net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #include <net/bluetooth/sco.h>
  38 #endif
  39
  40 #include "hci_request.h"
  41 #include "smp.h"
  42 #include "mgmt_util.h"
  43 #include "mgmt_config.h"
  44 #include "msft.h"
  45 #include "eir.h"
  46 #include "aosp.h"
  47
  48 #define MGMT_VERSION    1
  49 #define MGMT_REVISION   22
  50
  51 static const u16 mgmt_commands[] = {
  52         MGMT_OP_READ_INDEX_LIST,
  53         MGMT_OP_READ_INFO,
  54         MGMT_OP_SET_POWERED,
  55         MGMT_OP_SET_DISCOVERABLE,
  56         MGMT_OP_SET_CONNECTABLE,
  57         MGMT_OP_SET_FAST_CONNECTABLE,
  58         MGMT_OP_SET_BONDABLE,
  59         MGMT_OP_SET_LINK_SECURITY,
  60         MGMT_OP_SET_SSP,
  61         MGMT_OP_SET_HS,
  62         MGMT_OP_SET_LE,
  63         MGMT_OP_SET_DEV_CLASS,
  64         MGMT_OP_SET_LOCAL_NAME,
  65         MGMT_OP_ADD_UUID,
  66         MGMT_OP_REMOVE_UUID,
  67         MGMT_OP_LOAD_LINK_KEYS,
  68         MGMT_OP_LOAD_LONG_TERM_KEYS,
  69         MGMT_OP_DISCONNECT,
  70         MGMT_OP_GET_CONNECTIONS,
  71         MGMT_OP_PIN_CODE_REPLY,
  72         MGMT_OP_PIN_CODE_NEG_REPLY,
  73         MGMT_OP_SET_IO_CAPABILITY,
  74         MGMT_OP_PAIR_DEVICE,
  75         MGMT_OP_CANCEL_PAIR_DEVICE,
  76         MGMT_OP_UNPAIR_DEVICE,
  77         MGMT_OP_USER_CONFIRM_REPLY,
  78         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  79         MGMT_OP_USER_PASSKEY_REPLY,
  80         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  81         MGMT_OP_READ_LOCAL_OOB_DATA,
  82         MGMT_OP_ADD_REMOTE_OOB_DATA,
  83         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  84         MGMT_OP_START_DISCOVERY,
  85         MGMT_OP_STOP_DISCOVERY,
  86         MGMT_OP_CONFIRM_NAME,
  87         MGMT_OP_BLOCK_DEVICE,
  88         MGMT_OP_UNBLOCK_DEVICE,
  89         MGMT_OP_SET_DEVICE_ID,
  90         MGMT_OP_SET_ADVERTISING,
  91         MGMT_OP_SET_BREDR,
  92         MGMT_OP_SET_STATIC_ADDRESS,
  93         MGMT_OP_SET_SCAN_PARAMS,
  94         MGMT_OP_SET_SECURE_CONN,
  95         MGMT_OP_SET_DEBUG_KEYS,
  96         MGMT_OP_SET_PRIVACY,
  97         MGMT_OP_LOAD_IRKS,
  98         MGMT_OP_GET_CONN_INFO,
  99         MGMT_OP_GET_CLOCK_INFO,
 100         MGMT_OP_ADD_DEVICE,
 101         MGMT_OP_REMOVE_DEVICE,
 102         MGMT_OP_LOAD_CONN_PARAM,
 103         MGMT_OP_READ_UNCONF_INDEX_LIST,
 104         MGMT_OP_READ_CONFIG_INFO,
 105         MGMT_OP_SET_EXTERNAL_CONFIG,
 106         MGMT_OP_SET_PUBLIC_ADDRESS,
 107         MGMT_OP_START_SERVICE_DISCOVERY,
 108         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 109         MGMT_OP_READ_EXT_INDEX_LIST,
 110         MGMT_OP_READ_ADV_FEATURES,
 111         MGMT_OP_ADD_ADVERTISING,
 112         MGMT_OP_REMOVE_ADVERTISING,
 113         MGMT_OP_GET_ADV_SIZE_INFO,
 114         MGMT_OP_START_LIMITED_DISCOVERY,
 115         MGMT_OP_READ_EXT_INFO,
 116         MGMT_OP_SET_APPEARANCE,
 117         MGMT_OP_GET_PHY_CONFIGURATION,
 118         MGMT_OP_SET_PHY_CONFIGURATION,
 119         MGMT_OP_SET_BLOCKED_KEYS,
 120         MGMT_OP_SET_WIDEBAND_SPEECH,
 121         MGMT_OP_READ_CONTROLLER_CAP,
 122         MGMT_OP_READ_EXP_FEATURES_INFO,
 123         MGMT_OP_SET_EXP_FEATURE,
 124         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 125         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 126         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 127         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 128         MGMT_OP_GET_DEVICE_FLAGS,
 129         MGMT_OP_SET_DEVICE_FLAGS,
 130         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 131         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 132         MGMT_OP_REMOVE_ADV_MONITOR,
 133         MGMT_OP_ADD_EXT_ADV_PARAMS,
 134         MGMT_OP_ADD_EXT_ADV_DATA,
 135         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 136         MGMT_OP_SET_MESH_RECEIVER,
 137         MGMT_OP_MESH_READ_FEATURES,
 138         MGMT_OP_MESH_SEND,
 139         MGMT_OP_MESH_SEND_CANCEL,
 140 };
 141
 142 static const u16 mgmt_events[] = {
 143         MGMT_EV_CONTROLLER_ERROR,
 144         MGMT_EV_INDEX_ADDED,
 145         MGMT_EV_INDEX_REMOVED,
 146         MGMT_EV_NEW_SETTINGS,
 147         MGMT_EV_CLASS_OF_DEV_CHANGED,
 148         MGMT_EV_LOCAL_NAME_CHANGED,
 149         MGMT_EV_NEW_LINK_KEY,
 150         MGMT_EV_NEW_LONG_TERM_KEY,
 151         MGMT_EV_DEVICE_CONNECTED,
 152         MGMT_EV_DEVICE_DISCONNECTED,
 153         MGMT_EV_CONNECT_FAILED,
 154         MGMT_EV_PIN_CODE_REQUEST,
 155         MGMT_EV_USER_CONFIRM_REQUEST,
 156         MGMT_EV_USER_PASSKEY_REQUEST,
 157         MGMT_EV_AUTH_FAILED,
 158         MGMT_EV_DEVICE_FOUND,
 159         MGMT_EV_DISCOVERING,
 160         MGMT_EV_DEVICE_BLOCKED,
 161         MGMT_EV_DEVICE_UNBLOCKED,
 162         MGMT_EV_DEVICE_UNPAIRED,
 163         MGMT_EV_PASSKEY_NOTIFY,
 164         MGMT_EV_NEW_IRK,
 165         MGMT_EV_NEW_CSRK,
 166         MGMT_EV_DEVICE_ADDED,
 167         MGMT_EV_DEVICE_REMOVED,
 168         MGMT_EV_NEW_CONN_PARAM,
 169         MGMT_EV_UNCONF_INDEX_ADDED,
 170         MGMT_EV_UNCONF_INDEX_REMOVED,
 171         MGMT_EV_NEW_CONFIG_OPTIONS,
 172         MGMT_EV_EXT_INDEX_ADDED,
 173         MGMT_EV_EXT_INDEX_REMOVED,
 174         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 175         MGMT_EV_ADVERTISING_ADDED,
 176         MGMT_EV_ADVERTISING_REMOVED,
 177         MGMT_EV_EXT_INFO_CHANGED,
 178         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 179         MGMT_EV_EXP_FEATURE_CHANGED,
 180         MGMT_EV_DEVICE_FLAGS_CHANGED,
 181         MGMT_EV_ADV_MONITOR_ADDED,
 182         MGMT_EV_ADV_MONITOR_REMOVED,
 183         MGMT_EV_CONTROLLER_SUSPEND,
 184         MGMT_EV_CONTROLLER_RESUME,
 185         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 186         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 187 };
 188
 189 static const u16 mgmt_untrusted_commands[] = {
 190         MGMT_OP_READ_INDEX_LIST,
 191         MGMT_OP_READ_INFO,
 192         MGMT_OP_READ_UNCONF_INDEX_LIST,
 193         MGMT_OP_READ_CONFIG_INFO,
 194         MGMT_OP_READ_EXT_INDEX_LIST,
 195         MGMT_OP_READ_EXT_INFO,
 196         MGMT_OP_READ_CONTROLLER_CAP,
 197         MGMT_OP_READ_EXP_FEATURES_INFO,
 198         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 199         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 200 };
 201
 202 static const u16 mgmt_untrusted_events[] = {
 203         MGMT_EV_INDEX_ADDED,
 204         MGMT_EV_INDEX_REMOVED,
 205         MGMT_EV_NEW_SETTINGS,
 206         MGMT_EV_CLASS_OF_DEV_CHANGED,
 207         MGMT_EV_LOCAL_NAME_CHANGED,
 208         MGMT_EV_UNCONF_INDEX_ADDED,
 209         MGMT_EV_UNCONF_INDEX_REMOVED,
 210         MGMT_EV_NEW_CONFIG_OPTIONS,
 211         MGMT_EV_EXT_INDEX_ADDED,
 212         MGMT_EV_EXT_INDEX_REMOVED,
 213         MGMT_EV_EXT_INFO_CHANGED,
 214         MGMT_EV_EXP_FEATURE_CHANGED,
 215 };
 216
 217 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 218
 219 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 220                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 221
 222 /* HCI to MGMT error code conversion table */
 223 static const u8 mgmt_status_table[] = {
 224         MGMT_STATUS_SUCCESS,
 225         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 226         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 227         MGMT_STATUS_FAILED,             /* Hardware Failure */
 228         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 229         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 230         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 231         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 232         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 233         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 234         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 235         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 236         MGMT_STATUS_BUSY,               /* Command Disallowed */
 237         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 238         MGMT_STATUS_REJECTED,           /* Rejected Security */
 239         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 240         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 241         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 242         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 243         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 244         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 245         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 246         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 247         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 248         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 249         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 250         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 251         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 252         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 253         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 254         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 255         MGMT_STATUS_FAILED,             /* Unspecified Error */
 256         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 257         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 258         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 259         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 260         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 261         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 262         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 263         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 264         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 265         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 266         MGMT_STATUS_FAILED,             /* Transaction Collision */
 267         MGMT_STATUS_FAILED,             /* Reserved for future use */
 268         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 269         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 270         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 271         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 272         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 273         MGMT_STATUS_FAILED,             /* Reserved for future use */
 274         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 275         MGMT_STATUS_FAILED,             /* Reserved for future use */
 276         MGMT_STATUS_FAILED,             /* Slot Violation */
 277         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 278         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 279         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 280         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 281         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 282         MGMT_STATUS_BUSY,               /* Controller Busy */
 283         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 284         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 285         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 286         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 287         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 288 };
 289
 290 static u8 mgmt_errno_status(int err)
 291 {
 292         switch (err) {
 293         case 0:
 294                 return MGMT_STATUS_SUCCESS;
 295         case -EPERM:
 296                 return MGMT_STATUS_REJECTED;
 297         case -EINVAL:
 298                 return MGMT_STATUS_INVALID_PARAMS;
 299         case -EOPNOTSUPP:
 300                 return MGMT_STATUS_NOT_SUPPORTED;
 301         case -EBUSY:
 302                 return MGMT_STATUS_BUSY;
 303         case -ETIMEDOUT:
 304                 return MGMT_STATUS_AUTH_FAILED;
 305         case -ENOMEM:
 306                 return MGMT_STATUS_NO_RESOURCES;
 307         case -EISCONN:
 308                 return MGMT_STATUS_ALREADY_CONNECTED;
 309         case -ENOTCONN:
 310                 return MGMT_STATUS_DISCONNECTED;
 311         }
 312
 313         return MGMT_STATUS_FAILED;
 314 }
 315
 316 static u8 mgmt_status(int err)
 317 {
 318         if (err < 0)
 319                 return mgmt_errno_status(err);
 320
 321         if (err < ARRAY_SIZE(mgmt_status_table))
 322                 return mgmt_status_table[err];
 323
 324         return MGMT_STATUS_FAILED;
 325 }
 326
 327 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 328                             u16 len, int flag)
 329 {
 330         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 331                                flag, NULL);
 332 }
 333
 334 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 335                               u16 len, int flag, struct sock *skip_sk)
 336 {
 337         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 338                                flag, skip_sk);
 339 }
 340
 341 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 342                       struct sock *skip_sk)
 343 {
 344         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 345                                HCI_SOCK_TRUSTED, skip_sk);
 346 }
 347
 348 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 349 {
 350         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 351                                    skip_sk);
 352 }
 353
 354 static u8 le_addr_type(u8 mgmt_addr_type)
 355 {
 356         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 357                 return ADDR_LE_DEV_PUBLIC;
 358         else
 359                 return ADDR_LE_DEV_RANDOM;
 360 }
 361
 362 void mgmt_fill_version_info(void *ver)
 363 {
 364         struct mgmt_rp_read_version *rp = ver;
 365
 366         rp->version = MGMT_VERSION;
 367         rp->revision = cpu_to_le16(MGMT_REVISION);
 368 }
 369
 370 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 371                         u16 data_len)
 372 {
 373         struct mgmt_rp_read_version rp;
 374
 375         bt_dev_dbg(hdev, "sock %p", sk);
 376
 377         mgmt_fill_version_info(&rp);
 378
 379         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 380                                  &rp, sizeof(rp));
 381 }
 382
 383 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 384                          u16 data_len)
 385 {
 386         struct mgmt_rp_read_commands *rp;
 387         u16 num_commands, num_events;
 388         size_t rp_size;
 389         int i, err;
 390
 391         bt_dev_dbg(hdev, "sock %p", sk);
 392
 393         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 394                 num_commands = ARRAY_SIZE(mgmt_commands);
 395                 num_events = ARRAY_SIZE(mgmt_events);
 396         } else {
 397                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 398                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 399         }
 400
 401         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 402
 403         rp = kmalloc(rp_size, GFP_KERNEL);
 404         if (!rp)
 405                 return -ENOMEM;
 406
 407         rp->num_commands = cpu_to_le16(num_commands);
 408         rp->num_events = cpu_to_le16(num_events);
 409
 410         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 411                 __le16 *opcode = rp->opcodes;
 412
 413                 for (i = 0; i < num_commands; i++, opcode++)
 414                         put_unaligned_le16(mgmt_commands[i], opcode);
 415
 416                 for (i = 0; i < num_events; i++, opcode++)
 417                         put_unaligned_le16(mgmt_events[i], opcode);
 418         } else {
 419                 __le16 *opcode = rp->opcodes;
 420
 421                 for (i = 0; i < num_commands; i++, opcode++)
 422                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 423
 424                 for (i = 0; i < num_events; i++, opcode++)
 425                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 426         }
 427
 428         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 429                                 rp, rp_size);
 430         kfree(rp);
 431
 432         return err;
 433 }
 434
 435 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 436                            u16 data_len)
 437 {
 438         struct mgmt_rp_read_index_list *rp;
 439         struct hci_dev *d;
 440         size_t rp_len;
 441         u16 count;
 442         int err;
 443
 444         bt_dev_dbg(hdev, "sock %p", sk);
 445
 446         read_lock(&hci_dev_list_lock);
 447
 448         count = 0;
 449         list_for_each_entry(d, &hci_dev_list, list) {
 450                 if (d->dev_type == HCI_PRIMARY &&
 451                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 452                         count++;
 453         }
 454
 455         rp_len = sizeof(*rp) + (2 * count);
 456         rp = kmalloc(rp_len, GFP_ATOMIC);
 457         if (!rp) {
 458                 read_unlock(&hci_dev_list_lock);
 459                 return -ENOMEM;
 460         }
 461
 462         count = 0;
 463         list_for_each_entry(d, &hci_dev_list, list) {
 464                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 465                     hci_dev_test_flag(d, HCI_CONFIG) ||
 466                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 467                         continue;
 468
 469                 /* Devices marked as raw-only are neither configured
 470                  * nor unconfigured controllers.
 471                  */
 472                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 473                         continue;
 474
 475                 if (d->dev_type == HCI_PRIMARY &&
 476                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 477                         rp->index[count++] = cpu_to_le16(d->id);
 478                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 479                 }
 480         }
 481
 482         rp->num_controllers = cpu_to_le16(count);
 483         rp_len = sizeof(*rp) + (2 * count);
 484
 485         read_unlock(&hci_dev_list_lock);
 486
 487         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 488                                 0, rp, rp_len);
 489
 490         kfree(rp);
 491
 492         return err;
 493 }
 494
 495 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 496                                   void *data, u16 data_len)
 497 {
 498         struct mgmt_rp_read_unconf_index_list *rp;
 499         struct hci_dev *d;
 500         size_t rp_len;
 501         u16 count;
 502         int err;
 503
 504         bt_dev_dbg(hdev, "sock %p", sk);
 505
 506         read_lock(&hci_dev_list_lock);
 507
 508         count = 0;
 509         list_for_each_entry(d, &hci_dev_list, list) {
 510                 if (d->dev_type == HCI_PRIMARY &&
 511                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 512                         count++;
 513         }
 514
 515         rp_len = sizeof(*rp) + (2 * count);
 516         rp = kmalloc(rp_len, GFP_ATOMIC);
 517         if (!rp) {
 518                 read_unlock(&hci_dev_list_lock);
 519                 return -ENOMEM;
 520         }
 521
 522         count = 0;
 523         list_for_each_entry(d, &hci_dev_list, list) {
 524                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 525                     hci_dev_test_flag(d, HCI_CONFIG) ||
 526                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 527                         continue;
 528
 529                 /* Devices marked as raw-only are neither configured
 530                  * nor unconfigured controllers.
 531                  */
 532                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 533                         continue;
 534
 535                 if (d->dev_type == HCI_PRIMARY &&
 536                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 537                         rp->index[count++] = cpu_to_le16(d->id);
 538                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 539                 }
 540         }
 541
 542         rp->num_controllers = cpu_to_le16(count);
 543         rp_len = sizeof(*rp) + (2 * count);
 544
 545         read_unlock(&hci_dev_list_lock);
 546
 547         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 548                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 549
 550         kfree(rp);
 551
 552         return err;
 553 }
 554
 555 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 556                                void *data, u16 data_len)
 557 {
 558         struct mgmt_rp_read_ext_index_list *rp;
 559         struct hci_dev *d;
 560         u16 count;
 561         int err;
 562
 563         bt_dev_dbg(hdev, "sock %p", sk);
 564
 565         read_lock(&hci_dev_list_lock);
 566
 567         count = 0;
 568         list_for_each_entry(d, &hci_dev_list, list) {
 569                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 570                         count++;
 571         }
 572
 573         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 574         if (!rp) {
 575                 read_unlock(&hci_dev_list_lock);
 576                 return -ENOMEM;
 577         }
 578
 579         count = 0;
 580         list_for_each_entry(d, &hci_dev_list, list) {
 581                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 582                     hci_dev_test_flag(d, HCI_CONFIG) ||
 583                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 584                         continue;
 585
 586                 /* Devices marked as raw-only are neither configured
 587                  * nor unconfigured controllers.
 588                  */
 589                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 590                         continue;
 591
 592                 if (d->dev_type == HCI_PRIMARY) {
 593                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 594                                 rp->entry[count].type = 0x01;
 595                         else
 596                                 rp->entry[count].type = 0x00;
 597                 } else if (d->dev_type == HCI_AMP) {
 598                         rp->entry[count].type = 0x02;
 599                 } else {
 600                         continue;
 601                 }
 602
 603                 rp->entry[count].bus = d->bus;
 604                 rp->entry[count++].index = cpu_to_le16(d->id);
 605                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 606         }
 607
 608         rp->num_controllers = cpu_to_le16(count);
 609
 610         read_unlock(&hci_dev_list_lock);
 611
 612         /* If this command is called at least once, then all the
 613          * default index and unconfigured index events are disabled
 614          * and from now on only extended index events are used.
