_MGMT_VAR_LEN },
10253         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
10254         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
10255                                                 HCI_MGMT_VAR_LEN },
10256         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
10257                                                 HCI_MGMT_VAR_LEN },
10258         { add_adv_patterns_monitor_rssi,
10259                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
10260                                                 HCI_MGMT_VAR_LEN },
10261 };
10262
10263 #ifdef TIZEN_BT
10264 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
10265         { NULL }, /* 0x0000 (no command) */
10266         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
10267         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
10268                                                 HCI_MGMT_VAR_LEN },
10269         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
10270                                                 HCI_MGMT_VAR_LEN },
10271         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
10272         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
10273         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
10274         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
10275         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
10276         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
10277         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
10278         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
10279         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
10280         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
10281         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
10282         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
10283 };
10284 #endif
10285
10286 void mgmt_index_added(struct hci_dev *hdev)
10287 {
10288         struct mgmt_ev_ext_index ev;
10289
10290         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10291                 return;
10292
10293         switch (hdev->dev_type) {
10294         case HCI_PRIMARY:
10295                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10296                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
10297                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10298                         ev.type = 0x01;
10299                 } else {
10300                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
10301                                          HCI_MGMT_INDEX_EVENTS);
10302                         ev.type = 0x00;
10303                 }
10304                 break;
10305         case HCI_AMP:
10306                 ev.type = 0x02;
10307                 break;
10308         default:
10309                 return;
10310         }
10311
10312         ev.bus = hdev->bus;
10313
10314         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
10315                          HCI_MGMT_EXT_INDEX_EVENTS);
10316 }
10317
10318 void mgmt_index_removed(struct hci_dev *hdev)
10319 {
10320         struct mgmt_ev_ext_index ev;
10321         u8 status = MGMT_STATUS_INVALID_INDEX;
10322
10323         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10324                 return;
10325
10326         switch (hdev->dev_type) {
10327         case HCI_PRIMARY:
10328                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10329
10330                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10331                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
10332                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10333                         ev.type = 0x01;
10334                 } else {
10335                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
10336                                          HCI_MGMT_INDEX_EVENTS);
10337                         ev.type = 0x00;
10338                 }
10339                 break;
10340         case HCI_AMP:
10341                 ev.type = 0x02;
10342                 break;
10343         default:
10344                 return;
10345         }
10346
10347         ev.bus = hdev->bus;
10348
10349         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
10350                          HCI_MGMT_EXT_INDEX_EVENTS);
10351 }
10352
10353 /* This function requires the caller holds hdev->lock */
10354 static void restart_le_actions(struct hci_dev *hdev)
10355 {
10356         struct hci_conn_params *p;
10357
10358         list_for_each_entry(p, &hdev->le_conn_params, list) {
10359                 /* Needed for AUTO_OFF case where might not "really"
10360                  * have been powered off.
10361                  */
10362                 list_del_init(&p->action);
10363
10364                 switch (p->auto_connect) {
10365                 case HCI_AUTO_CONN_DIRECT:
10366                 case HCI_AUTO_CONN_ALWAYS:
10367                         list_add(&p->action, &hdev->pend_le_conns);
10368                         break;
10369                 case HCI_AUTO_CONN_REPORT:
10370                         list_add(&p->action, &hdev->pend_le_reports);
10371                         break;
10372                 default:
10373                         break;
10374                 }
10375         }
10376 }
10377
10378 void mgmt_power_on(struct hci_dev *hdev, int err)
10379 {
10380         struct cmd_lookup match = { NULL, hdev };
10381
10382         bt_dev_dbg(hdev, "err %d", err);
10383
10384         hci_dev_lock(hdev);
10385
10386         if (!err) {
10387                 restart_le_actions(hdev);
10388                 hci_update_background_scan(hdev);
10389         }
10390
10391         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10392
10393         new_settings(hdev, match.sk);
10394
10395         if (match.sk)
10396                 sock_put(match.sk);
10397
10398         hci_dev_unlock(hdev);
10399 }
10400
10401 void __mgmt_power_off(struct hci_dev *hdev)
10402 {
10403         struct cmd_lookup match = { NULL, hdev };
10404         u8 status, zero_cod[] = { 0, 0, 0 };
10405
10406         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10407
10408         /* If the power off is because of hdev unregistration let
10409          * use the appropriate INVALID_INDEX status. Otherwise use
10410          * NOT_POWERED. We cover both scenarios here since later in
10411          * mgmt_index_removed() any hci_conn callbacks will have already
10412          * been triggered, potentially causing misleading DISCONNECTED
10413          * status responses.