 615          */
 616         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 617         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 618         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 619
 620         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 621                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 622                                 struct_size(rp, entry, count));
 623
 624         kfree(rp);
 625
 626         return err;
 627 }
 628
 629 static bool is_configured(struct hci_dev *hdev)
 630 {
 631         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 632             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 633                 return false;
 634
 635         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 636              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 637             !bacmp(&hdev->public_addr, BDADDR_ANY))
 638                 return false;
 639
 640         return true;
 641 }
 642
 643 static __le32 get_missing_options(struct hci_dev *hdev)
 644 {
 645         u32 options = 0;
 646
 647         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 648             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 649                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 650
 651         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 652              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 653             !bacmp(&hdev->public_addr, BDADDR_ANY))
 654                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 655
 656         return cpu_to_le32(options);
 657 }
 658
 659 static int new_options(struct hci_dev *hdev, struct sock *skip)
 660 {
 661         __le32 options = get_missing_options(hdev);
 662
 663         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 664                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 665 }
 666
 667 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 668 {
 669         __le32 options = get_missing_options(hdev);
 670
 671         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 672                                  sizeof(options));
 673 }
 674
 675 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 676                             void *data, u16 data_len)
 677 {
 678         struct mgmt_rp_read_config_info rp;
 679         u32 options = 0;
 680
 681         bt_dev_dbg(hdev, "sock %p", sk);
 682
 683         hci_dev_lock(hdev);
 684
 685         memset(&rp, 0, sizeof(rp));
 686         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 687
 688         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 689                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 690
 691         if (hdev->set_bdaddr)
 692                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 693
 694         rp.supported_options = cpu_to_le32(options);
 695         rp.missing_options = get_missing_options(hdev);
 696
 697         hci_dev_unlock(hdev);
 698
 699         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 700                                  &rp, sizeof(rp));
 701 }
 702
 703 static u32 get_supported_phys(struct hci_dev *hdev)
 704 {
 705         u32 supported_phys = 0;
 706
 707         if (lmp_bredr_capable(hdev)) {
 708                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 709
 710                 if (hdev->features[0][0] & LMP_3SLOT)
 711                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 712
 713                 if (hdev->features[0][0] & LMP_5SLOT)
 714                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 715
 716                 if (lmp_edr_2m_capable(hdev)) {
 717                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 718
 719                         if (lmp_edr_3slot_capable(hdev))
 720                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 721
 722                         if (lmp_edr_5slot_capable(hdev))
 723                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 724
 725                         if (lmp_edr_3m_capable(hdev)) {
 726                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 727
 728                                 if (lmp_edr_3slot_capable(hdev))
 729                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 730
 731                                 if (lmp_edr_5slot_capable(hdev))
 732                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 733                         }
 734                 }
 735         }
 736
 737         if (lmp_le_capable(hdev)) {
 738                 supported_phys |= MGMT_PHY_LE_1M_TX;
 739                 supported_phys |= MGMT_PHY_LE_1M_RX;
 740
 741                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 742                         supported_phys |= MGMT_PHY_LE_2M_TX;
 743                         supported_phys |= MGMT_PHY_LE_2M_RX;
 744                 }
 745
 746                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 747                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 748                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 749                 }
 750         }
 751
 752         return supported_phys;
 753 }
 754
 755 static u32 get_selected_phys(struct hci_dev *hdev)
 756 {
 757         u32 selected_phys = 0;
 758
 759         if (lmp_bredr_capable(hdev)) {
 760                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 761
 762                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 763                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 764
 765                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 766                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 767
 768                 if (lmp_edr_2m_capable(hdev)) {
 769                         if (!(hdev->pkt_type & HCI_2DH1))
 770                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 771
 772                         if (lmp_edr_3slot_capable(hdev) &&
 773                             !(hdev->pkt_type & HCI_2DH3))
 774                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 775
 776                         if (lmp_edr_5slot_capable(hdev) &&
 777                             !(hdev->pkt_type & HCI_2DH5))
 778                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 779
 780                         if (lmp_edr_3m_capable(hdev)) {
 781                                 if (!(hdev->pkt_type & HCI_3DH1))
 782                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 783
 784                                 if (lmp_edr_3slot_capable(hdev) &&
 785                                     !(hdev->pkt_type & HCI_3DH3))
 786                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 787
 788                                 if (lmp_edr_5slot_capable(hdev) &&
 789                                     !(hdev->pkt_type & HCI_3DH5))
 790                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 791                         }
 792                 }
 793         }
 794
 795         if (lmp_le_capable(hdev)) {
 796                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 797                         selected_phys |= MGMT_PHY_LE_1M_TX;
 798
 799                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 800                         selected_phys |= MGMT_PHY_LE_1M_RX;
 801
 802                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 803                         selected_phys |= MGMT_PHY_LE_2M_TX;
 804
 805                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 806                         selected_phys |= MGMT_PHY_LE_2M_RX;
 807
 808                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 809                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 810
 811                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 812                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 813         }
 814
 815         return selected_phys;
 816 }
 817
 818 static u32 get_configurable_phys(struct hci_dev *hdev)
 819 {
 820         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 821                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 822 }
 823
 824 static u32 get_supported_settings(struct hci_dev *hdev)
 825 {
 826         u32 settings = 0;
 827
 828         settings |= MGMT_SETTING_POWERED;
 829         settings |= MGMT_SETTING_BONDABLE;
 830         settings |= MGMT_SETTING_DEBUG_KEYS;
 831         settings |= MGMT_SETTING_CONNECTABLE;
 832         settings |= MGMT_SETTING_DISCOVERABLE;
 833
 834         if (lmp_bredr_capable(hdev)) {
 835                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 836                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 837                 settings |= MGMT_SETTING_BREDR;
 838                 settings |= MGMT_SETTING_LINK_SECURITY;
 839
 840                 if (lmp_ssp_capable(hdev)) {
 841                         settings |= MGMT_SETTING_SSP;
 842                         if (IS_ENABLED(CONFIG_BT_HS))
 843                                 settings |= MGMT_SETTING_HS;
 844                 }
 845
 846                 if (lmp_sc_capable(hdev))
 847                         settings |= MGMT_SETTING_SECURE_CONN;
 848
 849                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 850                              &hdev->quirks))
 851                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 852         }
 853
 854         if (lmp_le_capable(hdev)) {
 855                 settings |= MGMT_SETTING_LE;
 856                 settings |= MGMT_SETTING_SECURE_CONN;
 857                 settings |= MGMT_SETTING_PRIVACY;
 858                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 859                 settings |= MGMT_SETTING_ADVERTISING;
 860         }
 861
 862         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 863             hdev->set_bdaddr)
 864                 settings |= MGMT_SETTING_CONFIGURATION;
 865
 866         if (cis_central_capable(hdev))
 867                 settings |= MGMT_SETTING_CIS_CENTRAL;
 868
 869         if (cis_peripheral_capable(hdev))
 870                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 871
 872         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 873
 874         return settings;
 875 }
 876
 877 static u32 get_current_settings(struct hci_dev *hdev)
 878 {
 879         u32 settings = 0;
 880
 881         if (hdev_is_powered(hdev))
 882                 settings |= MGMT_SETTING_POWERED;
 883
 884         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 885                 settings |= MGMT_SETTING_CONNECTABLE;
 886
 887         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 888                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 889
 890         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 891                 settings |= MGMT_SETTING_DISCOVERABLE;
 892
 893         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 894                 settings |= MGMT_SETTING_BONDABLE;
 895
 896         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 897                 settings |= MGMT_SETTING_BREDR;
 898
 899         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 900                 settings |= MGMT_SETTING_LE;
 901
 902         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 903                 settings |= MGMT_SETTING_LINK_SECURITY;
 904
 905         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 906                 settings |= MGMT_SETTING_SSP;
 907
 908         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 909                 settings |= MGMT_SETTING_HS;
 910
 911         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 912                 settings |= MGMT_SETTING_ADVERTISING;
 913
 914         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 915                 settings |= MGMT_SETTING_SECURE_CONN;
 916
 917         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 918                 settings |= MGMT_SETTING_DEBUG_KEYS;
 919
 920         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 921                 settings |= MGMT_SETTING_PRIVACY;
 922
 923         /* The current setting for static address has two purposes. The
 924          * first is to indicate if the static address will be used and
 925          * the second is to indicate if it is actually set.
 926          *
 927          * This means if the static address is not configured, this flag
 928          * will never be set. If the address is configured, then if the
 929          * address is actually used decides if the flag is set or not.
 930          *
 931          * For single mode LE only controllers and dual-mode controllers
 932          * with BR/EDR disabled, the existence of the static address will
 933          * be evaluated.
 934          */
 935         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 936             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 937             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 938                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 939                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 940         }
 941
 942         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 943                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 944
 945         if (cis_central_capable(hdev))
 946                 settings |= MGMT_SETTING_CIS_CENTRAL;
 947
 948         if (cis_peripheral_capable(hdev))
 949                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 950
 951         return settings;
 952 }
 953
 954 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 955 {
 956         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 957 }
 958
 959 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 960 {
 961         struct mgmt_pending_cmd *cmd;
 962
 963         /* If there's a pending mgmt command the flags will not yet have
 964          * their final values, so check for this first.
 965          */
 966         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 967         if (cmd) {
 968                 struct mgmt_mode *cp = cmd->param;
 969                 if (cp->val == 0x01)
 970                         return LE_AD_GENERAL;
 971                 else if (cp->val == 0x02)
 972                         return LE_AD_LIMITED;
 973         } else {
 974                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 975                         return LE_AD_LIMITED;
 976                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 977                         return LE_AD_GENERAL;
 978         }
 979
 980         return 0;
 981 }
 982
 983 bool mgmt_get_connectable(struct hci_dev *hdev)
 984 {
 985         struct mgmt_pending_cmd *cmd;
 986
 987         /* If there's a pending mgmt command the flag will not yet have
 988          * it's final value, so check for this first.
 989          */
 990         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 991         if (cmd) {
 992                 struct mgmt_mode *cp = cmd->param;
 993
 994                 return cp->val;
 995         }
 996
 997         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 998 }
 999
1000 static int service_cache_sync(struct hci_dev *hdev, void *data)
1001 {
1002         hci_update_eir_sync(hdev);
1003         hci_update_class_sync(hdev);
1004
1005         return 0;
1006 }
1007
1008 static void service_cache_off(struct work_struct *work)
1009 {
1010         struct hci_dev *hdev = container_of(work, struct hci_dev,
1011                                             service_cache.work);
1012
1013         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1014                 return;
1015
1016         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1017 }
1018
1019 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1020 {
1021         /* The generation of a new RPA and programming it into the
1022          * controller happens in the hci_req_enable_advertising()
1023          * function.
1024          */
1025         if (ext_adv_capable(hdev))
1026                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1027         else
1028                 return hci_enable_advertising_sync(hdev);
1029 }
1030
1031 static void rpa_expired(struct work_struct *work)
1032 {
1033         struct hci_dev *hdev = container_of(work, struct hci_dev,
1034                                             rpa_expired.work);
1035
1036         bt_dev_dbg(hdev, "");
1037
1038         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1039
1040         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1041                 return;
1042
1043         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1044 }
1045
1046 static void discov_off(struct work_struct *work)
1047 {
1048         struct hci_dev *hdev = container_of(work, struct hci_dev,
1049                                             discov_off.work);
1050
1051         bt_dev_dbg(hdev, "");
1052
1053         hci_dev_lock(hdev);
1054
1055         /* When discoverable timeout triggers, then just make sure
1056          * the limited discoverable flag is cleared. Even in the case
1057          * of a timeout triggered from general discoverable, it is
1058          * safe to unconditionally clear the flag.
1059          */
1060         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1061         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1062         hdev->discov_timeout = 0;
1063
1064         hci_update_discoverable(hdev);
1065
1066         mgmt_new_settings(hdev);
1067
1068         hci_dev_unlock(hdev);
1069 }
1070
1071 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1072
1073 static void mesh_send_complete(struct hci_dev *hdev,
1074                                struct mgmt_mesh_tx *mesh_tx, bool silent)
1075 {
1076         u8 handle = mesh_tx->handle;
1077
1078         if (!silent)
1079                 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1080                            sizeof(handle), NULL);
1081
1082         mgmt_mesh_remove(mesh_tx);
1083 }
1084
1085 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1086 {
1087         struct mgmt_mesh_tx *mesh_tx;
1088
1089         hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1090         hci_disable_advertising_sync(hdev);
1091         mesh_tx = mgmt_mesh_next(hdev, NULL);
1092
1093         if (mesh_tx)
1094                 mesh_send_complete(hdev, mesh_tx, false);
1095
1096         return 0;
1097 }
1098
1099 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1100 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1101 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1102 {
1103         struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1104
1105         if (!mesh_tx)
1106                 return;
1107
1108         err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1109                                  mesh_send_start_complete);
1110
1111         if (err < 0)
1112                 mesh_send_complete(hdev, mesh_tx, false);
1113         else
1114                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1115 }
1116
1117 static void mesh_send_done(struct work_struct *work)
1118 {
1119         struct hci_dev *hdev = container_of(work, struct hci_dev,
1120                                             mesh_send_done.work);
1121
1122         if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1123                 return;
1124
1125         hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1126 }
1127
1128 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1129 {
1130         if (hci_dev_test_flag(hdev, HCI_MGMT))
1131                 return;
1132
1133         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1134
1135         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1136         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1137         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1138         INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1139
1140         /* Non-mgmt controlled devices get this bit set
1141          * implicitly so that pairing works for them, however
1142          * for mgmt we require user-space to explicitly enable
1143          * it
1144          */
1145         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1146
1147         hci_dev_set_flag(hdev, HCI_MGMT);
1148 }
1149
1150 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1151                                 void *data, u16 data_len)
1152 {
1153         struct mgmt_rp_read_info rp;
1154
1155         bt_dev_dbg(hdev, "sock %p", sk);
1156
1157         hci_dev_lock(hdev);
1158
1159         memset(&rp, 0, sizeof(rp));
1160
1161         bacpy(&rp.bdaddr, &hdev->bdaddr);
1162
1163         rp.version = hdev->hci_ver;
1164         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1165
1166         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1167         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1168
1169         memcpy(rp.dev_class, hdev->dev_class, 3);
1170
1171         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1172         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1173
1174         hci_dev_unlock(hdev);
1175
1176         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1177                                  sizeof(rp));
1178 }
1179
1180 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1181 {
1182         u16 eir_len = 0;
1183         size_t name_len;
1184
1185         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1186                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1187                                           hdev->dev_class, 3);
1188
1189         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1190                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1191                                           hdev->appearance);
1192
1193         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1194         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1195                                   hdev->dev_name, name_len);
1196
1197         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1198         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1199                                   hdev->short_name, name_len);
1200
1201         return eir_len;
1202 }
1203
1204 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1205                                     void *data, u16 data_len)
1206 {
1207         char buf[512];
1208         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1209         u16 eir_len;
1210
1211         bt_dev_dbg(hdev, "sock %p", sk);
1212
1213         memset(&buf, 0, sizeof(buf));
1214
1215         hci_dev_lock(hdev);
1216
1217         bacpy(&rp->bdaddr, &hdev->bdaddr);
1218
1219         rp->version = hdev->hci_ver;
1220         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1221
1222         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1223         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1224
1225
1226         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1227         rp->eir_len = cpu_to_le16(eir_len);
1228
1229         hci_dev_unlock(hdev);
1230
1231         /* If this command is called at least once, then the events
1232          * for class of device and local name changes are disabled
1233          * and only the new extended controller information event
1234          * is used.
1235          */
1236         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1237         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1238         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1239
1240         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1241                                  sizeof(*rp) + eir_len);
1242 }
1243
1244 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1245 {
1246         char buf[512];
1247         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1248         u16 eir_len;
1249
1250         memset(buf, 0, sizeof(buf));
1251
1252         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1253         ev->eir_len = cpu_to_le16(eir_len);
1254
1255         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1256                                   sizeof(*ev) + eir_len,
1257                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1258 }
1259
1260 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1261 {
1262         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1263
1264         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1265                                  sizeof(settings));
1266 }
1267
1268 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1269 {
1270         struct mgmt_ev_advertising_added ev;
1271
1272         ev.instance = instance;
1273
1274         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1275 }
1276
1277 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1278                               u8 instance)
1279 {
1280         struct mgmt_ev_advertising_removed ev;
1281
1282         ev.instance = instance;
1283
1284         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1285 }
1286
1287 static void cancel_adv_timeout(struct hci_dev *hdev)
1288 {
1289         if (hdev->adv_instance_timeout) {
1290                 hdev->adv_instance_timeout = 0;
1291                 cancel_delayed_work(&hdev->adv_instance_expire);
1292         }
1293 }
1294
1295 /* This function requires the caller holds hdev->lock */
1296 static void restart_le_actions(struct hci_dev *hdev)
1297 {
1298         struct hci_conn_params *p;
1299
1300         list_for_each_entry(p, &hdev->le_conn_params, list) {
1301                 /* Needed for AUTO_OFF case where might not "really"
1302                  * have been powered off.
1303                  */
1304                 list_del_init(&p->action);
1305
1306                 switch (p->auto_connect) {
1307                 case HCI_AUTO_CONN_DIRECT:
1308                 case HCI_AUTO_CONN_ALWAYS:
1309                         list_add(&p->action, &hdev->pend_le_conns);
1310                         break;
1311                 case HCI_AUTO_CONN_REPORT:
1312                         list_add(&p->action, &hdev->pend_le_reports);
1313                         break;
1314                 default:
1315                         break;
1316                 }
1317         }
1318 }
1319
1320 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1321 {
1322         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1323
1324         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1325                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1326 }
1327
1328 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1329 {
1330         struct mgmt_pending_cmd *cmd = data;
1331         struct mgmt_mode *cp;
1332
1333         /* Make sure cmd still outstanding. */
1334         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1335                 return;
1336
1337         cp = cmd->param;
1338
1339         bt_dev_dbg(hdev, "err %d", err);
1340
1341         if (!err) {
1342                 if (cp->val) {
1343                         hci_dev_lock(hdev);
1344                         restart_le_actions(hdev);
1345                         hci_update_passive_scan(hdev);
1346                         hci_dev_unlock(hdev);
1347                 }
1348
1349                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1350
1351                 /* Only call new_setting for power on as power off is deferred
1352                  * to hdev->power_off work which does call hci_dev_do_close.
1353                  */
1354                 if (cp->val)
1355                         new_settings(hdev, cmd->sk);
1356         } else {
1357                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1358                                 mgmt_status(err));
1359         }
1360
1361         mgmt_pending_remove(cmd);
1362 }
1363
1364 static int set_powered_sync(struct hci_dev *hdev, void *data)
1365 {
1366         struct mgmt_pending_cmd *cmd = data;
1367         struct mgmt_mode *cp = cmd->param;
1368
1369         BT_DBG("%s", hdev->name);
1370
1371         return hci_set_powered_sync(hdev, cp->val);
1372 }
1373
1374 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1375                        u16 len)
1376 {
1377         struct mgmt_mode *cp = data;
1378         struct mgmt_pending_cmd *cmd;
1379         int err;
1380
1381         bt_dev_dbg(hdev, "sock %p", sk);
1382
1383         if (cp->val != 0x00 && cp->val != 0x01)
1384                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1385                                        MGMT_STATUS_INVALID_PARAMS);
1386
1387         hci_dev_lock(hdev);
1388
1389         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1390                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1391                                       MGMT_STATUS_BUSY);
1392                 goto failed;
1393         }
1394
1395         if (!!cp->val == hdev_is_powered(hdev)) {
1396                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1397                 goto failed;
1398         }
1399
1400         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1401         if (!cmd) {
1402                 err = -ENOMEM;
1403                 goto failed;
1404         }
1405
1406         err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1407                                  mgmt_set_powered_complete);
1408
1409         if (err < 0)
1410                 mgmt_pending_remove(cmd);
1411
1412 failed:
1413         hci_dev_unlock(hdev);
1414         return err;
1415 }
1416
1417 int mgmt_new_settings(struct hci_dev *hdev)
1418 {
1419         return new_settings(hdev, NULL);
1420 }
1421
1422 struct cmd_lookup {
1423         struct sock *sk;
1424         struct hci_dev *hdev;
1425         u8 mgmt_status;
1426 };
1427
1428 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1429 {
1430         struct cmd_lookup *match = data;
1431
1432         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1433
1434         list_del(&cmd->list);
1435
1436         if (match->sk == NULL) {
1437                 match->sk = cmd->sk;
1438                 sock_hold(match->sk);
1439         }
1440
1441         mgmt_pending_free(cmd);
1442 }
1443
1444 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1445 {
1446         u8 *status = data;
1447
1448         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1449         mgmt_pending_remove(cmd);
1450 }
1451
1452 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1453 {
1454         if (cmd->cmd_complete) {
1455                 u8 *status = data;
1456
1457                 cmd->cmd_complete(cmd, *status);
1458                 mgmt_pending_remove(cmd);
1459
1460                 return;
1461         }
1462
1463         cmd_status_rsp(cmd, data);
1464 }
1465
1466 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1467 {
1468         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1469                                  cmd->param, cmd->param_len);
1470 }
1471
1472 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1473 {
1474         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1475                                  cmd->param, sizeof(struct mgmt_addr_info));
1476 }
1477
1478 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1479 {
1480         if (!lmp_bredr_capable(hdev))
1481                 return MGMT_STATUS_NOT_SUPPORTED;
1482         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1483                 return MGMT_STATUS_REJECTED;
1484         else
1485                 return MGMT_STATUS_SUCCESS;
1486 }
1487
1488 static u8 mgmt_le_support(struct hci_dev *hdev)
1489 {
1490         if (!lmp_le_capable(hdev))
1491                 return MGMT_STATUS_NOT_SUPPORTED;
1492         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1493                 return MGMT_STATUS_REJECTED;
1494         else
1495                 return MGMT_STATUS_SUCCESS;
1496 }
1497
1498 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1499                                            int err)
1500 {
1501         struct mgmt_pending_cmd *cmd = data;
1502
1503         bt_dev_dbg(hdev, "err %d", err);
1504
1505         /* Make sure cmd still outstanding. */
1506         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1507                 return;
1508
1509         hci_dev_lock(hdev);
1510
1511         if (err) {
1512                 u8 mgmt_err = mgmt_status(err);
1513                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1514                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1515                 goto done;
1516         }
1517
1518         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1519             hdev->discov_timeout > 0) {
1520                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1521                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1522         }
1523
1524         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1525         new_settings(hdev, cmd->sk);
1526
1527 done:
1528         mgmt_pending_remove(cmd);
1529         hci_dev_unlock(hdev);
1530 }
1531
1532 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1533 {
1534         BT_DBG("%s", hdev->name);
1535
1536         return hci_update_discoverable_sync(hdev);
1537 }
1538
1539 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1540                             u16 len)
1541 {
1542         struct mgmt_cp_set_discoverable *cp = data;
1543         struct mgmt_pending_cmd *cmd;
1544         u16 timeout;
1545         int err;
1546
1547         bt_dev_dbg(hdev, "sock %p", sk);
1548
1549         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1550             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1551                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1552                                        MGMT_STATUS_REJECTED);
1553
1554         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1555                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1556                                        MGMT_STATUS_INVALID_PARAMS);
1557
1558         timeout = __le16_to_cpu(cp->timeout);
1559
1560         /* Disabling discoverable requires that no timeout is set,
1561          * and enabling limited discoverable requires a timeout.
1562          */
1563         if ((cp->val == 0x00 && timeout > 0) ||
1564             (cp->val == 0x02 && timeout == 0))
1565                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1566                                        MGMT_STATUS_INVALID_PARAMS);
1567
1568         hci_dev_lock(hdev);
1569
1570         if (!hdev_is_powered(hdev) && timeout > 0) {
1571                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1572                                       MGMT_STATUS_NOT_POWERED);
1573                 goto failed;
1574         }
1575
1576         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1577             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1578                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1579                                       MGMT_STATUS_BUSY);
1580                 goto failed;
1581         }
1582
1583         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1584                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1585                                       MGMT_STATUS_REJECTED);
1586                 goto failed;
1587         }
1588
1589         if (hdev->advertising_paused) {
1590                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1591                                       MGMT_STATUS_BUSY);
1592                 goto failed;
1593         }
1594
1595         if (!hdev_is_powered(hdev)) {
1596                 bool changed = false;
1597
1598                 /* Setting limited discoverable when powered off is
1599                  * not a valid operation since it requires a timeout
1600                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1601                  */
1602                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1603                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1604                         changed = true;
1605                 }
1606
1607                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1608                 if (err < 0)
1609                         goto failed;
1610
1611                 if (changed)
1612                         err = new_settings(hdev, sk);
1613
1614                 goto failed;
1615         }
1616
1617         /* If the current mode is the same, then just update the timeout
1618          * value with the new value. And if only the timeout gets updated,
1619          * then no need for any HCI transactions.
1620          */
1621         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1622             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1623                                                    HCI_LIMITED_DISCOVERABLE)) {
1624                 cancel_delayed_work(&hdev->discov_off);
1625                 hdev->discov_timeout = timeout;
1626
1627                 if (cp->val && hdev->discov_timeout > 0) {
1628                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1629                         queue_delayed_work(hdev->req_workqueue,
1630                                            &hdev->discov_off, to);
1631                 }
1632
1633                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1634                 goto failed;
1635         }
1636
1637         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1638         if (!cmd) {
1639                 err = -ENOMEM;
1640                 goto failed;
1641         }
1642
1643         /* Cancel any potential discoverable timeout that might be
1644          * still active and store new timeout value. The arming of
1645          * the timeout happens in the complete handler.
1646          */
1647         cancel_delayed_work(&hdev->discov_off);
1648         hdev->discov_timeout = timeout;
1649
1650         if (cp->val)
1651                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1652         else
1653                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1654
1655         /* Limited discoverable mode */
1656         if (cp->val == 0x02)
1657                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1658         else
1659                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1660
1661         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1662                                  mgmt_set_discoverable_complete);
1663
1664         if (err < 0)
1665                 mgmt_pending_remove(cmd);
1666
1667 failed:
1668         hci_dev_unlock(hdev);
1669         return err;
1670 }
1671
1672 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1673                                           int err)
1674 {
1675         struct mgmt_pending_cmd *cmd = data;
1676
1677         bt_dev_dbg(hdev, "err %d", err);
1678
1679         /* Make sure cmd still outstanding. */
1680         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1681                 return;
1682
1683         hci_dev_lock(hdev);
1684
1685         if (err) {
1686                 u8 mgmt_err = mgmt_status(err);
1687                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1688                 goto done;
1689         }
1690
1691         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1692         new_settings(hdev, cmd->sk);
1693
1694 done:
1695         if (cmd)
1696                 mgmt_pending_remove(cmd);
1697
1698         hci_dev_unlock(hdev);
1699 }
1700
1701 static int set_connectable_update_settings(struct hci_dev *hdev,
1702                                            struct sock *sk, u8 val)
1703 {
1704         bool changed = false;
1705         int err;
1706
1707         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1708                 changed = true;
1709
1710         if (val) {
1711                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1712         } else {
1713                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1714                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1715         }
1716
1717         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1718         if (err < 0)
1719                 return err;
1720
1721         if (changed) {
1722                 hci_update_scan(hdev);
1723                 hci_update_passive_scan(hdev);
1724                 return new_settings(hdev, sk);
1725         }
1726
1727         return 0;
1728 }
1729
1730 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1731 {
1732         BT_DBG("%s", hdev->name);
1733
1734         return hci_update_connectable_sync(hdev);
1735 }
1736
1737 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1738                            u16 len)
1739 {
1740         struct mgmt_mode *cp = data;
1741         struct mgmt_pending_cmd *cmd;
1742         int err;
1743
1744         bt_dev_dbg(hdev, "sock %p", sk);
1745
1746         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1747             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1749                                        MGMT_STATUS_REJECTED);
1750
1751         if (cp->val != 0x00 && cp->val != 0x01)
1752                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1753                                        MGMT_STATUS_INVALID_PARAMS);
1754
1755         hci_dev_lock(hdev);
1756
1757         if (!hdev_is_powered(hdev)) {
1758                 err = set_connectable_update_settings(hdev, sk, cp->val);
1759                 goto failed;
1760         }
1761
1762         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1763             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1764                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1765                                       MGMT_STATUS_BUSY);
1766                 goto failed;
1767         }
1768
1769         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1770         if (!cmd) {
1771                 err = -ENOMEM;
1772                 goto failed;
1773         }
1774
1775         if (cp->val) {
1776                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1777         } else {
1778                 if (hdev->discov_timeout > 0)
1779                         cancel_delayed_work(&hdev->discov_off);
1780
1781                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1782                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1783                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1784         }
1785
1786         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1787                                  mgmt_set_connectable_complete);
1788
1789         if (err < 0)
1790                 mgmt_pending_remove(cmd);
1791
1792 failed:
1793         hci_dev_unlock(hdev);
1794         return err;
1795 }
1796
1797 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1798                         u16 len)
1799 {
1800         struct mgmt_mode *cp = data;
1801         bool changed;
1802         int err;
1803
1804         bt_dev_dbg(hdev, "sock %p", sk);
1805
1806         if (cp->val != 0x00 && cp->val != 0x01)
1807                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1808                                        MGMT_STATUS_INVALID_PARAMS);
1809
1810         hci_dev_lock(hdev);
1811
1812         if (cp->val)
1813                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1814         else
1815                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1816
1817         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1818         if (err < 0)
1819                 goto unlock;
1820
1821         if (changed) {
1822                 /* In limited privacy mode the change of bondable mode
1823                  * may affect the local advertising address.
1824                  */
1825                 hci_update_discoverable(hdev);
1826
1827                 err = new_settings(hdev, sk);
1828         }
1829
1830 unlock:
1831         hci_dev_unlock(hdev);
1832         return err;
1833 }
1834
1835 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1836                              u16 len)
1837 {
1838         struct mgmt_mode *cp = data;
1839         struct mgmt_pending_cmd *cmd;
1840         u8 val, status;
1841         int err;
1842
1843         bt_dev_dbg(hdev, "sock %p", sk);
1844
1845         status = mgmt_bredr_support(hdev);
1846         if (status)
1847                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1848                                        status);
1849
1850         if (cp->val != 0x00 && cp->val != 0x01)
1851                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1852                                        MGMT_STATUS_INVALID_PARAMS);
1853
1854         hci_dev_lock(hdev);
1855
1856         if (!hdev_is_powered(hdev)) {
1857                 bool changed = false;
1858
1859                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1860                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1861                         changed = true;
1862                 }
1863
1864                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1865                 if (err < 0)
1866                         goto failed;
1867
1868                 if (changed)
1869                         err = new_settings(hdev, sk);
1870
1871                 goto failed;
1872         }
1873
1874         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1875                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1876                                       MGMT_STATUS_BUSY);
1877                 goto failed;
1878         }
1879
1880         val = !!cp->val;
1881
1882         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1883                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1884                 goto failed;
1885         }
1886
1887         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1888         if (!cmd) {
1889                 err = -ENOMEM;
1890                 goto failed;
1891         }
1892
1893         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1894         if (err < 0) {
1895                 mgmt_pending_remove(cmd);
1896                 goto failed;
1897         }
1898
1899 failed:
1900         hci_dev_unlock(hdev);
1901         return err;
1902 }
1903
1904 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1905 {
1906         struct cmd_lookup match = { NULL, hdev };
1907         struct mgmt_pending_cmd *cmd = data;
1908         struct mgmt_mode *cp = cmd->param;
1909         u8 enable = cp->val;
1910         bool changed;
1911
1912         /* Make sure cmd still outstanding. */
1913         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1914                 return;
1915
1916         if (err) {
1917                 u8 mgmt_err = mgmt_status(err);
1918
1919                 if (enable && hci_dev_test_and_clear_flag(hdev,
1920                                                           HCI_SSP_ENABLED)) {
1921                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1922                         new_settings(hdev, NULL);
1923                 }
1924
1925                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1926                                      &mgmt_err);
1927                 return;
1928         }
1929
1930         if (enable) {
1931                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1932         } else {
1933                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1934
1935                 if (!changed)
1936                         changed = hci_dev_test_and_clear_flag(hdev,
1937                                                               HCI_HS_ENABLED);
1938                 else
1939                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1940         }
1941
1942         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1943
1944         if (changed)
1945                 new_settings(hdev, match.sk);
1946
1947         if (match.sk)
1948                 sock_put(match.sk);
1949
1950         hci_update_eir_sync(hdev);
1951 }
1952
1953 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1954 {
1955         struct mgmt_pending_cmd *cmd = data;
1956         struct mgmt_mode *cp = cmd->param;
1957         bool changed = false;
1958         int err;
1959
1960         if (cp->val)
1961                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1962
1963         err = hci_write_ssp_mode_sync(hdev, cp->val);
1964
1965         if (!err && changed)
1966                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1967
1968         return err;
1969 }
1970
1971 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1972 {
1973         struct mgmt_mode *cp = data;
1974         struct mgmt_pending_cmd *cmd;
1975         u8 status;
1976         int err;
1977
1978         bt_dev_dbg(hdev, "sock %p", sk);
1979
1980         status = mgmt_bredr_support(hdev);
1981         if (status)
1982                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1983
1984         if (!lmp_ssp_capable(hdev))
1985                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1986                                        MGMT_STATUS_NOT_SUPPORTED);
1987
1988         if (cp->val != 0x00 && cp->val != 0x01)
1989                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1990                                        MGMT_STATUS_INVALID_PARAMS);
1991
1992         hci_dev_lock(hdev);
1993
1994         if (!hdev_is_powered(hdev)) {
1995                 bool changed;
1996
1997                 if (cp->val) {
1998                         changed = !hci_dev_test_and_set_flag(hdev,
1999                                                              HCI_SSP_ENABLED);
2000                 } else {
2001                         changed = hci_dev_test_and_clear_flag(hdev,
2002                                                               HCI_SSP_ENABLED);
2003                         if (!changed)
2004                                 changed = hci_dev_test_and_clear_flag(hdev,
2005                                                                       HCI_HS_ENABLED);
2006                         else
2007                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2008                 }
2009
2010                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2011                 if (err < 0)
2012                         goto failed;
2013
2014                 if (changed)
2015                         err = new_settings(hdev, sk);
2016
2017                 goto failed;
2018         }
2019
2020         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2021                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2022                                       MGMT_STATUS_BUSY);
2023                 goto failed;
2024         }
2025
2026         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2027                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2028                 goto failed;
2029         }
2030
2031         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2032         if (!cmd)
2033                 err = -ENOMEM;
2034         else
2035                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2036                                          set_ssp_complete);
2037
2038         if (err < 0) {
2039                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2040                                       MGMT_STATUS_FAILED);
2041
2042                 if (cmd)
2043                         mgmt_pending_remove(cmd);
2044         }
2045
2046 failed:
2047         hci_dev_unlock(hdev);
2048         return err;
2049 }
2050
2051 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2052 {
2053         struct mgmt_mode *cp = data;
2054         bool changed;
2055         u8 status;
2056         int err;
2057
2058         bt_dev_dbg(hdev, "sock %p", sk);
2059
2060         if (!IS_ENABLED(CONFIG_BT_HS))
2061                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2062                                        MGMT_STATUS_NOT_SUPPORTED);
2063
2064         status = mgmt_bredr_support(hdev);
2065         if (status)
2066                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2067
2068         if (!lmp_ssp_capable(hdev))
2069                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2070                                        MGMT_STATUS_NOT_SUPPORTED);
2071
2072         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2073                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2074                                        MGMT_STATUS_REJECTED);
2075
2076         if (cp->val != 0x00 && cp->val != 0x01)
2077                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2078                                        MGMT_STATUS_INVALID_PARAMS);
2079
2080         hci_dev_lock(hdev);
2081
2082         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2083                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2084                                       MGMT_STATUS_BUSY);
2085                 goto unlock;
2086         }
2087
2088         if (cp->val) {
2089                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2090         } else {
2091                 if (hdev_is_powered(hdev)) {
2092                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2093                                               MGMT_STATUS_REJECTED);
2094                         goto unlock;
2095                 }
2096
2097                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2098         }
2099
2100         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2101         if (err < 0)
2102                 goto unlock;
2103
2104         if (changed)
2105                 err = new_settings(hdev, sk);
2106
2107 unlock:
2108         hci_dev_unlock(hdev);
2109         return err;
2110 }
2111
2112 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2113 {
2114         struct cmd_lookup match = { NULL, hdev };
2115         u8 status = mgmt_status(err);
2116
2117         bt_dev_dbg(hdev, "err %d", err);
2118
2119         if (status) {
2120                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2121                                                         &status);
2122                 return;
2123         }
2124
2125         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2126
2127         new_settings(hdev, match.sk);
2128
2129         if (match.sk)
2130                 sock_put(match.sk);
2131 }
2132
2133 static int set_le_sync(struct hci_dev *hdev, void *data)
2134 {
2135         struct mgmt_pending_cmd *cmd = data;
2136         struct mgmt_mode *cp = cmd->param;
2137         u8 val = !!cp->val;
2138         int err;
2139
2140         if (!val) {
2141                 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2142
2143                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2144                         hci_disable_advertising_sync(hdev);
2145
2146                 if (ext_adv_capable(hdev))
2147                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2148         } else {
2149                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2150         }
2151
2152         err = hci_write_le_host_supported_sync(hdev, val, 0);
2153
2154         /* Make sure the controller has a good default for
2155          * advertising data. Restrict the update to when LE
2156          * has actually been enabled. During power on, the
2157          * update in powered_update_hci will take care of it.
2158          */
2159         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2160                 if (ext_adv_capable(hdev)) {
2161                         int status;
2162
2163                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2164                         if (!status)
2165                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2166                 } else {
2167                         hci_update_adv_data_sync(hdev, 0x00);
2168                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2169                 }
2170
2171                 hci_update_passive_scan(hdev);
2172         }
2173
2174         return err;
2175 }
2176
2177 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2178 {
2179         struct mgmt_pending_cmd *cmd = data;
2180         u8 status = mgmt_status(err);
2181         struct sock *sk = cmd->sk;
2182
2183         if (status) {
2184                 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2185                                      cmd_status_rsp, &status);
2186                 return;
2187         }
2188
2189         mgmt_pending_remove(cmd);
2190         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2191 }
2192
2193 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2194 {
2195         struct mgmt_pending_cmd *cmd = data;
2196         struct mgmt_cp_set_mesh *cp = cmd->param;
2197         size_t len = cmd->param_len;
2198
2199         memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2200
2201         if (cp->enable)
2202                 hci_dev_set_flag(hdev, HCI_MESH);
2203         else
2204                 hci_dev_clear_flag(hdev, HCI_MESH);
2205
2206         len -= sizeof(*cp);
2207
2208         /* If filters don't fit, forward all adv pkts */
2209         if (len <= sizeof(hdev->mesh_ad_types))
2210                 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2211
2212         hci_update_passive_scan_sync(hdev);
2213         return 0;
2214 }
2215
2216 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2217 {
2218         struct mgmt_cp_set_mesh *cp = data;
2219         struct mgmt_pending_cmd *cmd;
2220         int err = 0;
2221
2222         bt_dev_dbg(hdev, "sock %p", sk);
2223
2224         if (!lmp_le_capable(hdev) ||
2225             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2226                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2227                                        MGMT_STATUS_NOT_SUPPORTED);
2228
2229         if (cp->enable != 0x00 && cp->enable != 0x01)
2230                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2231                                        MGMT_STATUS_INVALID_PARAMS);
2232
2233         hci_dev_lock(hdev);
2234
2235         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2236         if (!cmd)
2237                 err = -ENOMEM;
2238         else
2239                 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2240                                          set_mesh_complete);
2241
2242         if (err < 0) {
2243                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2244                                       MGMT_STATUS_FAILED);
2245
2246                 if (cmd)
2247                         mgmt_pending_remove(cmd);
2248         }
2249
2250         hci_dev_unlock(hdev);
2251         return err;
2252 }
2253
2254 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2255 {
2256         struct mgmt_mesh_tx *mesh_tx = data;
2257         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2258         unsigned long mesh_send_interval;
2259         u8 mgmt_err = mgmt_status(err);
2260
2261         /* Report any errors here, but don't report completion */
2262
2263         if (mgmt_err) {
2264                 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2265                 /* Send Complete Error Code for handle */
2266                 mesh_send_complete(hdev, mesh_tx, false);
2267                 return;
2268         }
2269
2270         mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2271         queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2272                            mesh_send_interval);
2273 }
2274
2275 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2276 {
2277         struct mgmt_mesh_tx *mesh_tx = data;
2278         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2279         struct adv_info *adv, *next_instance;
2280         u8 instance = hdev->le_num_of_adv_sets + 1;
2281         u16 timeout, duration;
2282         int err = 0;
2283
2284         if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2285                 return MGMT_STATUS_BUSY;
2286
2287         timeout = 1000;
2288         duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2289         adv = hci_add_adv_instance(hdev, instance, 0,
2290                                    send->adv_data_len, send->adv_data,
2291                                    0, NULL,
2292                                    timeout, duration,
2293                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
2294                                    hdev->le_adv_min_interval,
2295                                    hdev->le_adv_max_interval,
2296                                    mesh_tx->handle);
2297
2298         if (!IS_ERR(adv))
2299                 mesh_tx->instance = instance;
2300         else
2301                 err = PTR_ERR(adv);
2302
2303         if (hdev->cur_adv_instance == instance) {
2304                 /* If the currently advertised instance is being changed then
2305                  * cancel the current advertising and schedule the next
2306                  * instance. If there is only one instance then the overridden
2307                  * advertising data will be visible right away.