10414          */
10415         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
10416                 status = MGMT_STATUS_INVALID_INDEX;
10417         else
10418                 status = MGMT_STATUS_NOT_POWERED;
10419
10420         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10421
10422         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
10423                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
10424                                    zero_cod, sizeof(zero_cod),
10425                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10426                 ext_info_changed(hdev, NULL);
10427         }
10428
10429         new_settings(hdev, match.sk);
10430
10431         if (match.sk)
10432                 sock_put(match.sk);
10433 }
10434
10435 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
10436 {
10437         struct mgmt_pending_cmd *cmd;
10438         u8 status;
10439
10440         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10441         if (!cmd)
10442                 return;
10443
10444         if (err == -ERFKILL)
10445                 status = MGMT_STATUS_RFKILLED;
10446         else
10447                 status = MGMT_STATUS_FAILED;
10448
10449         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
10450
10451         mgmt_pending_remove(cmd);
10452 }
10453
10454 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
10455                        bool persistent)
10456 {
10457         struct mgmt_ev_new_link_key ev;
10458
10459         memset(&ev, 0, sizeof(ev));
10460
10461         ev.store_hint = persistent;
10462         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10463         ev.key.addr.type = BDADDR_BREDR;
10464         ev.key.type = key->type;
10465         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
10466         ev.key.pin_len = key->pin_len;
10467
10468         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
10469 }
10470
10471 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
10472 {
10473         switch (ltk->type) {
10474         case SMP_LTK:
10475         case SMP_LTK_RESPONDER:
10476                 if (ltk->authenticated)
10477                         return MGMT_LTK_AUTHENTICATED;
10478                 return MGMT_LTK_UNAUTHENTICATED;
10479         case SMP_LTK_P256:
10480                 if (ltk->authenticated)
10481                         return MGMT_LTK_P256_AUTH;
10482                 return MGMT_LTK_P256_UNAUTH;
10483         case SMP_LTK_P256_DEBUG:
10484                 return MGMT_LTK_P256_DEBUG;
10485         }
10486
10487         return MGMT_LTK_UNAUTHENTICATED;
10488 }
10489
10490 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
10491 {
10492         struct mgmt_ev_new_long_term_key ev;
10493
10494         memset(&ev, 0, sizeof(ev));
10495
10496         /* Devices using resolvable or non-resolvable random addresses
10497          * without providing an identity resolving key don't require
10498          * to store long term keys. Their addresses will change the
10499          * next time around.
10500          *
10501          * Only when a remote device provides an identity address
10502          * make sure the long term key is stored. If the remote
10503          * identity is known, the long term keys are internally
10504          * mapped to the identity address. So allow static random
10505          * and public addresses here.
10506          */
10507         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10508             (key->bdaddr.b[5] & 0xc0) != 0xc0)
10509                 ev.store_hint = 0x00;
10510         else
10511                 ev.store_hint = persistent;
10512
10513         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10514         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
10515         ev.key.type = mgmt_ltk_type(key);
10516         ev.key.enc_size = key->enc_size;
10517         ev.key.ediv = key->ediv;
10518         ev.key.rand = key->rand;
10519
10520         if (key->type == SMP_LTK)
10521                 ev.key.initiator = 1;
10522
10523         /* Make sure we copy only the significant bytes based on the
10524          * encryption key size, and set the rest of the value to zeroes.
10525          */
10526         memcpy(ev.key.val, key->val, key->enc_size);
10527         memset(ev.key.val + key->enc_size, 0,
10528                sizeof(ev.key.val) - key->enc_size);
10529
10530         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
10531 }
10532
10533 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
10534 {
10535         struct mgmt_ev_new_irk ev;
10536
10537         memset(&ev, 0, sizeof(ev));
10538
10539         ev.store_hint = persistent;
10540
10541         bacpy(&ev.rpa, &irk->rpa);
10542         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
10543         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
10544         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
10545
10546         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
10547 }
10548
10549 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
10550                    bool persistent)
10551 {
10552         struct mgmt_ev_new_csrk ev;
10553
10554         memset(&ev, 0, sizeof(ev));
10555
10556         /* Devices using resolvable or non-resolvable random addresses
10557          * without providing an identity resolving key don't require
10558          * to store signature resolving keys. Their addresses will change
10559          * the next time around.
10560          *
10561          * Only when a remote device provides an identity address
10562          * make sure the signature resolving key is stored. So allow
10563          * static random and public addresses here.
10564          */
10565         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10566             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
10567                 ev.store_hint = 0x00;
10568         else
10569                 ev.store_hint = persistent;
10570
10571         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
10572         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
10573         ev.key.type = csrk->type;
10574         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
10575
10576         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
10577 }
10578
10579 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
10580                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
10581                          u16 max_interval, u16 latency, u16 timeout)
10582 {
10583         struct mgmt_ev_new_conn_param ev;
10584
10585         if (!hci_is_identity_address(bdaddr, bdaddr_type))
10586                 return;
10587
10588         memset(&ev, 0, sizeof(ev));
10589         bacpy(&ev.addr.bdaddr, bdaddr);
10590         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
10591         ev.store_hint = store_hint;
10592         ev.min_interval = cpu_to_le16(min_interval);
10593         ev.max_interval = cpu_to_le16(max_interval);
10594         ev.latency = cpu_to_le16(latency);
10595         ev.timeout = cpu_to_le16(timeout);
10596
10597         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
10598 }
10599
10600 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
10601                            u8 *name, u8 name_len)
10602 {
10603         char buf[512];
10604         struct mgmt_ev_device_connected *ev = (void *) buf;
10605         u16 eir_len = 0;
10606         u32 flags = 0;
10607
10608         bacpy(&ev->addr.bdaddr, &conn->dst);
10609         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10610
10611         if (conn->out)
10612                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
10613
10614         ev->flags = __cpu_to_le32(flags);
10615
10616         /* We must ensure that the EIR Data fields are ordered and
10617          * unique. Keep it simple for now and avoid the problem by not
10618          * adding any BR/EDR data to the LE adv.
10619          */
10620         if (conn->le_adv_data_len > 0) {
10621                 memcpy(&ev->eir[eir_len],
10622                        conn->le_adv_data, conn->le_adv_data_len);
10623                 eir_len = conn->le_adv_data_len;
10624         } else {
10625                 if (name_len > 0)
10626                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
10627                                                   name, name_len);
10628
10629                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
10630                         eir_len = eir_append_data(ev->eir, eir_len,
10631                                                   EIR_CLASS_OF_DEV,
10632                                                   conn->dev_class, 3);
10633         }
10634
10635         ev->eir_len = cpu_to_le16(eir_len);
10636
10637         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
10638                     sizeof(*ev) + eir_len, NULL);
10639 }
10640
10641 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
10642 {
10643         struct sock **sk = data;
10644
10645         cmd->cmd_complete(cmd, 0);
10646
10647         *sk = cmd->sk;
10648         sock_hold(*sk);
10649
10650         mgmt_pending_remove(cmd);
10651 }
10652
10653 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
10654 {
10655         struct hci_dev *hdev = data;
10656         struct mgmt_cp_unpair_device *cp = cmd->param;
10657
10658         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
10659
10660         cmd->cmd_complete(cmd, 0);
10661         mgmt_pending_remove(cmd);
10662 }
10663
10664 bool mgmt_powering_down(struct hci_dev *hdev)
10665 {
10666         struct mgmt_pending_cmd *cmd;
10667         struct mgmt_mode *cp;
10668
10669         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10670         if (!cmd)
10671                 return false;
10672
10673         cp = cmd->param;
10674         if (!cp->val)
10675                 return true;
10676
10677         return false;
10678 }
10679
10680 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10681                               u8 link_type, u8 addr_type, u8 reason,
10682                               bool mgmt_connected)
10683 {
10684         struct mgmt_ev_device_disconnected ev;
10685         struct sock *sk = NULL;
10686
10687         /* The connection is still in hci_conn_hash so test for 1
10688          * instead of 0 to know if this is the last one.