2308                  */
2309                 cancel_adv_timeout(hdev);
2310
2311                 next_instance = hci_get_next_instance(hdev, instance);
2312                 if (next_instance)
2313                         instance = next_instance->instance;
2314                 else
2315                         instance = 0;
2316         } else if (hdev->adv_instance_timeout) {
2317                 /* Immediately advertise the new instance if no other, or
2318                  * let it go naturally from queue if ADV is already happening
2319                  */
2320                 instance = 0;
2321         }
2322
2323         if (instance)
2324                 return hci_schedule_adv_instance_sync(hdev, instance, true);
2325
2326         return err;
2327 }
2328
2329 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2330 {
2331         struct mgmt_rp_mesh_read_features *rp = data;
2332
2333         if (rp->used_handles >= rp->max_handles)
2334                 return;
2335
2336         rp->handles[rp->used_handles++] = mesh_tx->handle;
2337 }
2338
2339 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2340                          void *data, u16 len)
2341 {
2342         struct mgmt_rp_mesh_read_features rp;
2343
2344         if (!lmp_le_capable(hdev) ||
2345             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2346                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2347                                        MGMT_STATUS_NOT_SUPPORTED);
2348
2349         memset(&rp, 0, sizeof(rp));
2350         rp.index = cpu_to_le16(hdev->id);
2351         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2352                 rp.max_handles = MESH_HANDLES_MAX;
2353
2354         hci_dev_lock(hdev);
2355
2356         if (rp.max_handles)
2357                 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2358
2359         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2360                           rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2361
2362         hci_dev_unlock(hdev);
2363         return 0;
2364 }
2365
2366 static int send_cancel(struct hci_dev *hdev, void *data)
2367 {
2368         struct mgmt_pending_cmd *cmd = data;
2369         struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2370         struct mgmt_mesh_tx *mesh_tx;
2371
2372         if (!cancel->handle) {
2373                 do {
2374                         mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2375
2376                         if (mesh_tx)
2377                                 mesh_send_complete(hdev, mesh_tx, false);
2378                 } while (mesh_tx);
2379         } else {
2380                 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2381
2382                 if (mesh_tx && mesh_tx->sk == cmd->sk)
2383                         mesh_send_complete(hdev, mesh_tx, false);
2384         }
2385
2386         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2387                           0, NULL, 0);
2388         mgmt_pending_free(cmd);
2389
2390         return 0;
2391 }
2392
2393 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2394                             void *data, u16 len)
2395 {
2396         struct mgmt_pending_cmd *cmd;
2397         int err;
2398
2399         if (!lmp_le_capable(hdev) ||
2400             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2401                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2402                                        MGMT_STATUS_NOT_SUPPORTED);
2403
2404         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2405                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2406                                        MGMT_STATUS_REJECTED);
2407
2408         hci_dev_lock(hdev);
2409         cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2410         if (!cmd)
2411                 err = -ENOMEM;
2412         else
2413                 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2414
2415         if (err < 0) {
2416                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2417                                       MGMT_STATUS_FAILED);
2418
2419                 if (cmd)
2420                         mgmt_pending_free(cmd);
2421         }
2422
2423         hci_dev_unlock(hdev);
2424         return err;
2425 }
2426
2427 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2428 {
2429         struct mgmt_mesh_tx *mesh_tx;
2430         struct mgmt_cp_mesh_send *send = data;
2431         struct mgmt_rp_mesh_read_features rp;
2432         bool sending;
2433         int err = 0;
2434
2435         if (!lmp_le_capable(hdev) ||
2436             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2437                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2438                                        MGMT_STATUS_NOT_SUPPORTED);
2439         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2440             len <= MGMT_MESH_SEND_SIZE ||
2441             len > (MGMT_MESH_SEND_SIZE + 31))
2442                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2443                                        MGMT_STATUS_REJECTED);
2444
2445         hci_dev_lock(hdev);
2446
2447         memset(&rp, 0, sizeof(rp));
2448         rp.max_handles = MESH_HANDLES_MAX;
2449
2450         mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2451
2452         if (rp.max_handles <= rp.used_handles) {
2453                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2454                                       MGMT_STATUS_BUSY);
2455                 goto done;
2456         }
2457
2458         sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2459         mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2460
2461         if (!mesh_tx)
2462                 err = -ENOMEM;
2463         else if (!sending)
2464                 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2465                                          mesh_send_start_complete);
2466
2467         if (err < 0) {
2468                 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2469                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2470                                       MGMT_STATUS_FAILED);
2471
2472                 if (mesh_tx) {
2473                         if (sending)
2474                                 mgmt_mesh_remove(mesh_tx);
2475                 }
2476         } else {
2477                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2478
2479                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2480                                   &mesh_tx->handle, 1);
2481         }
2482
2483 done:
2484         hci_dev_unlock(hdev);
2485         return err;
2486 }
2487
2488 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2489 {
2490         struct mgmt_mode *cp = data;
2491         struct mgmt_pending_cmd *cmd;
2492         int err;
2493         u8 val, enabled;
2494
2495         bt_dev_dbg(hdev, "sock %p", sk);
2496
2497         if (!lmp_le_capable(hdev))
2498                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2499                                        MGMT_STATUS_NOT_SUPPORTED);
2500
2501         if (cp->val != 0x00 && cp->val != 0x01)
2502                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2503                                        MGMT_STATUS_INVALID_PARAMS);
2504
2505         /* Bluetooth single mode LE only controllers or dual-mode
2506          * controllers configured as LE only devices, do not allow
2507          * switching LE off. These have either LE enabled explicitly
2508          * or BR/EDR has been previously switched off.
2509          *
2510          * When trying to enable an already enabled LE, then gracefully
2511          * send a positive response. Trying to disable it however will
2512          * result into rejection.
2513          */
2514         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2515                 if (cp->val == 0x01)
2516                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2517
2518                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2519                                        MGMT_STATUS_REJECTED);
2520         }
2521
2522         hci_dev_lock(hdev);
2523
2524         val = !!cp->val;
2525         enabled = lmp_host_le_capable(hdev);
2526
2527         if (!hdev_is_powered(hdev) || val == enabled) {
2528                 bool changed = false;
2529
2530                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2531                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2532                         changed = true;
2533                 }
2534
2535                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2536                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2537                         changed = true;
2538                 }
2539
2540                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2541                 if (err < 0)
2542                         goto unlock;
2543
2544                 if (changed)
2545                         err = new_settings(hdev, sk);
2546
2547                 goto unlock;
2548         }
2549
2550         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2551             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2552                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2553                                       MGMT_STATUS_BUSY);
2554                 goto unlock;
2555         }
2556
2557         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2558         if (!cmd)
2559                 err = -ENOMEM;
2560         else
2561                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2562                                          set_le_complete);
2563
2564         if (err < 0) {
2565                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2566                                       MGMT_STATUS_FAILED);
2567
2568                 if (cmd)
2569                         mgmt_pending_remove(cmd);
2570         }
2571
2572 unlock:
2573         hci_dev_unlock(hdev);
2574         return err;
2575 }
2576
2577 /* This is a helper function to test for pending mgmt commands that can
2578  * cause CoD or EIR HCI commands. We can only allow one such pending
2579  * mgmt command at a time since otherwise we cannot easily track what
2580  * the current values are, will be, and based on that calculate if a new
2581  * HCI command needs to be sent and if yes with what value.
2582  */
2583 static bool pending_eir_or_class(struct hci_dev *hdev)
2584 {
2585         struct mgmt_pending_cmd *cmd;
2586
2587         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2588                 switch (cmd->opcode) {
2589                 case MGMT_OP_ADD_UUID:
2590                 case MGMT_OP_REMOVE_UUID:
2591                 case MGMT_OP_SET_DEV_CLASS:
2592                 case MGMT_OP_SET_POWERED:
2593                         return true;
2594                 }
2595         }
2596
2597         return false;
2598 }
2599
2600 static const u8 bluetooth_base_uuid[] = {
2601                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2602                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2603 };
2604
2605 static u8 get_uuid_size(const u8 *uuid)
2606 {
2607         u32 val;
2608
2609         if (memcmp(uuid, bluetooth_base_uuid, 12))
2610                 return 128;
2611
2612         val = get_unaligned_le32(&uuid[12]);
2613         if (val > 0xffff)
2614                 return 32;
2615
2616         return 16;
2617 }
2618
2619 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2620 {
2621         struct mgmt_pending_cmd *cmd = data;
2622
2623         bt_dev_dbg(hdev, "err %d", err);
2624
2625         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2626                           mgmt_status(err), hdev->dev_class, 3);
2627
2628         mgmt_pending_free(cmd);
2629 }
2630
2631 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2632 {
2633         int err;
2634
2635         err = hci_update_class_sync(hdev);
2636         if (err)
2637                 return err;
2638
2639         return hci_update_eir_sync(hdev);
2640 }
2641
2642 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2643 {
2644         struct mgmt_cp_add_uuid *cp = data;
2645         struct mgmt_pending_cmd *cmd;
2646         struct bt_uuid *uuid;
2647         int err;
2648
2649         bt_dev_dbg(hdev, "sock %p", sk);
2650
2651         hci_dev_lock(hdev);
2652
2653         if (pending_eir_or_class(hdev)) {
2654                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2655                                       MGMT_STATUS_BUSY);
2656                 goto failed;
2657         }
2658
2659         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2660         if (!uuid) {
2661                 err = -ENOMEM;
2662                 goto failed;
2663         }
2664
2665         memcpy(uuid->uuid, cp->uuid, 16);
2666         uuid->svc_hint = cp->svc_hint;
2667         uuid->size = get_uuid_size(cp->uuid);
2668
2669         list_add_tail(&uuid->list, &hdev->uuids);
2670
2671         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2672         if (!cmd) {
2673                 err = -ENOMEM;
2674                 goto failed;
2675         }
2676
2677         err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2678         if (err < 0) {
2679                 mgmt_pending_free(cmd);
2680                 goto failed;
2681         }
2682
2683 failed:
2684         hci_dev_unlock(hdev);
2685         return err;
2686 }
2687
2688 static bool enable_service_cache(struct hci_dev *hdev)
2689 {
2690         if (!hdev_is_powered(hdev))
2691                 return false;
2692
2693         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2694                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2695                                    CACHE_TIMEOUT);
2696                 return true;
2697         }
2698
2699         return false;
2700 }
2701
2702 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2703 {
2704         int err;
2705
2706         err = hci_update_class_sync(hdev);
2707         if (err)
2708                 return err;
2709
2710         return hci_update_eir_sync(hdev);
2711 }
2712
2713 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2714                        u16 len)
2715 {
2716         struct mgmt_cp_remove_uuid *cp = data;
2717         struct mgmt_pending_cmd *cmd;
2718         struct bt_uuid *match, *tmp;
2719         static const u8 bt_uuid_any[] = {
2720                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2721         };
2722         int err, found;
2723
2724         bt_dev_dbg(hdev, "sock %p", sk);
2725
2726         hci_dev_lock(hdev);
2727
2728         if (pending_eir_or_class(hdev)) {
2729                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2730                                       MGMT_STATUS_BUSY);
2731                 goto unlock;
2732         }
2733
2734         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2735                 hci_uuids_clear(hdev);
2736
2737                 if (enable_service_cache(hdev)) {
2738                         err = mgmt_cmd_complete(sk, hdev->id,
2739                                                 MGMT_OP_REMOVE_UUID,
2740                                                 0, hdev->dev_class, 3);
2741                         goto unlock;
2742                 }
2743
2744                 goto update_class;
2745         }
2746
2747         found = 0;
2748
2749         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2750                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2751                         continue;
2752
2753                 list_del(&match->list);
2754                 kfree(match);
2755                 found++;
2756         }
2757
2758         if (found == 0) {
2759                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2760                                       MGMT_STATUS_INVALID_PARAMS);
2761                 goto unlock;
2762         }
2763
2764 update_class:
2765         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2766         if (!cmd) {
2767                 err = -ENOMEM;
2768                 goto unlock;
2769         }
2770
2771         err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2772                                  mgmt_class_complete);
2773         if (err < 0)
2774                 mgmt_pending_free(cmd);
2775
2776 unlock:
2777         hci_dev_unlock(hdev);
2778         return err;
2779 }
2780
2781 static int set_class_sync(struct hci_dev *hdev, void *data)
2782 {
2783         int err = 0;
2784
2785         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2786                 cancel_delayed_work_sync(&hdev->service_cache);
2787                 err = hci_update_eir_sync(hdev);
2788         }
2789
2790         if (err)
2791                 return err;
2792
2793         return hci_update_class_sync(hdev);
2794 }
2795
2796 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2797                          u16 len)
2798 {
2799         struct mgmt_cp_set_dev_class *cp = data;
2800         struct mgmt_pending_cmd *cmd;
2801         int err;
2802
2803         bt_dev_dbg(hdev, "sock %p", sk);
2804
2805         if (!lmp_bredr_capable(hdev))
2806                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2807                                        MGMT_STATUS_NOT_SUPPORTED);
2808
2809         hci_dev_lock(hdev);
2810
2811         if (pending_eir_or_class(hdev)) {
2812                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2813                                       MGMT_STATUS_BUSY);
2814                 goto unlock;
2815         }
2816
2817         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2818                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2819                                       MGMT_STATUS_INVALID_PARAMS);
2820                 goto unlock;
2821         }
2822
2823         hdev->major_class = cp->major;
2824         hdev->minor_class = cp->minor;
2825
2826         if (!hdev_is_powered(hdev)) {
2827                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2828                                         hdev->dev_class, 3);
2829                 goto unlock;
2830         }
2831
2832         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2833         if (!cmd) {
2834                 err = -ENOMEM;
2835                 goto unlock;
2836         }
2837
2838         err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2839                                  mgmt_class_complete);
2840         if (err < 0)
2841                 mgmt_pending_free(cmd);
2842
2843 unlock:
2844         hci_dev_unlock(hdev);
2845         return err;
2846 }
2847
2848 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2849                           u16 len)
2850 {
2851         struct mgmt_cp_load_link_keys *cp = data;
2852         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2853                                    sizeof(struct mgmt_link_key_info));
2854         u16 key_count, expected_len;
2855         bool changed;
2856         int i;
2857
2858         bt_dev_dbg(hdev, "sock %p", sk);
2859
2860         if (!lmp_bredr_capable(hdev))
2861                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2862                                        MGMT_STATUS_NOT_SUPPORTED);
2863
2864         key_count = __le16_to_cpu(cp->key_count);
2865         if (key_count > max_key_count) {
2866                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2867                            key_count);
2868                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2869                                        MGMT_STATUS_INVALID_PARAMS);
2870         }
2871
2872         expected_len = struct_size(cp, keys, key_count);
2873         if (expected_len != len) {
2874                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2875                            expected_len, len);
2876                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2877                                        MGMT_STATUS_INVALID_PARAMS);
2878         }
2879
2880         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2881                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2882                                        MGMT_STATUS_INVALID_PARAMS);
2883
2884         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2885                    key_count);
2886
2887         for (i = 0; i < key_count; i++) {
2888                 struct mgmt_link_key_info *key = &cp->keys[i];
2889
2890                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2891                         return mgmt_cmd_status(sk, hdev->id,
2892                                                MGMT_OP_LOAD_LINK_KEYS,
2893                                                MGMT_STATUS_INVALID_PARAMS);
2894         }
2895
2896         hci_dev_lock(hdev);
2897
2898         hci_link_keys_clear(hdev);
2899
2900         if (cp->debug_keys)
2901                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2902         else
2903                 changed = hci_dev_test_and_clear_flag(hdev,
2904                                                       HCI_KEEP_DEBUG_KEYS);
2905
2906         if (changed)
2907                 new_settings(hdev, NULL);
2908
2909         for (i = 0; i < key_count; i++) {
2910                 struct mgmt_link_key_info *key = &cp->keys[i];
2911
2912                 if (hci_is_blocked_key(hdev,
2913                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2914                                        key->val)) {
2915                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2916                                     &key->addr.bdaddr);
2917                         continue;
2918                 }
2919
2920                 /* Always ignore debug keys and require a new pairing if
2921                  * the user wants to use them.
2922                  */
2923                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2924                         continue;
2925
2926                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2927                                  key->type, key->pin_len, NULL);
2928         }
2929
2930         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2931
2932         hci_dev_unlock(hdev);
2933
2934         return 0;
2935 }
2936
2937 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2938                            u8 addr_type, struct sock *skip_sk)
2939 {
2940         struct mgmt_ev_device_unpaired ev;
2941
2942         bacpy(&ev.addr.bdaddr, bdaddr);
2943         ev.addr.type = addr_type;
2944
2945         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2946                           skip_sk);
2947 }
2948
2949 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2950 {
2951         struct mgmt_pending_cmd *cmd = data;
2952         struct mgmt_cp_unpair_device *cp = cmd->param;
2953
2954         if (!err)
2955                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2956
2957         cmd->cmd_complete(cmd, err);
2958         mgmt_pending_free(cmd);
2959 }
2960
2961 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2962 {
2963         struct mgmt_pending_cmd *cmd = data;
2964         struct mgmt_cp_unpair_device *cp = cmd->param;
2965         struct hci_conn *conn;
2966
2967         if (cp->addr.type == BDADDR_BREDR)
2968                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2969                                                &cp->addr.bdaddr);
2970         else
2971                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2972                                                le_addr_type(cp->addr.type));
2973
2974         if (!conn)
2975                 return 0;
2976
2977         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2978 }
2979
2980 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2981                          u16 len)
2982 {
2983         struct mgmt_cp_unpair_device *cp = data;
2984         struct mgmt_rp_unpair_device rp;
2985         struct hci_conn_params *params;
2986         struct mgmt_pending_cmd *cmd;
2987         struct hci_conn *conn;
2988         u8 addr_type;
2989         int err;
2990
2991         memset(&rp, 0, sizeof(rp));
2992         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2993         rp.addr.type = cp->addr.type;
2994
2995         if (!bdaddr_type_is_valid(cp->addr.type))
2996                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2997                                          MGMT_STATUS_INVALID_PARAMS,
2998                                          &rp, sizeof(rp));
2999
3000         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
3001                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3002                                          MGMT_STATUS_INVALID_PARAMS,
3003                                          &rp, sizeof(rp));
3004
3005         hci_dev_lock(hdev);
3006
3007         if (!hdev_is_powered(hdev)) {
3008                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3009                                         MGMT_STATUS_NOT_POWERED, &rp,
3010                                         sizeof(rp));
3011                 goto unlock;
3012         }
3013
3014         if (cp->addr.type == BDADDR_BREDR) {
3015                 /* If disconnection is requested, then look up the
3016                  * connection. If the remote device is connected, it
3017                  * will be later used to terminate the link.
3018                  *
3019                  * Setting it to NULL explicitly will cause no
3020                  * termination of the link.
3021                  */
3022                 if (cp->disconnect)
3023                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3024                                                        &cp->addr.bdaddr);
3025                 else
3026                         conn = NULL;
3027
3028                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3029                 if (err < 0) {
3030                         err = mgmt_cmd_complete(sk, hdev->id,
3031                                                 MGMT_OP_UNPAIR_DEVICE,
3032                                                 MGMT_STATUS_NOT_PAIRED, &rp,
3033                                                 sizeof(rp));
3034                         goto unlock;
3035                 }
3036
3037                 goto done;
3038         }
3039
3040         /* LE address type */
3041         addr_type = le_addr_type(cp->addr.type);
3042
3043         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3044         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3045         if (err < 0) {
3046                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3047                                         MGMT_STATUS_NOT_PAIRED, &rp,
3048                                         sizeof(rp));
3049                 goto unlock;
3050         }
3051
3052         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3053         if (!conn) {
3054                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3055                 goto done;
3056         }
3057
3058
3059         /* Defer clearing up the connection parameters until closing to
3060          * give a chance of keeping them if a repairing happens.
3061          */
3062         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3063
3064         /* Disable auto-connection parameters if present */
3065         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3066         if (params) {
3067                 if (params->explicit_connect)
3068                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3069                 else
3070                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3071         }
3072
3073         /* If disconnection is not requested, then clear the connection
3074          * variable so that the link is not terminated.
3075          */
3076         if (!cp->disconnect)
3077                 conn = NULL;
3078
3079 done:
3080         /* If the connection variable is set, then termination of the
3081          * link is requested.