10689          */
10690         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10691                 cancel_delayed_work(&hdev->power_off);
10692                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10693         }
10694
10695         if (!mgmt_connected)
10696                 return;
10697
10698         if (link_type != ACL_LINK && link_type != LE_LINK)
10699                 return;
10700
10701         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
10702
10703         bacpy(&ev.addr.bdaddr, bdaddr);
10704         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10705         ev.reason = reason;
10706
10707         /* Report disconnects due to suspend */
10708         if (hdev->suspended)
10709                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10710
10711         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10712
10713         if (sk)
10714                 sock_put(sk);
10715
10716         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10717                              hdev);
10718 }
10719
10720 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10721                             u8 link_type, u8 addr_type, u8 status)
10722 {
10723         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10724         struct mgmt_cp_disconnect *cp;
10725         struct mgmt_pending_cmd *cmd;
10726
10727         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10728                              hdev);
10729
10730         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10731         if (!cmd)
10732                 return;
10733
10734         cp = cmd->param;
10735
10736         if (bacmp(bdaddr, &cp->addr.bdaddr))
10737                 return;
10738
10739         if (cp->addr.type != bdaddr_type)
10740                 return;
10741
10742         cmd->cmd_complete(cmd, mgmt_status(status));
10743         mgmt_pending_remove(cmd);
10744 }
10745
10746 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10747                          u8 addr_type, u8 status)
10748 {
10749         struct mgmt_ev_connect_failed ev;
10750
10751         /* The connection is still in hci_conn_hash so test for 1
10752          * instead of 0 to know if this is the last one.
10753          */
10754         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10755                 cancel_delayed_work(&hdev->power_off);
10756                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10757         }
10758
10759         bacpy(&ev.addr.bdaddr, bdaddr);
10760         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10761         ev.status = mgmt_status(status);
10762
10763         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
10764 }
10765
10766 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
10767 {
10768         struct mgmt_ev_pin_code_request ev;
10769
10770         bacpy(&ev.addr.bdaddr, bdaddr);
10771         ev.addr.type = BDADDR_BREDR;
10772         ev.secure = secure;
10773
10774         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
10775 }
10776
10777 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10778                                   u8 status)
10779 {
10780         struct mgmt_pending_cmd *cmd;
10781
10782         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
10783         if (!cmd)
10784                 return;
10785
10786         cmd->cmd_complete(cmd, mgmt_status(status));
10787         mgmt_pending_remove(cmd);
10788 }
10789
10790 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10791                                       u8 status)
10792 {
10793         struct mgmt_pending_cmd *cmd;
10794
10795         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
10796         if (!cmd)
10797                 return;
10798
10799         cmd->cmd_complete(cmd, mgmt_status(status));
10800         mgmt_pending_remove(cmd);
10801 }
10802
10803 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10804                               u8 link_type, u8 addr_type, u32 value,
10805                               u8 confirm_hint)
10806 {
10807         struct mgmt_ev_user_confirm_request ev;
10808
10809         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10810
10811         bacpy(&ev.addr.bdaddr, bdaddr);
10812         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10813         ev.confirm_hint = confirm_hint;
10814         ev.value = cpu_to_le32(value);
10815
10816         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
10817                           NULL);
10818 }
10819
10820 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10821                               u8 link_type, u8 addr_type)
10822 {
10823         struct mgmt_ev_user_passkey_request ev;
10824
10825         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10826
10827         bacpy(&ev.addr.bdaddr, bdaddr);
10828         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10829
10830         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
10831                           NULL);
10832 }
10833
10834 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10835                                       u8 link_type, u8 addr_type, u8 status,
10836                                       u8 opcode)
10837 {
10838         struct mgmt_pending_cmd *cmd;
10839
10840         cmd = pending_find(opcode, hdev);
10841         if (!cmd)
10842                 return -ENOENT;
10843
10844         cmd->cmd_complete(cmd, mgmt_status(status));
10845         mgmt_pending_remove(cmd);
10846
10847         return 0;
10848 }
10849
10850 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10851                                      u8 link_type, u8 addr_type, u8 status)
10852 {
10853         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10854                                           status, MGMT_OP_USER_CONFIRM_REPLY);
10855 }
10856
10857 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10858                                          u8 link_type, u8 addr_type, u8 status)
10859 {
10860         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10861                                           status,
10862                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
10863 }
10864
10865 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10866                                      u8 link_type, u8 addr_type, u8 status)
10867 {
10868         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10869                                           status, MGMT_OP_USER_PASSKEY_REPLY);
10870 }
10871
10872 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10873                                          u8 link_type, u8 addr_type, u8 status)
10874 {
10875         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10876                                           status,
10877                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
10878 }
10879
10880 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
10881                              u8 link_type, u8 addr_type, u32 passkey,
10882                              u8 entered)
10883 {
10884         struct mgmt_ev_passkey_notify ev;
10885
10886         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10887
10888         bacpy(&ev.addr.bdaddr, bdaddr);
10889         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10890         ev.passkey = __cpu_to_le32(passkey);
10891         ev.entered = entered;
10892
10893         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
10894 }
10895
10896 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
10897 {
10898         struct mgmt_ev_auth_failed ev;
10899         struct mgmt_pending_cmd *cmd;
10900         u8 status = mgmt_status(hci_status);
10901
10902         bacpy(&ev.addr.bdaddr, &conn->dst);
10903         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10904         ev.status = status;
10905
10906         cmd = find_pairing(conn);
10907
10908         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
10909                     cmd ? cmd->sk : NULL);
10910
10911         if (cmd) {
10912                 cmd->cmd_complete(cmd, status);
10913                 mgmt_pending_remove(cmd);
10914         }
10915 }
10916
10917 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
10918 {
10919         struct cmd_lookup match = { NULL, hdev };
10920         bool changed;
10921
10922         if (status) {
10923                 u8 mgmt_err = mgmt_status(status);
10924                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
10925                                      cmd_status_rsp, &mgmt_err);
10926                 return;
10927         }
10928
10929         if (test_bit(HCI_AUTH, &hdev->flags))
10930                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
10931         else
10932                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
10933
10934         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
10935                              &match);
10936
10937         if (changed)
10938                 new_settings(hdev, match.sk);
10939
10940         if (match.sk)
10941                 sock_put(match.sk);
10942 }
10943
10944 static void clear_eir(struct hci_request *req)
10945 {
10946         struct hci_dev *hdev = req->hdev;
10947         struct hci_cp_write_eir cp;
10948
10949         if (!lmp_ext_inq_capable(hdev))
10950                 return;
10951
10952         memset(hdev->eir, 0, sizeof(hdev->eir));
10953
10954         memset(&cp, 0, sizeof(cp));
10955
10956         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
10957 }
10958
10959 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
10960 {
10961         struct cmd_lookup match = { NULL, hdev };
10962         struct hci_request req;
10963         bool changed = false;
10964
10965         if (status) {
10966                 u8 mgmt_err = mgmt_status(status);
10967
10968                 if (enable && hci_dev_test_and_clear_flag(hdev,
10969                                                           HCI_SSP_ENABLED)) {
10970                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
10971                         new_settings(hdev, NULL);
10972                 }
10973
10974                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
10975                                      &mgmt_err);
10976                 return;
10977         }
10978
10979         if (enable) {
10980                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
10981         } else {
10982                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
10983                 if (!changed)
10984                         changed = hci_dev_test_and_clear_flag(hdev,
10985                                                               HCI_HS_ENABLED);
10986                 else
10987                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
10988         }
10989
10990         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
10991
10992         if (changed)
10993                 new_settings(hdev, match.sk);
10994
10995         if (match.sk)
10996                 sock_put(match.sk);
10997
10998         hci_req_init(&req, hdev);
10999
11000         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
11001                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
11002                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
11003                                     sizeof(enable), &enable);
11004                 __hci_req_update_eir(&req);
11005         } else {
11006                 clear_eir(&req);
11007         }
11008
11009         hci_req_run(&req, NULL);
11010 }
11011
11012 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
11013 {
11014         struct cmd_lookup *match = data;
11015
11016         if (match->sk == NULL) {
11017                 match->sk = cmd->sk;
11018                 sock_hold(match->sk);
11019         }
11020 }
11021
11022 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
11023                                     u8 status)
11024 {
11025         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
11026
11027         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
11028         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
11029         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
11030
11031         if (!status) {
11032                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
11033                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11034                 ext_info_changed(hdev, NULL);
11035         }
11036
11037         if (match.sk)
11038                 sock_put(match.sk);
11039 }
11040
11041 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
11042 {
11043         struct mgmt_cp_set_local_name ev;
11044         struct mgmt_pending_cmd *cmd;
11045
11046         if (status)
11047                 return;
11048
11049         memset(&ev, 0, sizeof(ev));
11050         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
11051         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
11052
11053         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
11054         if (!cmd) {
11055                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
11056
11057                 /* If this is a HCI command related to powering on the
11058                  * HCI dev don't send any mgmt signals.