3082          */
3083         if (!conn) {
3084                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3085                                         &rp, sizeof(rp));
3086                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3087                 goto unlock;
3088         }
3089
3090         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3091                                sizeof(*cp));
3092         if (!cmd) {
3093                 err = -ENOMEM;
3094                 goto unlock;
3095         }
3096
3097         cmd->cmd_complete = addr_cmd_complete;
3098
3099         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3100                                  unpair_device_complete);
3101         if (err < 0)
3102                 mgmt_pending_free(cmd);
3103
3104 unlock:
3105         hci_dev_unlock(hdev);
3106         return err;
3107 }
3108
3109 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3110                       u16 len)
3111 {
3112         struct mgmt_cp_disconnect *cp = data;
3113         struct mgmt_rp_disconnect rp;
3114         struct mgmt_pending_cmd *cmd;
3115         struct hci_conn *conn;
3116         int err;
3117
3118         bt_dev_dbg(hdev, "sock %p", sk);
3119
3120         memset(&rp, 0, sizeof(rp));
3121         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3122         rp.addr.type = cp->addr.type;
3123
3124         if (!bdaddr_type_is_valid(cp->addr.type))
3125                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3126                                          MGMT_STATUS_INVALID_PARAMS,
3127                                          &rp, sizeof(rp));
3128
3129         hci_dev_lock(hdev);
3130
3131         if (!test_bit(HCI_UP, &hdev->flags)) {
3132                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3133                                         MGMT_STATUS_NOT_POWERED, &rp,
3134                                         sizeof(rp));
3135                 goto failed;
3136         }
3137
3138         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3139                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3140                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3141                 goto failed;
3142         }
3143
3144         if (cp->addr.type == BDADDR_BREDR)
3145                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3146                                                &cp->addr.bdaddr);
3147         else
3148                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3149                                                le_addr_type(cp->addr.type));
3150
3151         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3152                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3153                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3154                                         sizeof(rp));
3155                 goto failed;
3156         }
3157
3158         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3159         if (!cmd) {
3160                 err = -ENOMEM;
3161                 goto failed;
3162         }
3163
3164         cmd->cmd_complete = generic_cmd_complete;
3165
3166         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3167         if (err < 0)
3168                 mgmt_pending_remove(cmd);
3169
3170 failed:
3171         hci_dev_unlock(hdev);
3172         return err;
3173 }
3174
3175 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3176 {
3177         switch (link_type) {
3178         case LE_LINK:
3179                 switch (addr_type) {
3180                 case ADDR_LE_DEV_PUBLIC:
3181                         return BDADDR_LE_PUBLIC;
3182
3183                 default:
3184                         /* Fallback to LE Random address type */
3185                         return BDADDR_LE_RANDOM;
3186                 }
3187
3188         default:
3189                 /* Fallback to BR/EDR type */
3190                 return BDADDR_BREDR;
3191         }
3192 }
3193
3194 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3195                            u16 data_len)
3196 {
3197         struct mgmt_rp_get_connections *rp;
3198         struct hci_conn *c;
3199         int err;
3200         u16 i;
3201
3202         bt_dev_dbg(hdev, "sock %p", sk);
3203
3204         hci_dev_lock(hdev);
3205
3206         if (!hdev_is_powered(hdev)) {
3207                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3208                                       MGMT_STATUS_NOT_POWERED);
3209                 goto unlock;
3210         }
3211
3212         i = 0;
3213         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3214                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3215                         i++;
3216         }
3217
3218         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
3219         if (!rp) {
3220                 err = -ENOMEM;
3221                 goto unlock;
3222         }
3223
3224         i = 0;
3225         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3226                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3227                         continue;
3228                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3229                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3230                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3231                         continue;
3232                 i++;
3233         }
3234
3235         rp->conn_count = cpu_to_le16(i);
3236
3237         /* Recalculate length in case of filtered SCO connections, etc */
3238         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3239                                 struct_size(rp, addr, i));
3240
3241         kfree(rp);
3242
3243 unlock:
3244         hci_dev_unlock(hdev);
3245         return err;
3246 }
3247
3248 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3249                                    struct mgmt_cp_pin_code_neg_reply *cp)
3250 {
3251         struct mgmt_pending_cmd *cmd;
3252         int err;
3253
3254         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3255                                sizeof(*cp));
3256         if (!cmd)
3257                 return -ENOMEM;
3258
3259         cmd->cmd_complete = addr_cmd_complete;
3260
3261         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3262                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3263         if (err < 0)
3264                 mgmt_pending_remove(cmd);
3265
3266         return err;
3267 }
3268
3269 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3270                           u16 len)
3271 {
3272         struct hci_conn *conn;
3273         struct mgmt_cp_pin_code_reply *cp = data;
3274         struct hci_cp_pin_code_reply reply;
3275         struct mgmt_pending_cmd *cmd;
3276         int err;
3277
3278         bt_dev_dbg(hdev, "sock %p", sk);
3279
3280         hci_dev_lock(hdev);
3281
3282         if (!hdev_is_powered(hdev)) {
3283                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3284                                       MGMT_STATUS_NOT_POWERED);
3285                 goto failed;
3286         }
3287
3288         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3289         if (!conn) {
3290                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3291                                       MGMT_STATUS_NOT_CONNECTED);
3292                 goto failed;
3293         }
3294
3295         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3296                 struct mgmt_cp_pin_code_neg_reply ncp;
3297
3298                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3299
3300                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3301
3302                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3303                 if (err >= 0)
3304                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3305                                               MGMT_STATUS_INVALID_PARAMS);
3306
3307                 goto failed;
3308         }
3309
3310         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3311         if (!cmd) {
3312                 err = -ENOMEM;
3313                 goto failed;
3314         }
3315
3316         cmd->cmd_complete = addr_cmd_complete;
3317
3318         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3319         reply.pin_len = cp->pin_len;
3320         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3321
3322         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3323         if (err < 0)
3324                 mgmt_pending_remove(cmd);
3325
3326 failed:
3327         hci_dev_unlock(hdev);
3328         return err;
3329 }
3330
3331 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3332                              u16 len)
3333 {
3334         struct mgmt_cp_set_io_capability *cp = data;
3335
3336         bt_dev_dbg(hdev, "sock %p", sk);
3337
3338         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3339                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3340                                        MGMT_STATUS_INVALID_PARAMS);
3341
3342         hci_dev_lock(hdev);
3343
3344         hdev->io_capability = cp->io_capability;
3345
3346         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3347
3348         hci_dev_unlock(hdev);
3349
3350         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3351                                  NULL, 0);
3352 }
3353
3354 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3355 {
3356         struct hci_dev *hdev = conn->hdev;
3357         struct mgmt_pending_cmd *cmd;
3358
3359         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3360                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3361                         continue;
3362
3363                 if (cmd->user_data != conn)
3364                         continue;
3365
3366                 return cmd;
3367         }
3368
3369         return NULL;
3370 }
3371
3372 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3373 {
3374         struct mgmt_rp_pair_device rp;
3375         struct hci_conn *conn = cmd->user_data;
3376         int err;
3377
3378         bacpy(&rp.addr.bdaddr, &conn->dst);
3379         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3380
3381         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3382                                 status, &rp, sizeof(rp));
3383
3384         /* So we don't get further callbacks for this connection */
3385         conn->connect_cfm_cb = NULL;
3386         conn->security_cfm_cb = NULL;
3387         conn->disconn_cfm_cb = NULL;
3388
3389         hci_conn_drop(conn);
3390
3391         /* The device is paired so there is no need to remove
3392          * its connection parameters anymore.
3393          */
3394         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3395
3396         hci_conn_put(conn);
3397
3398         return err;
3399 }
3400
3401 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3402 {
3403         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3404         struct mgmt_pending_cmd *cmd;
3405
3406         cmd = find_pairing(conn);
3407         if (cmd) {
3408                 cmd->cmd_complete(cmd, status);
3409                 mgmt_pending_remove(cmd);
3410         }
3411 }
3412
3413 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3414 {
3415         struct mgmt_pending_cmd *cmd;
3416
3417         BT_DBG("status %u", status);
3418
3419         cmd = find_pairing(conn);
3420         if (!cmd) {
3421                 BT_DBG("Unable to find a pending command");
3422                 return;
3423         }
3424
3425         cmd->cmd_complete(cmd, mgmt_status(status));
3426         mgmt_pending_remove(cmd);
3427 }
3428
3429 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3430 {
3431         struct mgmt_pending_cmd *cmd;
3432
3433         BT_DBG("status %u", status);
3434
3435         if (!status)
3436                 return;
3437
3438         cmd = find_pairing(conn);
3439         if (!cmd) {
3440                 BT_DBG("Unable to find a pending command");
3441                 return;
3442         }
3443
3444         cmd->cmd_complete(cmd, mgmt_status(status));
3445         mgmt_pending_remove(cmd);
3446 }
3447
3448 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3449                        u16 len)
3450 {
3451         struct mgmt_cp_pair_device *cp = data;
3452         struct mgmt_rp_pair_device rp;
3453         struct mgmt_pending_cmd *cmd;
3454         u8 sec_level, auth_type;
3455         struct hci_conn *conn;
3456         int err;
3457
3458         bt_dev_dbg(hdev, "sock %p", sk);
3459
3460         memset(&rp, 0, sizeof(rp));
3461         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3462         rp.addr.type = cp->addr.type;
3463
3464         if (!bdaddr_type_is_valid(cp->addr.type))
3465                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3466                                          MGMT_STATUS_INVALID_PARAMS,
3467                                          &rp, sizeof(rp));
3468
3469         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3470                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3471                                          MGMT_STATUS_INVALID_PARAMS,
3472                                          &rp, sizeof(rp));
3473
3474         hci_dev_lock(hdev);
3475
3476         if (!hdev_is_powered(hdev)) {
3477                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3478                                         MGMT_STATUS_NOT_POWERED, &rp,
3479                                         sizeof(rp));
3480                 goto unlock;
3481         }
3482
3483         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3484                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3485                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3486                                         sizeof(rp));
3487                 goto unlock;
3488         }
3489
3490         sec_level = BT_SECURITY_MEDIUM;
3491         auth_type = HCI_AT_DEDICATED_BONDING;
3492
3493         if (cp->addr.type == BDADDR_BREDR) {
3494                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3495                                        auth_type, CONN_REASON_PAIR_DEVICE);
3496         } else {
3497                 u8 addr_type = le_addr_type(cp->addr.type);
3498                 struct hci_conn_params *p;
3499
3500                 /* When pairing a new device, it is expected to remember
3501                  * this device for future connections. Adding the connection
3502                  * parameter information ahead of time allows tracking
3503                  * of the peripheral preferred values and will speed up any
3504                  * further connection establishment.
3505                  *
3506                  * If connection parameters already exist, then they
3507                  * will be kept and this function does nothing.
3508                  */
3509                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3510
3511                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3512                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3513
3514                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3515                                            sec_level, HCI_LE_CONN_TIMEOUT,
3516                                            CONN_REASON_PAIR_DEVICE);
3517         }
3518
3519         if (IS_ERR(conn)) {
3520                 int status;
3521
3522                 if (PTR_ERR(conn) == -EBUSY)
3523                         status = MGMT_STATUS_BUSY;
3524                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3525                         status = MGMT_STATUS_NOT_SUPPORTED;
3526                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3527                         status = MGMT_STATUS_REJECTED;
3528                 else
3529                         status = MGMT_STATUS_CONNECT_FAILED;
3530
3531                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3532                                         status, &rp, sizeof(rp));
3533                 goto unlock;
3534         }
3535
3536         if (conn->connect_cfm_cb) {
3537                 hci_conn_drop(conn);
3538                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3539                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3540                 goto unlock;
3541         }
3542
3543         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3544         if (!cmd) {
3545                 err = -ENOMEM;
3546                 hci_conn_drop(conn);
3547                 goto unlock;
3548         }
3549
3550         cmd->cmd_complete = pairing_complete;
3551
3552         /* For LE, just connecting isn't a proof that the pairing finished */
3553         if (cp->addr.type == BDADDR_BREDR) {
3554                 conn->connect_cfm_cb = pairing_complete_cb;
3555                 conn->security_cfm_cb = pairing_complete_cb;
3556                 conn->disconn_cfm_cb = pairing_complete_cb;
3557         } else {
3558                 conn->connect_cfm_cb = le_pairing_complete_cb;
3559                 conn->security_cfm_cb = le_pairing_complete_cb;
3560                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3561         }
3562
3563         conn->io_capability = cp->io_cap;
3564         cmd->user_data = hci_conn_get(conn);
3565
3566         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3567             hci_conn_security(conn, sec_level, auth_type, true)) {
3568                 cmd->cmd_complete(cmd, 0);
3569                 mgmt_pending_remove(cmd);
3570         }
3571
3572         err = 0;
3573
3574 unlock:
3575         hci_dev_unlock(hdev);
3576         return err;
3577 }
3578
3579 static int abort_conn_sync(struct hci_dev *hdev, void *data)
3580 {
3581         struct hci_conn *conn;
3582         u16 handle = PTR_ERR(data);
3583
3584         conn = hci_conn_hash_lookup_handle(hdev, handle);
3585         if (!conn)
3586                 return 0;
3587
3588         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
3589 }
3590
3591 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3592                               u16 len)
3593 {
3594         struct mgmt_addr_info *addr = data;
3595         struct mgmt_pending_cmd *cmd;
3596         struct hci_conn *conn;
3597         int err;
3598
3599         bt_dev_dbg(hdev, "sock %p", sk);
3600
3601         hci_dev_lock(hdev);
3602
3603         if (!hdev_is_powered(hdev)) {
3604                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3605                                       MGMT_STATUS_NOT_POWERED);
3606                 goto unlock;
3607         }
3608
3609         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3610         if (!cmd) {
3611                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3612                                       MGMT_STATUS_INVALID_PARAMS);
3613                 goto unlock;
3614         }
3615
3616         conn = cmd->user_data;
3617
3618         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3619                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3620                                       MGMT_STATUS_INVALID_PARAMS);
3621                 goto unlock;
3622         }
3623
3624         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3625         mgmt_pending_remove(cmd);
3626
3627         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3628                                 addr, sizeof(*addr));
3629
3630         /* Since user doesn't want to proceed with the connection, abort any
3631          * ongoing pairing and then terminate the link if it was created
3632          * because of the pair device action.
3633          */
3634         if (addr->type == BDADDR_BREDR)
3635                 hci_remove_link_key(hdev, &addr->bdaddr);
3636         else
3637                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3638                                               le_addr_type(addr->type));
3639
3640         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3641                 hci_cmd_sync_queue(hdev, abort_conn_sync, ERR_PTR(conn->handle),
3642                                    NULL);
3643
3644 unlock:
3645         hci_dev_unlock(hdev);
3646         return err;
3647 }
3648
3649 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3650                              struct mgmt_addr_info *addr, u16 mgmt_op,
3651                              u16 hci_op, __le32 passkey)
3652 {
3653         struct mgmt_pending_cmd *cmd;
3654         struct hci_conn *conn;
3655         int err;
3656
3657         hci_dev_lock(hdev);
3658
3659         if (!hdev_is_powered(hdev)) {
3660                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3661                                         MGMT_STATUS_NOT_POWERED, addr,
3662                                         sizeof(*addr));
3663                 goto done;
3664         }
3665
3666         if (addr->type == BDADDR_BREDR)
3667                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3668         else
3669                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3670                                                le_addr_type(addr->type));
3671
3672         if (!conn) {
3673                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3674                                         MGMT_STATUS_NOT_CONNECTED, addr,
3675                                         sizeof(*addr));
3676                 goto done;
3677         }
3678
3679         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3680                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3681                 if (!err)
3682                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3683                                                 MGMT_STATUS_SUCCESS, addr,
3684                                                 sizeof(*addr));
3685                 else
3686                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3687                                                 MGMT_STATUS_FAILED, addr,
3688                                                 sizeof(*addr));
3689
3690                 goto done;
3691         }
3692
3693         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3694         if (!cmd) {
3695                 err = -ENOMEM;
3696                 goto done;
3697         }
3698
3699         cmd->cmd_complete = addr_cmd_complete;
3700
3701         /* Continue with pairing via HCI */
3702         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3703                 struct hci_cp_user_passkey_reply cp;
3704
3705                 bacpy(&cp.bdaddr, &addr->bdaddr);
3706                 cp.passkey = passkey;
3707                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3708         } else
3709                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3710                                    &addr->bdaddr);
3711
3712         if (err < 0)
3713                 mgmt_pending_remove(cmd);
3714
3715 done:
3716         hci_dev_unlock(hdev);
3717         return err;
3718 }
3719
3720 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3721                               void *data, u16 len)
3722 {
3723         struct mgmt_cp_pin_code_neg_reply *cp = data;
3724
3725         bt_dev_dbg(hdev, "sock %p", sk);
3726
3727         return user_pairing_resp(sk, hdev, &cp->addr,
3728                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3729                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3730 }
3731
3732 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3733                               u16 len)
3734 {
3735         struct mgmt_cp_user_confirm_reply *cp = data;
3736
3737         bt_dev_dbg(hdev, "sock %p", sk);
3738
3739         if (len != sizeof(*cp))
3740                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3741                                        MGMT_STATUS_INVALID_PARAMS);
3742
3743         return user_pairing_resp(sk, hdev, &cp->addr,
3744                                  MGMT_OP_USER_CONFIRM_REPLY,
3745                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3746 }
3747
3748 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3749                                   void *data, u16 len)
3750 {
3751         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3752
3753         bt_dev_dbg(hdev, "sock %p", sk);
3754
3755         return user_pairing_resp(sk, hdev, &cp->addr,
3756                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3757                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3758 }
3759
3760 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3761                               u16 len)
3762 {
3763         struct mgmt_cp_user_passkey_reply *cp = data;
3764
3765         bt_dev_dbg(hdev, "sock %p", sk);
3766
3767         return user_pairing_resp(sk, hdev, &cp->addr,
3768                                  MGMT_OP_USER_PASSKEY_REPLY,
3769                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3770 }
3771
3772 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3773                                   void *data, u16 len)
3774 {
3775         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3776
3777         bt_dev_dbg(hdev, "sock %p", sk);
3778
3779         return user_pairing_resp(sk, hdev, &cp->addr,
3780                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3781                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3782 }
3783
3784 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3785 {
3786         struct adv_info *adv_instance;
3787
3788         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3789         if (!adv_instance)
3790                 return 0;
3791
3792         /* stop if current instance doesn't need to be changed */
3793         if (!(adv_instance->flags & flags))
3794                 return 0;
3795
3796         cancel_adv_timeout(hdev);
3797
3798         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3799         if (!adv_instance)
3800                 return 0;
3801
3802         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3803
3804         return 0;
3805 }
3806
3807 static int name_changed_sync(struct hci_dev *hdev, void *data)
3808 {
3809         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3810 }
3811
3812 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3813 {
3814         struct mgmt_pending_cmd *cmd = data;
3815         struct mgmt_cp_set_local_name *cp = cmd->param;
3816         u8 status = mgmt_status(err);
3817
3818         bt_dev_dbg(hdev, "err %d", err);
3819
3820         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3821                 return;
3822
3823         if (status) {
3824                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3825                                 status);
3826         } else {
3827                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3828                                   cp, sizeof(*cp));
3829
3830                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3831                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3832         }
3833
3834         mgmt_pending_remove(cmd);
3835 }
3836
3837 static int set_name_sync(struct hci_dev *hdev, void *data)
3838 {
3839         if (lmp_bredr_capable(hdev)) {
3840                 hci_update_name_sync(hdev);
3841                 hci_update_eir_sync(hdev);
3842         }
3843
3844         /* The name is stored in the scan response data and so
3845          * no need to update the advertising data here.
3846          */
3847         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3848                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3849
3850         return 0;
3851 }
3852
3853 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3854                           u16 len)
3855 {
3856         struct mgmt_cp_set_local_name *cp = data;
3857         struct mgmt_pending_cmd *cmd;
3858         int err;
3859
3860         bt_dev_dbg(hdev, "sock %p", sk);
3861
3862         hci_dev_lock(hdev);
3863
3864         /* If the old values are the same as the new ones just return a
3865          * direct command complete event.