11059                  */
11060                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
11061                         return;
11062         }
11063
11064         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
11065                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
11066         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
11067 }
11068
11069 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
11070 {
11071         int i;
11072
11073         for (i = 0; i < uuid_count; i++) {
11074                 if (!memcmp(uuid, uuids[i], 16))
11075                         return true;
11076         }
11077
11078         return false;
11079 }
11080
11081 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
11082 {
11083         u16 parsed = 0;
11084
11085         while (parsed < eir_len) {
11086                 u8 field_len = eir[0];
11087                 u8 uuid[16];
11088                 int i;
11089
11090                 if (field_len == 0)
11091                         break;
11092
11093                 if (eir_len - parsed < field_len + 1)
11094                         break;
11095
11096                 switch (eir[1]) {
11097                 case EIR_UUID16_ALL:
11098                 case EIR_UUID16_SOME:
11099                         for (i = 0; i + 3 <= field_len; i += 2) {
11100                                 memcpy(uuid, bluetooth_base_uuid, 16);
11101                                 uuid[13] = eir[i + 3];
11102                                 uuid[12] = eir[i + 2];
11103                                 if (has_uuid(uuid, uuid_count, uuids))
11104                                         return true;
11105                         }
11106                         break;
11107                 case EIR_UUID32_ALL:
11108                 case EIR_UUID32_SOME:
11109                         for (i = 0; i + 5 <= field_len; i += 4) {
11110                                 memcpy(uuid, bluetooth_base_uuid, 16);
11111                                 uuid[15] = eir[i + 5];
11112                                 uuid[14] = eir[i + 4];
11113                                 uuid[13] = eir[i + 3];
11114                                 uuid[12] = eir[i + 2];
11115                                 if (has_uuid(uuid, uuid_count, uuids))
11116                                         return true;
11117                         }
11118                         break;
11119                 case EIR_UUID128_ALL:
11120                 case EIR_UUID128_SOME:
11121                         for (i = 0; i + 17 <= field_len; i += 16) {
11122                                 memcpy(uuid, eir + i + 2, 16);
11123                                 if (has_uuid(uuid, uuid_count, uuids))
11124                                         return true;
11125                         }
11126                         break;
11127                 }
11128
11129                 parsed += field_len + 1;
11130                 eir += field_len + 1;
11131         }
11132
11133         return false;
11134 }
11135
11136 static void restart_le_scan(struct hci_dev *hdev)
11137 {
11138         /* If controller is not scanning we are done. */
11139         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
11140                 return;
11141
11142         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
11143                        hdev->discovery.scan_start +
11144                        hdev->discovery.scan_duration))
11145                 return;
11146
11147         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
11148                            DISCOV_LE_RESTART_DELAY);
11149 }
11150
11151 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
11152                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11153 {
11154         /* If a RSSI threshold has been specified, and
11155          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
11156          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
11157          * is set, let it through for further processing, as we might need to
11158          * restart the scan.
11159          *
11160          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
11161          * the results are also dropped.
11162          */
11163         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11164             (rssi == HCI_RSSI_INVALID ||
11165             (rssi < hdev->discovery.rssi &&
11166              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
11167                 return  false;
11168
11169         if (hdev->discovery.uuid_count != 0) {
11170                 /* If a list of UUIDs is provided in filter, results with no
11171                  * matching UUID should be dropped.
11172                  */
11173                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
11174                                    hdev->discovery.uuids) &&
11175                     !eir_has_uuids(scan_rsp, scan_rsp_len,
11176                                    hdev->discovery.uuid_count,
11177                                    hdev->discovery.uuids))
11178                         return false;
11179         }
11180
11181         /* If duplicate filtering does not report RSSI changes, then restart
11182          * scanning to ensure updated result with updated RSSI values.
11183          */
11184         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
11185                 restart_le_scan(hdev);
11186
11187                 /* Validate RSSI value against the RSSI threshold once more. */
11188                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11189                     rssi < hdev->discovery.rssi)
11190                         return false;
11191         }
11192
11193         return true;
11194 }
11195
11196 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11197                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
11198                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11199 {
11200         char buf[512];
11201         struct mgmt_ev_device_found *ev = (void *)buf;
11202         size_t ev_size;
11203
11204         /* Don't send events for a non-kernel initiated discovery. With
11205          * LE one exception is if we have pend_le_reports > 0 in which
11206          * case we're doing passive scanning and want these events.