3866          */
3867         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3868             !memcmp(hdev->short_name, cp->short_name,
3869                     sizeof(hdev->short_name))) {
3870                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3871                                         data, len);
3872                 goto failed;
3873         }
3874
3875         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3876
3877         if (!hdev_is_powered(hdev)) {
3878                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3879
3880                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3881                                         data, len);
3882                 if (err < 0)
3883                         goto failed;
3884
3885                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3886                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3887                 ext_info_changed(hdev, sk);
3888
3889                 goto failed;
3890         }
3891
3892         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3893         if (!cmd)
3894                 err = -ENOMEM;
3895         else
3896                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3897                                          set_name_complete);
3898
3899         if (err < 0) {
3900                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3901                                       MGMT_STATUS_FAILED);
3902
3903                 if (cmd)
3904                         mgmt_pending_remove(cmd);
3905
3906                 goto failed;
3907         }
3908
3909         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3910
3911 failed:
3912         hci_dev_unlock(hdev);
3913         return err;
3914 }
3915
3916 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3917 {
3918         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3919 }
3920
3921 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3922                           u16 len)
3923 {
3924         struct mgmt_cp_set_appearance *cp = data;
3925         u16 appearance;
3926         int err;
3927
3928         bt_dev_dbg(hdev, "sock %p", sk);
3929
3930         if (!lmp_le_capable(hdev))
3931                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3932                                        MGMT_STATUS_NOT_SUPPORTED);
3933
3934         appearance = le16_to_cpu(cp->appearance);
3935
3936         hci_dev_lock(hdev);
3937
3938         if (hdev->appearance != appearance) {
3939                 hdev->appearance = appearance;
3940
3941                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3942                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3943                                            NULL);
3944
3945                 ext_info_changed(hdev, sk);
3946         }
3947
3948         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3949                                 0);
3950
3951         hci_dev_unlock(hdev);
3952
3953         return err;
3954 }
3955
3956 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3957                                  void *data, u16 len)
3958 {
3959         struct mgmt_rp_get_phy_configuration rp;
3960
3961         bt_dev_dbg(hdev, "sock %p", sk);
3962
3963         hci_dev_lock(hdev);
3964
3965         memset(&rp, 0, sizeof(rp));
3966
3967         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3968         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3969         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3970
3971         hci_dev_unlock(hdev);
3972
3973         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3974                                  &rp, sizeof(rp));
3975 }
3976
3977 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3978 {
3979         struct mgmt_ev_phy_configuration_changed ev;
3980
3981         memset(&ev, 0, sizeof(ev));
3982
3983         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3984
3985         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3986                           sizeof(ev), skip);
3987 }
3988
3989 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3990 {
3991         struct mgmt_pending_cmd *cmd = data;
3992         struct sk_buff *skb = cmd->skb;
3993         u8 status = mgmt_status(err);
3994
3995         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3996                 return;
3997
3998         if (!status) {
3999                 if (!skb)
4000                         status = MGMT_STATUS_FAILED;
4001                 else if (IS_ERR(skb))
4002                         status = mgmt_status(PTR_ERR(skb));
4003                 else
4004                         status = mgmt_status(skb->data[0]);
4005         }
4006
4007         bt_dev_dbg(hdev, "status %d", status);
4008
4009         if (status) {
4010                 mgmt_cmd_status(cmd->sk, hdev->id,
4011                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
4012         } else {
4013                 mgmt_cmd_complete(cmd->sk, hdev->id,
4014                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
4015                                   NULL, 0);
4016
4017                 mgmt_phy_configuration_changed(hdev, cmd->sk);
4018         }
4019
4020         if (skb && !IS_ERR(skb))
4021                 kfree_skb(skb);
4022
4023         mgmt_pending_remove(cmd);
4024 }
4025
4026 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4027 {
4028         struct mgmt_pending_cmd *cmd = data;
4029         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4030         struct hci_cp_le_set_default_phy cp_phy;
4031         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
4032
4033         memset(&cp_phy, 0, sizeof(cp_phy));
4034
4035         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4036                 cp_phy.all_phys |= 0x01;
4037
4038         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4039                 cp_phy.all_phys |= 0x02;
4040
4041         if (selected_phys & MGMT_PHY_LE_1M_TX)
4042                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4043
4044         if (selected_phys & MGMT_PHY_LE_2M_TX)
4045                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4046
4047         if (selected_phys & MGMT_PHY_LE_CODED_TX)
4048                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4049
4050         if (selected_phys & MGMT_PHY_LE_1M_RX)
4051                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4052
4053         if (selected_phys & MGMT_PHY_LE_2M_RX)
4054                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4055
4056         if (selected_phys & MGMT_PHY_LE_CODED_RX)
4057                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4058
4059         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4060                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4061
4062         return 0;
4063 }
4064
4065 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4066                                  void *data, u16 len)
4067 {
4068         struct mgmt_cp_set_phy_configuration *cp = data;
4069         struct mgmt_pending_cmd *cmd;
4070         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4071         u16 pkt_type = (HCI_DH1 | HCI_DM1);
4072         bool changed = false;
4073         int err;
4074
4075         bt_dev_dbg(hdev, "sock %p", sk);
4076
4077         configurable_phys = get_configurable_phys(hdev);
4078         supported_phys = get_supported_phys(hdev);
4079         selected_phys = __le32_to_cpu(cp->selected_phys);
4080
4081         if (selected_phys & ~supported_phys)
4082                 return mgmt_cmd_status(sk, hdev->id,
4083                                        MGMT_OP_SET_PHY_CONFIGURATION,
4084                                        MGMT_STATUS_INVALID_PARAMS);
4085
4086         unconfigure_phys = supported_phys & ~configurable_phys;
4087
4088         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4089                 return mgmt_cmd_status(sk, hdev->id,
4090                                        MGMT_OP_SET_PHY_CONFIGURATION,
4091                                        MGMT_STATUS_INVALID_PARAMS);
4092
4093         if (selected_phys == get_selected_phys(hdev))
4094                 return mgmt_cmd_complete(sk, hdev->id,
4095                                          MGMT_OP_SET_PHY_CONFIGURATION,
4096                                          0, NULL, 0);
4097
4098         hci_dev_lock(hdev);
4099
4100         if (!hdev_is_powered(hdev)) {
4101                 err = mgmt_cmd_status(sk, hdev->id,
4102                                       MGMT_OP_SET_PHY_CONFIGURATION,
4103                                       MGMT_STATUS_REJECTED);
4104                 goto unlock;
4105         }
4106
4107         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4108                 err = mgmt_cmd_status(sk, hdev->id,
4109                                       MGMT_OP_SET_PHY_CONFIGURATION,
4110                                       MGMT_STATUS_BUSY);
4111                 goto unlock;
4112         }
4113
4114         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4115                 pkt_type |= (HCI_DH3 | HCI_DM3);
4116         else
4117                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4118
4119         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4120                 pkt_type |= (HCI_DH5 | HCI_DM5);
4121         else
4122                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4123
4124         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4125                 pkt_type &= ~HCI_2DH1;
4126         else
4127                 pkt_type |= HCI_2DH1;
4128
4129         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4130                 pkt_type &= ~HCI_2DH3;
4131         else
4132                 pkt_type |= HCI_2DH3;
4133
4134         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4135                 pkt_type &= ~HCI_2DH5;
4136         else
4137                 pkt_type |= HCI_2DH5;
4138
4139         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4140                 pkt_type &= ~HCI_3DH1;
4141         else
4142                 pkt_type |= HCI_3DH1;
4143
4144         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4145                 pkt_type &= ~HCI_3DH3;
4146         else
4147                 pkt_type |= HCI_3DH3;
4148
4149         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4150                 pkt_type &= ~HCI_3DH5;
4151         else
4152                 pkt_type |= HCI_3DH5;
4153
4154         if (pkt_type != hdev->pkt_type) {
4155                 hdev->pkt_type = pkt_type;
4156                 changed = true;
4157         }
4158
4159         if ((selected_phys & MGMT_PHY_LE_MASK) ==
4160             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4161                 if (changed)
4162                         mgmt_phy_configuration_changed(hdev, sk);
4163
4164                 err = mgmt_cmd_complete(sk, hdev->id,
4165                                         MGMT_OP_SET_PHY_CONFIGURATION,
4166                                         0, NULL, 0);
4167
4168                 goto unlock;
4169         }
4170
4171         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4172                                len);
4173         if (!cmd)
4174                 err = -ENOMEM;
4175         else
4176                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4177                                          set_default_phy_complete);
4178
4179         if (err < 0) {
4180                 err = mgmt_cmd_status(sk, hdev->id,
4181                                       MGMT_OP_SET_PHY_CONFIGURATION,
4182                                       MGMT_STATUS_FAILED);
4183
4184                 if (cmd)
4185                         mgmt_pending_remove(cmd);
4186         }
4187
4188 unlock:
4189         hci_dev_unlock(hdev);
4190
4191         return err;
4192 }
4193
4194 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4195                             u16 len)
4196 {
4197         int err = MGMT_STATUS_SUCCESS;
4198         struct mgmt_cp_set_blocked_keys *keys = data;
4199         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4200                                    sizeof(struct mgmt_blocked_key_info));
4201         u16 key_count, expected_len;
4202         int i;
4203
4204         bt_dev_dbg(hdev, "sock %p", sk);
4205
4206         key_count = __le16_to_cpu(keys->key_count);
4207         if (key_count > max_key_count) {
4208                 bt_dev_err(hdev, "too big key_count value %u", key_count);
4209                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4210                                        MGMT_STATUS_INVALID_PARAMS);
4211         }
4212
4213         expected_len = struct_size(keys, keys, key_count);
4214         if (expected_len != len) {
4215                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4216                            expected_len, len);
4217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4218                                        MGMT_STATUS_INVALID_PARAMS);
4219         }
4220
4221         hci_dev_lock(hdev);
4222
4223         hci_blocked_keys_clear(hdev);
4224
4225         for (i = 0; i < key_count; ++i) {
4226                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4227
4228                 if (!b) {
4229                         err = MGMT_STATUS_NO_RESOURCES;
4230                         break;
4231                 }
4232
4233                 b->type = keys->keys[i].type;
4234                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4235                 list_add_rcu(&b->list, &hdev->blocked_keys);
4236         }
4237         hci_dev_unlock(hdev);
4238
4239         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4240                                 err, NULL, 0);
4241 }
4242
4243 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4244                                void *data, u16 len)
4245 {
4246         struct mgmt_mode *cp = data;
4247         int err;
4248         bool changed = false;
4249
4250         bt_dev_dbg(hdev, "sock %p", sk);
4251
4252         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4253                 return mgmt_cmd_status(sk, hdev->id,
4254                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4255                                        MGMT_STATUS_NOT_SUPPORTED);
4256
4257         if (cp->val != 0x00 && cp->val != 0x01)
4258                 return mgmt_cmd_status(sk, hdev->id,
4259                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4260                                        MGMT_STATUS_INVALID_PARAMS);
4261
4262         hci_dev_lock(hdev);
4263
4264         if (hdev_is_powered(hdev) &&
4265             !!cp->val != hci_dev_test_flag(hdev,
4266                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
4267                 err = mgmt_cmd_status(sk, hdev->id,
4268                                       MGMT_OP_SET_WIDEBAND_SPEECH,
4269                                       MGMT_STATUS_REJECTED);
4270                 goto unlock;
4271         }
4272
4273         if (cp->val)
4274                 changed = !hci_dev_test_and_set_flag(hdev,
4275                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4276         else
4277                 changed = hci_dev_test_and_clear_flag(hdev,
4278                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4279
4280         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4281         if (err < 0)
4282                 goto unlock;
4283
4284         if (changed)
4285                 err = new_settings(hdev, sk);
4286
4287 unlock:
4288         hci_dev_unlock(hdev);
4289         return err;
4290 }
4291
4292 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4293                                void *data, u16 data_len)
4294 {
4295         char buf[20];
4296         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4297         u16 cap_len = 0;
4298         u8 flags = 0;
4299         u8 tx_power_range[2];
4300
4301         bt_dev_dbg(hdev, "sock %p", sk);
4302
4303         memset(&buf, 0, sizeof(buf));
4304
4305         hci_dev_lock(hdev);
4306
4307         /* When the Read Simple Pairing Options command is supported, then
4308          * the remote public key validation is supported.
4309          *
4310          * Alternatively, when Microsoft extensions are available, they can
4311          * indicate support for public key validation as well.
4312          */
4313         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4314                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
4315
4316         flags |= 0x02;          /* Remote public key validation (LE) */
4317
4318         /* When the Read Encryption Key Size command is supported, then the
4319          * encryption key size is enforced.
4320          */
4321         if (hdev->commands[20] & 0x10)
4322                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
4323
4324         flags |= 0x08;          /* Encryption key size enforcement (LE) */
4325
4326         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4327                                   &flags, 1);
4328
4329         /* When the Read Simple Pairing Options command is supported, then
4330          * also max encryption key size information is provided.
4331          */
4332         if (hdev->commands[41] & 0x08)
4333                 cap_len = eir_append_le16(rp->cap, cap_len,
4334                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
4335                                           hdev->max_enc_key_size);
4336
4337         cap_len = eir_append_le16(rp->cap, cap_len,
4338                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4339                                   SMP_MAX_ENC_KEY_SIZE);
4340
4341         /* Append the min/max LE tx power parameters if we were able to fetch
4342          * it from the controller
4343          */
4344         if (hdev->commands[38] & 0x80) {
4345                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4346                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4347                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4348                                           tx_power_range, 2);
4349         }
4350
4351         rp->cap_len = cpu_to_le16(cap_len);
4352
4353         hci_dev_unlock(hdev);
4354
4355         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4356                                  rp, sizeof(*rp) + cap_len);
4357 }
4358
4359 #ifdef CONFIG_BT_FEATURE_DEBUG
4360 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4361 static const u8 debug_uuid[16] = {
4362         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4363         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4364 };
4365 #endif
4366
4367 /* 330859bc-7506-492d-9370-9a6f0614037f */
4368 static const u8 quality_report_uuid[16] = {
4369         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4370         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4371 };
4372
4373 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4374 static const u8 offload_codecs_uuid[16] = {
4375         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4376         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4377 };
4378
4379 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4380 static const u8 le_simultaneous_roles_uuid[16] = {
4381         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4382         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4383 };
4384
4385 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
4386 static const u8 rpa_resolution_uuid[16] = {
4387         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4388         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4389 };
4390
4391 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4392 static const u8 iso_socket_uuid[16] = {
4393         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4394         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4395 };
4396
4397 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4398 static const u8 mgmt_mesh_uuid[16] = {
4399         0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4400         0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4401 };
4402
4403 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4404                                   void *data, u16 data_len)
4405 {
4406         struct mgmt_rp_read_exp_features_info *rp;
4407         size_t len;
4408         u16 idx = 0;
4409         u32 flags;
4410         int status;
4411
4412         bt_dev_dbg(hdev, "sock %p", sk);
4413
4414         /* Enough space for 7 features */
4415         len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4416         rp = kzalloc(len, GFP_KERNEL);
4417         if (!rp)
4418                 return -ENOMEM;
4419
4420 #ifdef CONFIG_BT_FEATURE_DEBUG
4421         if (!hdev) {
4422                 flags = bt_dbg_get() ? BIT(0) : 0;
4423
4424                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4425                 rp->features[idx].flags = cpu_to_le32(flags);
4426                 idx++;
4427         }
4428 #endif
4429
4430         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4431                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4432                         flags = BIT(0);
4433                 else
4434                         flags = 0;
4435
4436                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4437                 rp->features[idx].flags = cpu_to_le32(flags);
4438                 idx++;
4439         }
4440
4441         if (hdev && ll_privacy_capable(hdev)) {
4442                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4443                         flags = BIT(0) | BIT(1);
4444                 else
4445                         flags = BIT(1);
4446
4447                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4448                 rp->features[idx].flags = cpu_to_le32(flags);
4449                 idx++;
4450         }
4451
4452         if (hdev && (aosp_has_quality_report(hdev) ||
4453                      hdev->set_quality_report)) {
4454                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4455                         flags = BIT(0);
4456                 else
4457                         flags = 0;
4458
4459                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4460                 rp->features[idx].flags = cpu_to_le32(flags);
4461                 idx++;
4462         }
4463
4464         if (hdev && hdev->get_data_path_id) {
4465                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4466                         flags = BIT(0);
4467                 else
4468                         flags = 0;
4469
4470                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4471                 rp->features[idx].flags = cpu_to_le32(flags);
4472                 idx++;
4473         }
4474
4475         if (IS_ENABLED(CONFIG_BT_LE)) {
4476                 flags = iso_enabled() ? BIT(0) : 0;
4477                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4478                 rp->features[idx].flags = cpu_to_le32(flags);
4479                 idx++;
4480         }
4481
4482         if (hdev && lmp_le_capable(hdev)) {
4483                 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4484                         flags = BIT(0);
4485                 else
4486                         flags = 0;
4487
4488                 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4489                 rp->features[idx].flags = cpu_to_le32(flags);
4490                 idx++;
4491         }
4492
4493         rp->feature_count = cpu_to_le16(idx);
4494
4495         /* After reading the experimental features information, enable
4496          * the events to update client on any future change.
4497          */
4498         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4499
4500         status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4501                                    MGMT_OP_READ_EXP_FEATURES_INFO,
4502                                    0, rp, sizeof(*rp) + (20 * idx));
4503
4504         kfree(rp);
4505         return status;
4506 }
4507
4508 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4509                                           struct sock *skip)
4510 {
4511         struct mgmt_ev_exp_feature_changed ev;
4512
4513         memset(&ev, 0, sizeof(ev));
4514         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4515         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4516
4517         // Do we need to be atomic with the conn_flags?
4518         if (enabled && privacy_mode_capable(hdev))
4519                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4520         else
4521                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4522
4523         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4524                                   &ev, sizeof(ev),
4525                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4526
4527 }
4528
4529 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4530                                bool enabled, struct sock *skip)
4531 {
4532         struct mgmt_ev_exp_feature_changed ev;
4533
4534         memset(&ev, 0, sizeof(ev));
4535         memcpy(ev.uuid, uuid, 16);
4536         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4537
4538         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4539                                   &ev, sizeof(ev),
4540                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4541 }
4542
4543 #define EXP_FEAT(_uuid, _set_func)      \
4544 {                                       \
4545         .uuid = _uuid,                  \
4546         .set_func = _set_func,          \
4547 }
4548
4549 /* The zero key uuid is special. Multiple exp features are set through it. */
4550 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4551                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4552 {
4553         struct mgmt_rp_set_exp_feature rp;
4554
4555         memset(rp.uuid, 0, 16);
4556         rp.flags = cpu_to_le32(0);
4557
4558 #ifdef CONFIG_BT_FEATURE_DEBUG
4559         if (!hdev) {
4560                 bool changed = bt_dbg_get();
4561
4562                 bt_dbg_set(false);
4563
4564                 if (changed)
4565                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4566         }
4567 #endif
4568
4569         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4570                 bool changed;
4571
4572                 changed = hci_dev_test_and_clear_flag(hdev,
4573                                                       HCI_ENABLE_LL_PRIVACY);
4574                 if (changed)
4575                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4576                                             sk);
4577         }
4578
4579         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4580
4581         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4582                                  MGMT_OP_SET_EXP_FEATURE, 0,
4583                                  &rp, sizeof(rp));
4584 }
4585
4586 #ifdef CONFIG_BT_FEATURE_DEBUG
4587 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4588                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4589 {
4590         struct mgmt_rp_set_exp_feature rp;
4591
4592         bool val, changed;
4593         int err;
4594
4595         /* Command requires to use the non-controller index */
4596         if (hdev)
4597                 return mgmt_cmd_status(sk, hdev->id,
4598                                        MGMT_OP_SET_EXP_FEATURE,
4599                                        MGMT_STATUS_INVALID_INDEX);
4600
4601         /* Parameters are limited to a single octet */
4602         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4603                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4604                                        MGMT_OP_SET_EXP_FEATURE,
4605                                        MGMT_STATUS_INVALID_PARAMS);
4606
4607         /* Only boolean on/off is supported */
4608         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4609                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4610                                        MGMT_OP_SET_EXP_FEATURE,
4611                                        MGMT_STATUS_INVALID_PARAMS);
4612
4613         val = !!cp->param[0];
4614         changed = val ? !bt_dbg_get() : bt_dbg_get();
4615         bt_dbg_set(val);
4616
4617         memcpy(rp.uuid, debug_uuid, 16);
4618         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4619
4620         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4621
4622         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4623                                 MGMT_OP_SET_EXP_FEATURE, 0,
4624                                 &rp, sizeof(rp));
4625
4626         if (changed)
4627                 exp_feature_changed(hdev, debug_uuid, val, sk);
4628
4629         return err;
4630 }
4631 #endif
4632
4633 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4634                               struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4635 {
4636         struct mgmt_rp_set_exp_feature rp;
4637         bool val, changed;
4638         int err;
4639
4640         /* Command requires to use the controller index */
4641         if (!hdev)
4642                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4643                                        MGMT_OP_SET_EXP_FEATURE,
4644                                        MGMT_STATUS_INVALID_INDEX);
4645
4646         /* Parameters are limited to a single octet */
4647         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4648                 return mgmt_cmd_status(sk, hdev->id,
4649                                        MGMT_OP_SET_EXP_FEATURE,
4650                                        MGMT_STATUS_INVALID_PARAMS);
4651
4652         /* Only boolean on/off is supported */
4653         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4654                 return mgmt_cmd_status(sk, hdev->id,
4655                                        MGMT_OP_SET_EXP_FEATURE,
4656                                        MGMT_STATUS_INVALID_PARAMS);
4657
4658         val = !!cp->param[0];
4659
4660         if (val) {
4661                 changed = !hci_dev_test_and_set_flag(hdev,
4662                                                      HCI_MESH_EXPERIMENTAL);
4663         } else {
4664                 hci_dev_clear_flag(hdev, HCI_MESH);
4665                 changed = hci_dev_test_and_clear_flag(hdev,
4666                                                       HCI_MESH_EXPERIMENTAL);
4667         }
4668
4669         memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4670         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4671
4672         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4673
4674         err = mgmt_cmd_complete(sk, hdev->id,
4675                                 MGMT_OP_SET_EXP_FEATURE, 0,
4676                                 &rp, sizeof(rp));
4677
4678         if (changed)
4679                 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4680
4681         return err;
4682 }
4683
4684 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4685                                    struct mgmt_cp_set_exp_feature *cp,
4686                                    u16 data_len)
4687 {
4688         struct mgmt_rp_set_exp_feature rp;
4689         bool val, changed;
4690         int err;
4691         u32 flags;
4692
4693         /* Command requires to use the controller index */
4694         if (!hdev)
4695                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4696                                        MGMT_OP_SET_EXP_FEATURE,
4697                                        MGMT_STATUS_INVALID_INDEX);
4698
4699         /* Changes can only be made when controller is powered down */
4700         if (hdev_is_powered(hdev))
4701                 return mgmt_cmd_status(sk, hdev->id,
4702                                        MGMT_OP_SET_EXP_FEATURE,
4703                                        MGMT_STATUS_REJECTED);
4704
4705         /* Parameters are limited to a single octet */
4706         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4707                 return mgmt_cmd_status(sk, hdev->id,
4708                                        MGMT_OP_SET_EXP_FEATURE,
4709                                        MGMT_STATUS_INVALID_PARAMS);
4710
4711         /* Only boolean on/off is supported */
4712         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4713                 return mgmt_cmd_status(sk, hdev->id,
4714                                        MGMT_OP_SET_EXP_FEATURE,
4715                                        MGMT_STATUS_INVALID_PARAMS);
4716
4717         val = !!cp->param[0];
4718
4719         if (val) {
4720                 changed = !hci_dev_test_and_set_flag(hdev,
4721                                                      HCI_ENABLE_LL_PRIVACY);
4722                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4723
4724                 /* Enable LL privacy + supported settings changed */
4725                 flags = BIT(0) | BIT(1);
4726         } else {
4727                 changed = hci_dev_test_and_clear_flag(hdev,
4728                                                       HCI_ENABLE_LL_PRIVACY);
4729
4730                 /* Disable LL privacy + supported settings changed */
4731                 flags = BIT(1);
4732         }
4733
4734         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4735         rp.flags = cpu_to_le32(flags);
4736
4737         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4738
4739         err = mgmt_cmd_complete(sk, hdev->id,
4740                                 MGMT_OP_SET_EXP_FEATURE, 0,
4741                                 &rp, sizeof(rp));
4742
4743         if (changed)
4744                 exp_ll_privacy_feature_changed(val, hdev, sk);
4745
4746         return err;
4747 }
4748
4749 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4750                                    struct mgmt_cp_set_exp_feature *cp,
4751                                    u16 data_len)
4752 {
4753         struct mgmt_rp_set_exp_feature rp;
4754         bool val, changed;
4755         int err;
4756
4757         /* Command requires to use a valid controller index */
4758         if (!hdev)
4759                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4760                                        MGMT_OP_SET_EXP_FEATURE,
4761                                        MGMT_STATUS_INVALID_INDEX);
4762
4763         /* Parameters are limited to a single octet */
4764         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4765                 return mgmt_cmd_status(sk, hdev->id,
4766                                        MGMT_OP_SET_EXP_FEATURE,
4767                                        MGMT_STATUS_INVALID_PARAMS);
4768
4769         /* Only boolean on/off is supported */
4770         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4771                 return mgmt_cmd_status(sk, hdev->id,
4772                                        MGMT_OP_SET_EXP_FEATURE,
4773                                        MGMT_STATUS_INVALID_PARAMS);
4774
4775         hci_req_sync_lock(hdev);
4776
4777         val = !!cp->param[0];
4778         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4779
4780         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4781                 err = mgmt_cmd_status(sk, hdev->id,
4782                                       MGMT_OP_SET_EXP_FEATURE,
4783                                       MGMT_STATUS_NOT_SUPPORTED);
4784                 goto unlock_quality_report;
4785         }
4786
4787         if (changed) {
4788                 if (hdev->set_quality_report)
4789                         err = hdev->set_quality_report(hdev, val);
4790                 else
4791                         err = aosp_set_quality_report(hdev, val);
4792
4793                 if (err) {
4794                         err = mgmt_cmd_status(sk, hdev->id,
4795                                               MGMT_OP_SET_EXP_FEATURE,
4796                                               MGMT_STATUS_FAILED);
4797                         goto unlock_quality_report;
4798                 }
4799
4800                 if (val)
4801                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4802                 else
4803                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4804         }
4805
4806         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4807
4808         memcpy(rp.uuid, quality_report_uuid, 16);
4809         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4810         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4811
4812         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4813                                 &rp, sizeof(rp));
4814
4815         if (changed)
4816                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4817
4818 unlock_quality_report:
4819         hci_req_sync_unlock(hdev);
4820         return err;
4821 }
4822
4823 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4824                                   struct mgmt_cp_set_exp_feature *cp,
4825                                   u16 data_len)
4826 {
4827         bool val, changed;
4828         int err;
4829         struct mgmt_rp_set_exp_feature rp;
4830
4831         /* Command requires to use a valid controller index */
4832         if (!hdev)
4833                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4834                                        MGMT_OP_SET_EXP_FEATURE,
4835                                        MGMT_STATUS_INVALID_INDEX);
4836
4837         /* Parameters are limited to a single octet */
4838         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4839                 return mgmt_cmd_status(sk, hdev->id,
4840                                        MGMT_OP_SET_EXP_FEATURE,
4841                                        MGMT_STATUS_INVALID_PARAMS);
4842
4843         /* Only boolean on/off is supported */
4844         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4845                 return mgmt_cmd_status(sk, hdev->id,
4846                                        MGMT_OP_SET_EXP_FEATURE,
4847                                        MGMT_STATUS_INVALID_PARAMS);
4848
4849         val = !!cp->param[0];
4850         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4851
4852         if (!hdev->get_data_path_id) {
4853                 return mgmt_cmd_status(sk, hdev->id,
4854                                        MGMT_OP_SET_EXP_FEATURE,
4855                                        MGMT_STATUS_NOT_SUPPORTED);
4856         }
4857
4858         if (changed) {
4859                 if (val)
4860                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4861                 else
4862                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4863         }
4864
4865         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4866                     val, changed);
4867
4868         memcpy(rp.uuid, offload_codecs_uuid, 16);
4869         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4870         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4871         err = mgmt_cmd_complete(sk, hdev->id,
4872                                 MGMT_OP_SET_EXP_FEATURE, 0,
4873                                 &rp, sizeof(rp));
4874
4875         if (changed)
4876                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4877
4878         return err;
4879 }
4880
4881 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4882                                           struct mgmt_cp_set_exp_feature *cp,
4883                                           u16 data_len)
4884 {
4885         bool val, changed;
4886         int err;
4887         struct mgmt_rp_set_exp_feature rp;
4888
4889         /* Command requires to use a valid controller index */
4890         if (!hdev)
4891                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4892                                        MGMT_OP_SET_EXP_FEATURE,
4893                                        MGMT_STATUS_INVALID_INDEX);
4894
4895         /* Parameters are limited to a single octet */
4896         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4897                 return mgmt_cmd_status(sk, hdev->id,
4898                                        MGMT_OP_SET_EXP_FEATURE,
4899                                        MGMT_STATUS_INVALID_PARAMS);
4900
4901         /* Only boolean on/off is supported */
4902         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4903                 return mgmt_cmd_status(sk, hdev->id,
4904                                        MGMT_OP_SET_EXP_FEATURE,
4905                                        MGMT_STATUS_INVALID_PARAMS);
4906
4907         val = !!cp->param[0];
4908         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4909
4910         if (!hci_dev_le_state_simultaneous(hdev)) {
4911                 return mgmt_cmd_status(sk, hdev->id,
4912                                        MGMT_OP_SET_EXP_FEATURE,
4913                                        MGMT_STATUS_NOT_SUPPORTED);
4914         }
4915
4916         if (changed) {
4917                 if (val)
4918                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4919                 else
4920                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4921         }
4922
4923         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4924                     val, changed);
4925
4926         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4927         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4928         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4929         err = mgmt_cmd_complete(sk, hdev->id,
4930                                 MGMT_OP_SET_EXP_FEATURE, 0,
4931                                 &rp, sizeof(rp));
4932
4933         if (changed)
4934                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4935
4936         return err;
4937 }
4938
4939 #ifdef CONFIG_BT_LE
4940 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4941                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4942 {
4943         struct mgmt_rp_set_exp_feature rp;
4944         bool val, changed = false;
4945         int err;
4946
4947         /* Command requires to use the non-controller index */
4948         if (hdev)
4949                 return mgmt_cmd_status(sk, hdev->id,
4950                                        MGMT_OP_SET_EXP_FEATURE,
4951                                        MGMT_STATUS_INVALID_INDEX);
4952
4953         /* Parameters are limited to a single octet */
4954         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4955                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4956                                        MGMT_OP_SET_EXP_FEATURE,
4957                                        MGMT_STATUS_INVALID_PARAMS);
4958
4959         /* Only boolean on/off is supported */
4960         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4961                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4962                                        MGMT_OP_SET_EXP_FEATURE,
4963                                        MGMT_STATUS_INVALID_PARAMS);
4964
4965         val = cp->param[0] ? true : false;
4966         if (val)
4967                 err = iso_init();
4968         else
4969                 err = iso_exit();
4970
4971         if (!err)
4972                 changed = true;
4973
4974         memcpy(rp.uuid, iso_socket_uuid, 16);
4975         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4976
4977         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4978
4979         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4980                                 MGMT_OP_SET_EXP_FEATURE, 0,
4981                                 &rp, sizeof(rp));
4982
4983         if (changed)
4984                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4985
4986         return err;
4987 }
4988 #endif
4989
4990 static const struct mgmt_exp_feature {
4991         const u8 *uuid;
4992         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4993                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4994 } exp_features[] = {
4995         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4996 #ifdef CONFIG_BT_FEATURE_DEBUG
4997         EXP_FEAT(debug_uuid, set_debug_func),
4998 #endif
4999         EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
5000         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
5001         EXP_FEAT(quality_report_uuid, set_quality_report_func),
5002         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
5003         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
5004 #ifdef CONFIG_BT_LE
5005         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
5006 #endif
5007
5008         /* end with a null feature */
5009         EXP_FEAT(NULL, NULL)
5010 };
5011
5012 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5013                            void *data, u16 data_len)
5014 {
5015         struct mgmt_cp_set_exp_feature *cp = data;
5016         size_t i = 0;
5017
5018         bt_dev_dbg(hdev, "sock %p", sk);
5019
5020         for (i = 0; exp_features[i].uuid; i++) {
5021                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5022                         return exp_features[i].set_func(sk, hdev, cp, data_len);
5023         }
5024
5025         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5026                                MGMT_OP_SET_EXP_FEATURE,
5027                                MGMT_STATUS_NOT_SUPPORTED);
5028 }
5029
5030 static u32 get_params_flags(struct hci_dev *hdev,
5031                             struct hci_conn_params *params)
5032 {
5033         u32 flags = hdev->conn_flags;
5034
5035         /* Devices using RPAs can only be programmed in the acceptlist if
5036          * LL Privacy has been enable otherwise they cannot mark
5037          * HCI_CONN_FLAG_REMOTE_WAKEUP.
5038          */
5039         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
5040             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
5041                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
5042
5043         return flags;
5044 }
5045
5046 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5047                             u16 data_len)
5048 {
5049         struct mgmt_cp_get_device_flags *cp = data;
5050         struct mgmt_rp_get_device_flags rp;
5051         struct bdaddr_list_with_flags *br_params;
5052         struct hci_conn_params *params;
5053         u32 supported_flags;
5054         u32 current_flags = 0;
5055         u8 status = MGMT_STATUS_INVALID_PARAMS;
5056
5057         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5058                    &cp->addr.bdaddr, cp->addr.type);
5059
5060         hci_dev_lock(hdev);
5061
5062         supported_flags = hdev->conn_flags;
5063
5064         memset(&rp, 0, sizeof(rp));
5065
5066         if (cp->addr.type == BDADDR_BREDR) {
5067                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5068                                                               &cp->addr.bdaddr,
5069                                                               cp->addr.type);
5070                 if (!br_params)
5071                         goto done;
5072
5073                 current_flags = br_params->flags;
5074         } else {
5075                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5076                                                 le_addr_type(cp->addr.type));
5077                 if (!params)
5078                         goto done;
5079
5080                 supported_flags = get_params_flags(hdev, params);
5081                 current_flags = params->flags;
5082         }
5083
5084         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5085         rp.addr.type = cp->addr.type;
5086         rp.supported_flags = cpu_to_le32(supported_flags);
5087         rp.current_flags = cpu_to_le32(current_flags);
5088
5089         status = MGMT_STATUS_SUCCESS;
5090
5091 done:
5092         hci_dev_unlock(hdev);
5093
5094         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5095                                 &rp, sizeof(rp));
5096 }
5097
5098 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5099                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5100                                  u32 supported_flags, u32 current_flags)
5101 {
5102         struct mgmt_ev_device_flags_changed ev;
5103
5104         bacpy(&ev.addr.bdaddr, bdaddr);
5105         ev.addr.type = bdaddr_type;
5106         ev.supported_flags = cpu_to_le32(supported_flags);
5107         ev.current_flags = cpu_to_le32(current_flags);
5108
5109         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5110 }
5111
5112 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5113                             u16 len)
5114 {
5115         struct mgmt_cp_set_device_flags *cp = data;
5116         struct bdaddr_list_with_flags *br_params;
5117         struct hci_conn_params *params;
5118         u8 status = MGMT_STATUS_INVALID_PARAMS;
5119         u32 supported_flags;
5120         u32 current_flags = __le32_to_cpu(cp->current_flags);
5121
5122         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5123                    &cp->addr.bdaddr, cp->addr.type, current_flags);
5124
5125         // We should take hci_dev_lock() early, I think.. conn_flags can change
5126         supported_flags = hdev->conn_flags;
5127
5128         if ((supported_flags | current_flags) != supported_flags) {
5129                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5130                             current_flags, supported_flags);
5131                 goto done;
5132         }
5133
5134         hci_dev_lock(hdev);
5135
5136         if (cp->addr.type == BDADDR_BREDR) {
5137                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5138                                                               &cp->addr.bdaddr,
5139                                                               cp->addr.type);
5140
5141                 if (br_params) {
5142                         br_params->flags = current_flags;
5143                         status = MGMT_STATUS_SUCCESS;
5144                 } else {
5145                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5146                                     &cp->addr.bdaddr, cp->addr.type);
5147                 }
5148
5149                 goto unlock;
5150         }
5151
5152         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5153                                         le_addr_type(cp->addr.type));
5154         if (!params) {
5155                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5156                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5157                 goto unlock;
5158         }
5159
5160         supported_flags = get_params_flags(hdev, params);
5161
5162         if ((supported_flags | current_flags) != supported_flags) {
5163                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5164                             current_flags, supported_flags);
5165                 goto unlock;
5166         }
5167
5168         params->flags = current_flags;
5169         status = MGMT_STATUS_SUCCESS;
5170
5171         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5172          * has been set.
5173          */
5174         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5175                 hci_update_passive_scan(hdev);
5176
5177 unlock:
5178         hci_dev_unlock(hdev);
5179
5180 done:
5181         if (status == MGMT_STATUS_SUCCESS)
5182                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5183                                      supported_flags, current_flags);
5184
5185         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5186                                  &cp->addr, sizeof(cp->addr));
5187 }
5188
5189 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5190                                    u16 handle)
5191 {
5192         struct mgmt_ev_adv_monitor_added ev;
5193
5194         ev.monitor_handle = cpu_to_le16(handle);
5195
5196         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5197 }
5198
5199 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
5200 {
5201         struct mgmt_ev_adv_monitor_removed ev;
5202         struct mgmt_pending_cmd *cmd;
5203         struct sock *sk_skip = NULL;
5204         struct mgmt_cp_remove_adv_monitor *cp;
5205
5206         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5207         if (cmd) {
5208                 cp = cmd->param;
5209
5210                 if (cp->monitor_handle)
5211                         sk_skip = cmd->sk;
5212         }
5213
5214         ev.monitor_handle = cpu_to_le16(handle);
5215
5216         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
5217 }
5218
5219 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5220                                  void *data, u16 len)
5221 {
5222         struct adv_monitor *monitor = NULL;
5223         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5224         int handle, err;
5225         size_t rp_size = 0;
5226         __u32 supported = 0;
5227         __u32 enabled = 0;
5228         __u16 num_handles = 0;
5229         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5230
5231         BT_DBG("request for %s", hdev->name);
5232
5233         hci_dev_lock(hdev);
5234
5235         if (msft_monitor_supported(hdev))
5236                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5237
5238         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5239                 handles[num_handles++] = monitor->handle;
5240
5241         hci_dev_unlock(hdev);
5242
5243         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5244         rp = kmalloc(rp_size, GFP_KERNEL);
5245         if (!rp)
5246                 return -ENOMEM;
5247
5248         /* All supported features are currently enabled */
5249         enabled = supported;
5250
5251         rp->supported_features = cpu_to_le32(supported);
5252         rp->enabled_features = cpu_to_le32(enabled);
5253         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5254         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5255         rp->num_handles = cpu_to_le16(num_handles);
5256         if (num_handles)
5257                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5258
5259         err = mgmt_cmd_complete(sk, hdev->id,
5260                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5261                                 MGMT_STATUS_SUCCESS, rp, rp_size);
5262
5263         kfree(rp);
5264
5265         return err;
5266 }
5267
5268 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5269                                                    void *data, int status)
5270 {
5271         struct mgmt_rp_add_adv_patterns_monitor rp;
5272         struct mgmt_pending_cmd *cmd = data;
5273         struct adv_monitor *monitor = cmd->user_data;
5274
5275         hci_dev_lock(hdev);
5276
5277         rp.monitor_handle = cpu_to_le16(monitor->handle);
5278
5279         if (!status) {
5280                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5281                 hdev->adv_monitors_cnt++;
5282                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5283                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
5284                 hci_update_passive_scan(hdev);
5285         }
5286
5287         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5288                           mgmt_status(status), &rp, sizeof(rp));
5289         mgmt_pending_remove(cmd);
5290
5291         hci_dev_unlock(hdev);
5292         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5293                    rp.monitor_handle, status);
5294 }
5295
5296 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5297 {
5298         struct mgmt_pending_cmd *cmd = data;
5299         struct adv_monitor *monitor = cmd->user_data;
5300
5301         return hci_add_adv_monitor(hdev, monitor);
5302 }
5303
5304 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5305                                       struct adv_monitor *m, u8 status,
5306                                       void *data, u16 len, u16 op)
5307 {
5308         struct mgmt_pending_cmd *cmd;
5309         int err;
5310
5311         hci_dev_lock(hdev);
5312
5313         if (status)
5314                 goto unlock;
5315
5316         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5317             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5318             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5319             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5320                 status = MGMT_STATUS_BUSY;
5321                 goto unlock;
5322         }
5323
5324         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5325         if (!cmd) {
5326                 status = MGMT_STATUS_NO_RESOURCES;
5327                 goto unlock;
5328         }
5329
5330         cmd->user_data = m;
5331         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5332                                  mgmt_add_adv_patterns_monitor_complete);
5333         if (err) {
5334                 if (err == -ENOMEM)
5335                         status = MGMT_STATUS_NO_RESOURCES;
5336                 else
5337                         status = MGMT_STATUS_FAILED;
5338
5339                 goto unlock;
5340         }
5341
5342         hci_dev_unlock(hdev);
5343
5344         return 0;
5345
5346 unlock:
5347         hci_free_adv_monitor(hdev, m);
5348         hci_dev_unlock(hdev);
5349         return mgmt_cmd_status(sk, hdev->id, op, status);
5350 }
5351
5352 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5353                                    struct mgmt_adv_rssi_thresholds *rssi)
5354 {
5355         if (rssi) {
5356                 m->rssi.low_threshold = rssi->low_threshold;
5357                 m->rssi.low_threshold_timeout =
5358                     __le16_to_cpu(rssi->low_threshold_timeout);
5359                 m->rssi.high_threshold = rssi->high_threshold;
5360                 m->rssi.high_threshold_timeout =
5361                     __le16_to_cpu(rssi->high_threshold_timeout);
5362                 m->rssi.sampling_period = rssi->sampling_period;
5363         } else {
5364                 /* Default values. These numbers are the least constricting
5365                  * parameters for MSFT API to work, so it behaves as if there
5366                  * are no rssi parameter to consider. May need to be changed
5367                  * if other API are to be supported.