11207          */
11208         if (!hci_discovery_active(hdev)) {
11209                 if (link_type == ACL_LINK)
11210                         return;
11211                 if (link_type == LE_LINK &&
11212                     list_empty(&hdev->pend_le_reports) &&
11213                     !hci_is_adv_monitoring(hdev)) {
11214                         return;
11215                 }
11216         }
11217
11218         if (hdev->discovery.result_filtering) {
11219                 /* We are using service discovery */
11220                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
11221                                      scan_rsp_len))
11222                         return;
11223         }
11224
11225         if (hdev->discovery.limited) {
11226                 /* Check for limited discoverable bit */
11227                 if (dev_class) {
11228                         if (!(dev_class[1] & 0x20))
11229                                 return;
11230                 } else {
11231                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
11232                         if (!flags || !(flags[0] & LE_AD_LIMITED))
11233                                 return;
11234                 }
11235         }
11236
11237         /* Make sure that the buffer is big enough. The 5 extra bytes
11238          * are for the potential CoD field.
11239          */
11240         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
11241                 return;
11242
11243         memset(buf, 0, sizeof(buf));
11244
11245         /* In case of device discovery with BR/EDR devices (pre 1.2), the
11246          * RSSI value was reported as 0 when not available. This behavior
11247          * is kept when using device discovery. This is required for full
11248          * backwards compatibility with the API.
11249          *
11250          * However when using service discovery, the value 127 will be
11251          * returned when the RSSI is not available.
11252          */
11253         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
11254             link_type == ACL_LINK)
11255                 rssi = 0;
11256
11257         bacpy(&ev->addr.bdaddr, bdaddr);
11258         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11259         ev->rssi = rssi;
11260         ev->flags = cpu_to_le32(flags);
11261
11262         if (eir_len > 0)
11263                 /* Copy EIR or advertising data into event */
11264                 memcpy(ev->eir, eir, eir_len);
11265
11266         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11267                                        NULL))
11268                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11269                                           dev_class, 3);
11270
11271         if (scan_rsp_len > 0)
11272                 /* Append scan response data to event */
11273                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
11274
11275         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11276         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
11277
11278         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
11279 }
11280
11281 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11282                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
11283 {
11284         struct mgmt_ev_device_found *ev;
11285         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
11286         u16 eir_len;
11287
11288         ev = (struct mgmt_ev_device_found *) buf;
11289
11290         memset(buf, 0, sizeof(buf));
11291
11292         bacpy(&ev->addr.bdaddr, bdaddr);
11293         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11294         ev->rssi = rssi;
11295
11296         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
11297                                   name_len);
11298
11299         ev->eir_len = cpu_to_le16(eir_len);
11300
11301         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
11302 }
11303
11304 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
11305 {
11306         struct mgmt_ev_discovering ev;
11307
11308         bt_dev_dbg(hdev, "discovering %u", discovering);
11309
11310         memset(&ev, 0, sizeof(ev));
11311         ev.type = hdev->discovery.type;
11312         ev.discovering = discovering;
11313
11314         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
11315 }
11316
11317 void mgmt_suspending(struct hci_dev *hdev, u8 state)
11318 {
11319         struct mgmt_ev_controller_suspend ev;
11320
11321         ev.suspend_state = state;
11322         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
11323 }
11324
11325 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
11326                    u8 addr_type)
11327 {
11328         struct mgmt_ev_controller_resume ev;
11329
11330         ev.wake_reason = reason;
11331         if (bdaddr) {
11332                 bacpy(&ev.addr.bdaddr, bdaddr);
11333                 ev.addr.type = addr_type;
11334         } else {
11335                 memset(&ev.addr, 0, sizeof(ev.addr));
11336         }
11337
11338         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
11339 }
11340
11341 static struct hci_mgmt_chan chan = {
11342         .channel        = HCI_CHANNEL_CONTROL,
11343         .handler_count  = ARRAY_SIZE(mgmt_handlers),
11344         .handlers       = mgmt_handlers,
11345 #ifdef TIZEN_BT
11346         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
11347         .tizen_handlers = tizen_mgmt_handlers,
11348 #endif
11349         .hdev_init      = mgmt_init_hdev,
11350 };
11351
11352 int mgmt_init(void)
11353 {
11354         return hci_mgmt_chan_register(&chan);
11355 }
11356
11357 void mgmt_exit(void)
11358 {
11359         hci_mgmt_chan_unregister(&chan);
11360 }