5368                  */
5369                 m->rssi.low_threshold = -127;
5370                 m->rssi.low_threshold_timeout = 60;
5371                 m->rssi.high_threshold = -127;
5372                 m->rssi.high_threshold_timeout = 0;
5373                 m->rssi.sampling_period = 0;
5374         }
5375 }
5376
5377 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5378                                     struct mgmt_adv_pattern *patterns)
5379 {
5380         u8 offset = 0, length = 0;
5381         struct adv_pattern *p = NULL;
5382         int i;
5383
5384         for (i = 0; i < pattern_count; i++) {
5385                 offset = patterns[i].offset;
5386                 length = patterns[i].length;
5387                 if (offset >= HCI_MAX_AD_LENGTH ||
5388                     length > HCI_MAX_AD_LENGTH ||
5389                     (offset + length) > HCI_MAX_AD_LENGTH)
5390                         return MGMT_STATUS_INVALID_PARAMS;
5391
5392                 p = kmalloc(sizeof(*p), GFP_KERNEL);
5393                 if (!p)
5394                         return MGMT_STATUS_NO_RESOURCES;
5395
5396                 p->ad_type = patterns[i].ad_type;
5397                 p->offset = patterns[i].offset;
5398                 p->length = patterns[i].length;
5399                 memcpy(p->value, patterns[i].value, p->length);
5400
5401                 INIT_LIST_HEAD(&p->list);
5402                 list_add(&p->list, &m->patterns);
5403         }
5404
5405         return MGMT_STATUS_SUCCESS;
5406 }
5407
5408 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5409                                     void *data, u16 len)
5410 {
5411         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5412         struct adv_monitor *m = NULL;
5413         u8 status = MGMT_STATUS_SUCCESS;
5414         size_t expected_size = sizeof(*cp);
5415
5416         BT_DBG("request for %s", hdev->name);
5417
5418         if (len <= sizeof(*cp)) {
5419                 status = MGMT_STATUS_INVALID_PARAMS;
5420                 goto done;
5421         }
5422
5423         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5424         if (len != expected_size) {
5425                 status = MGMT_STATUS_INVALID_PARAMS;
5426                 goto done;
5427         }
5428
5429         m = kzalloc(sizeof(*m), GFP_KERNEL);
5430         if (!m) {
5431                 status = MGMT_STATUS_NO_RESOURCES;
5432                 goto done;
5433         }
5434
5435         INIT_LIST_HEAD(&m->patterns);
5436
5437         parse_adv_monitor_rssi(m, NULL);
5438         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5439
5440 done:
5441         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5442                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5443 }
5444
5445 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5446                                          void *data, u16 len)
5447 {
5448         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5449         struct adv_monitor *m = NULL;
5450         u8 status = MGMT_STATUS_SUCCESS;
5451         size_t expected_size = sizeof(*cp);
5452
5453         BT_DBG("request for %s", hdev->name);
5454
5455         if (len <= sizeof(*cp)) {
5456                 status = MGMT_STATUS_INVALID_PARAMS;
5457                 goto done;
5458         }
5459
5460         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5461         if (len != expected_size) {
5462                 status = MGMT_STATUS_INVALID_PARAMS;
5463                 goto done;
5464         }
5465
5466         m = kzalloc(sizeof(*m), GFP_KERNEL);
5467         if (!m) {
5468                 status = MGMT_STATUS_NO_RESOURCES;
5469                 goto done;
5470         }
5471
5472         INIT_LIST_HEAD(&m->patterns);
5473
5474         parse_adv_monitor_rssi(m, &cp->rssi);
5475         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5476
5477 done:
5478         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5479                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5480 }
5481
5482 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5483                                              void *data, int status)
5484 {
5485         struct mgmt_rp_remove_adv_monitor rp;
5486         struct mgmt_pending_cmd *cmd = data;
5487         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5488
5489         hci_dev_lock(hdev);
5490
5491         rp.monitor_handle = cp->monitor_handle;
5492
5493         if (!status)
5494                 hci_update_passive_scan(hdev);
5495
5496         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5497                           mgmt_status(status), &rp, sizeof(rp));
5498         mgmt_pending_remove(cmd);
5499
5500         hci_dev_unlock(hdev);
5501         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5502                    rp.monitor_handle, status);
5503 }
5504
5505 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5506 {
5507         struct mgmt_pending_cmd *cmd = data;
5508         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5509         u16 handle = __le16_to_cpu(cp->monitor_handle);
5510
5511         if (!handle)
5512                 return hci_remove_all_adv_monitor(hdev);
5513
5514         return hci_remove_single_adv_monitor(hdev, handle);
5515 }
5516
5517 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5518                               void *data, u16 len)
5519 {
5520         struct mgmt_pending_cmd *cmd;
5521         int err, status;
5522
5523         hci_dev_lock(hdev);
5524
5525         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5526             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5527             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5528             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5529                 status = MGMT_STATUS_BUSY;
5530                 goto unlock;
5531         }
5532
5533         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5534         if (!cmd) {
5535                 status = MGMT_STATUS_NO_RESOURCES;
5536                 goto unlock;
5537         }
5538
5539         err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
5540                                  mgmt_remove_adv_monitor_complete);
5541
5542         if (err) {
5543                 mgmt_pending_remove(cmd);
5544
5545                 if (err == -ENOMEM)
5546                         status = MGMT_STATUS_NO_RESOURCES;
5547                 else
5548                         status = MGMT_STATUS_FAILED;
5549
5550                 goto unlock;
5551         }
5552
5553         hci_dev_unlock(hdev);
5554
5555         return 0;
5556
5557 unlock:
5558         hci_dev_unlock(hdev);
5559         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5560                                status);
5561 }
5562
5563 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5564 {
5565         struct mgmt_rp_read_local_oob_data mgmt_rp;
5566         size_t rp_size = sizeof(mgmt_rp);
5567         struct mgmt_pending_cmd *cmd = data;
5568         struct sk_buff *skb = cmd->skb;
5569         u8 status = mgmt_status(err);
5570
5571         if (!status) {
5572                 if (!skb)
5573                         status = MGMT_STATUS_FAILED;
5574                 else if (IS_ERR(skb))
5575                         status = mgmt_status(PTR_ERR(skb));
5576                 else
5577                         status = mgmt_status(skb->data[0]);
5578         }
5579
5580         bt_dev_dbg(hdev, "status %d", status);
5581
5582         if (status) {
5583                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5584                 goto remove;
5585         }
5586
5587         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5588
5589         if (!bredr_sc_enabled(hdev)) {
5590                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5591
5592                 if (skb->len < sizeof(*rp)) {
5593                         mgmt_cmd_status(cmd->sk, hdev->id,
5594                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5595                                         MGMT_STATUS_FAILED);
5596                         goto remove;
5597                 }
5598
5599                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5600                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5601
5602                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5603         } else {
5604                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5605
5606                 if (skb->len < sizeof(*rp)) {
5607                         mgmt_cmd_status(cmd->sk, hdev->id,
5608                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5609                                         MGMT_STATUS_FAILED);
5610                         goto remove;
5611                 }
5612
5613                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5614                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5615
5616                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5617                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5618         }
5619
5620         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5621                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5622
5623 remove:
5624         if (skb && !IS_ERR(skb))
5625                 kfree_skb(skb);
5626
5627         mgmt_pending_free(cmd);
5628 }
5629
5630 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5631 {
5632         struct mgmt_pending_cmd *cmd = data;
5633
5634         if (bredr_sc_enabled(hdev))
5635                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5636         else
5637                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5638
5639         if (IS_ERR(cmd->skb))
5640                 return PTR_ERR(cmd->skb);
5641         else
5642                 return 0;
5643 }
5644
5645 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5646                                void *data, u16 data_len)
5647 {
5648         struct mgmt_pending_cmd *cmd;
5649         int err;
5650
5651         bt_dev_dbg(hdev, "sock %p", sk);
5652
5653         hci_dev_lock(hdev);
5654
5655         if (!hdev_is_powered(hdev)) {
5656                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5657                                       MGMT_STATUS_NOT_POWERED);
5658                 goto unlock;
5659         }
5660
5661         if (!lmp_ssp_capable(hdev)) {
5662                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5663                                       MGMT_STATUS_NOT_SUPPORTED);
5664                 goto unlock;
5665         }
5666
5667         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5668         if (!cmd)
5669                 err = -ENOMEM;
5670         else
5671                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5672                                          read_local_oob_data_complete);
5673
5674         if (err < 0) {
5675                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5676                                       MGMT_STATUS_FAILED);
5677
5678                 if (cmd)
5679                         mgmt_pending_free(cmd);
5680         }
5681
5682 unlock:
5683         hci_dev_unlock(hdev);
5684         return err;
5685 }
5686
5687 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5688                                void *data, u16 len)
5689 {
5690         struct mgmt_addr_info *addr = data;
5691         int err;
5692
5693         bt_dev_dbg(hdev, "sock %p", sk);
5694
5695         if (!bdaddr_type_is_valid(addr->type))
5696                 return mgmt_cmd_complete(sk, hdev->id,
5697                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5698                                          MGMT_STATUS_INVALID_PARAMS,
5699                                          addr, sizeof(*addr));
5700
5701         hci_dev_lock(hdev);
5702
5703         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5704                 struct mgmt_cp_add_remote_oob_data *cp = data;
5705                 u8 status;
5706
5707                 if (cp->addr.type != BDADDR_BREDR) {
5708                         err = mgmt_cmd_complete(sk, hdev->id,
5709                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5710                                                 MGMT_STATUS_INVALID_PARAMS,
5711                                                 &cp->addr, sizeof(cp->addr));
5712                         goto unlock;
5713                 }
5714
5715                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5716                                               cp->addr.type, cp->hash,
5717                                               cp->rand, NULL, NULL);
5718                 if (err < 0)
5719                         status = MGMT_STATUS_FAILED;
5720                 else
5721                         status = MGMT_STATUS_SUCCESS;
5722
5723                 err = mgmt_cmd_complete(sk, hdev->id,
5724                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5725                                         &cp->addr, sizeof(cp->addr));
5726         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5727                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5728                 u8 *rand192, *hash192, *rand256, *hash256;
5729                 u8 status;
5730
5731                 if (bdaddr_type_is_le(cp->addr.type)) {
5732                         /* Enforce zero-valued 192-bit parameters as
5733                          * long as legacy SMP OOB isn't implemented.
5734                          */
5735                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5736                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5737                                 err = mgmt_cmd_complete(sk, hdev->id,
5738                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5739                                                         MGMT_STATUS_INVALID_PARAMS,
5740                                                         addr, sizeof(*addr));
5741                                 goto unlock;
5742                         }
5743
5744                         rand192 = NULL;
5745                         hash192 = NULL;
5746                 } else {
5747                         /* In case one of the P-192 values is set to zero,
5748                          * then just disable OOB data for P-192.
5749                          */
5750                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5751                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5752                                 rand192 = NULL;
5753                                 hash192 = NULL;
5754                         } else {
5755                                 rand192 = cp->rand192;
5756                                 hash192 = cp->hash192;
5757                         }
5758                 }
5759
5760                 /* In case one of the P-256 values is set to zero, then just
5761                  * disable OOB data for P-256.
5762                  */
5763                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5764                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5765                         rand256 = NULL;
5766                         hash256 = NULL;
5767                 } else {
5768                         rand256 = cp->rand256;
5769                         hash256 = cp->hash256;
5770                 }
5771
5772                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5773                                               cp->addr.type, hash192, rand192,
5774                                               hash256, rand256);
5775                 if (err < 0)
5776                         status = MGMT_STATUS_FAILED;
5777                 else
5778                         status = MGMT_STATUS_SUCCESS;
5779
5780                 err = mgmt_cmd_complete(sk, hdev->id,
5781                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5782                                         status, &cp->addr, sizeof(cp->addr));
5783         } else {
5784                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5785                            len);
5786                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5787                                       MGMT_STATUS_INVALID_PARAMS);
5788         }
5789
5790 unlock:
5791         hci_dev_unlock(hdev);
5792         return err;
5793 }
5794
5795 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5796                                   void *data, u16 len)
5797 {
5798         struct mgmt_cp_remove_remote_oob_data *cp = data;
5799         u8 status;
5800         int err;
5801
5802         bt_dev_dbg(hdev, "sock %p", sk);
5803
5804         if (cp->addr.type != BDADDR_BREDR)
5805                 return mgmt_cmd_complete(sk, hdev->id,
5806                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5807                                          MGMT_STATUS_INVALID_PARAMS,
5808                                          &cp->addr, sizeof(cp->addr));
5809
5810         hci_dev_lock(hdev);
5811
5812         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5813                 hci_remote_oob_data_clear(hdev);
5814                 status = MGMT_STATUS_SUCCESS;
5815                 goto done;
5816         }
5817
5818         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5819         if (err < 0)
5820                 status = MGMT_STATUS_INVALID_PARAMS;
5821         else
5822                 status = MGMT_STATUS_SUCCESS;
5823
5824 done:
5825         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5826                                 status, &cp->addr, sizeof(cp->addr));
5827
5828         hci_dev_unlock(hdev);
5829         return err;
5830 }
5831
5832 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5833 {
5834         struct mgmt_pending_cmd *cmd;
5835
5836         bt_dev_dbg(hdev, "status %u", status);
5837
5838         hci_dev_lock(hdev);
5839
5840         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5841         if (!cmd)
5842                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5843
5844         if (!cmd)
5845                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5846
5847         if (cmd) {
5848                 cmd->cmd_complete(cmd, mgmt_status(status));
5849                 mgmt_pending_remove(cmd);
5850         }
5851
5852         hci_dev_unlock(hdev);
5853 }
5854
5855 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5856                                     uint8_t *mgmt_status)
5857 {
5858         switch (type) {
5859         case DISCOV_TYPE_LE:
5860                 *mgmt_status = mgmt_le_support(hdev);
5861                 if (*mgmt_status)
5862                         return false;
5863                 break;
5864         case DISCOV_TYPE_INTERLEAVED:
5865                 *mgmt_status = mgmt_le_support(hdev);
5866                 if (*mgmt_status)
5867                         return false;
5868                 fallthrough;
5869         case DISCOV_TYPE_BREDR:
5870                 *mgmt_status = mgmt_bredr_support(hdev);
5871                 if (*mgmt_status)
5872                         return false;
5873                 break;
5874         default:
5875                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5876                 return false;
5877         }
5878
5879         return true;
5880 }
5881
5882 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5883 {
5884         struct mgmt_pending_cmd *cmd = data;
5885
5886         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5887             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5888             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5889                 return;
5890
5891         bt_dev_dbg(hdev, "err %d", err);
5892
5893         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5894                           cmd->param, 1);
5895         mgmt_pending_remove(cmd);
5896
5897         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5898                                 DISCOVERY_FINDING);
5899 }
5900
5901 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5902 {
5903         return hci_start_discovery_sync(hdev);
5904 }
5905
5906 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5907                                     u16 op, void *data, u16 len)
5908 {
5909         struct mgmt_cp_start_discovery *cp = data;
5910         struct mgmt_pending_cmd *cmd;
5911         u8 status;
5912         int err;
5913
5914         bt_dev_dbg(hdev, "sock %p", sk);
5915
5916         hci_dev_lock(hdev);
5917
5918         if (!hdev_is_powered(hdev)) {
5919                 err = mgmt_cmd_complete(sk, hdev->id, op,
5920                                         MGMT_STATUS_NOT_POWERED,
5921                                         &cp->type, sizeof(cp->type));
5922                 goto failed;
5923         }
5924
5925         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5926             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5927                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5928                                         &cp->type, sizeof(cp->type));
5929                 goto failed;
5930         }
5931
5932         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5933                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5934                                         &cp->type, sizeof(cp->type));
5935                 goto failed;
5936         }
5937
5938         /* Can't start discovery when it is paused */
5939         if (hdev->discovery_paused) {
5940                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5941                                         &cp->type, sizeof(cp->type));
5942                 goto failed;
5943         }
5944
5945         /* Clear the discovery filter first to free any previously
5946          * allocated memory for the UUID list.
5947          */
5948         hci_discovery_filter_clear(hdev);
5949
5950         hdev->discovery.type = cp->type;
5951         hdev->discovery.report_invalid_rssi = false;
5952         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5953                 hdev->discovery.limited = true;
5954         else
5955                 hdev->discovery.limited = false;
5956
5957         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5958         if (!cmd) {
5959                 err = -ENOMEM;
5960                 goto failed;
5961         }
5962
5963         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5964                                  start_discovery_complete);
5965         if (err < 0) {
5966                 mgmt_pending_remove(cmd);
5967                 goto failed;
5968         }
5969
5970         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5971
5972 failed:
5973         hci_dev_unlock(hdev);
5974         return err;
5975 }
5976
5977 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5978                            void *data, u16 len)
5979 {
5980         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5981                                         data, len);
5982 }
5983
5984 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5985                                    void *data, u16 len)
5986 {
5987         return start_discovery_internal(sk, hdev,
5988                                         MGMT_OP_START_LIMITED_DISCOVERY,
5989                                         data, len);
5990 }
5991
5992 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5993                                    void *data, u16 len)
5994 {
5995         struct mgmt_cp_start_service_discovery *cp = data;
5996         struct mgmt_pending_cmd *cmd;
5997         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5998         u16 uuid_count, expected_len;
5999         u8 status;
6000         int err;
6001
6002         bt_dev_dbg(hdev, "sock %p", sk);
6003
6004         hci_dev_lock(hdev);
6005
6006         if (!hdev_is_powered(hdev)) {
6007                 err = mgmt_cmd_complete(sk, hdev->id,
6008                                         MGMT_OP_START_SERVICE_DISCOVERY,
6009                                         MGMT_STATUS_NOT_POWERED,
6010                                         &cp->type, sizeof(cp->type));
6011                 goto failed;
6012         }
6013
6014         if (hdev->discovery.state != DISCOVERY_STOPPED ||
6015             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6016                 err = mgmt_cmd_complete(sk, hdev->id,
6017                                         MGMT_OP_START_SERVICE_DISCOVERY,
6018                                         MGMT_STATUS_BUSY, &cp->type,
6019                                         sizeof(cp->type));
6020                 goto failed;
6021         }
6022
6023         if (hdev->discovery_paused) {
6024                 err = mgmt_cmd_complete(sk, hdev->id,
6025                                         MGMT_OP_START_SERVICE_DISCOVERY,
6026                                         MGMT_STATUS_BUSY, &cp->type,
6027                                         sizeof(cp->type));
6028                 goto failed;
6029         }
6030
6031         uuid_count = __le16_to_cpu(cp->uuid_count);
6032         if (uuid_count > max_uuid_count) {
6033                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6034                            uuid_count);
6035                 err = mgmt_cmd_complete(sk, hdev->id,
6036                                         MGMT_OP_START_SERVICE_DISCOVERY,
6037                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6038                                         sizeof(cp->type));
6039                 goto failed;
6040         }
6041
6042         expected_len = sizeof(*cp) + uuid_count * 16;
6043         if (expected_len != len) {
6044                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6045                            expected_len, len);
6046                 err = mgmt_cmd_complete(sk, hdev->id,
6047                                         MGMT_OP_START_SERVICE_DISCOVERY,
6048                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6049                                         sizeof(cp->type));
6050                 goto failed;
6051         }
6052
6053         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6054                 err = mgmt_cmd_complete(sk, hdev->id,
6055                                         MGMT_OP_START_SERVICE_DISCOVERY,
6056                                         status, &cp->type, sizeof(cp->type));
6057                 goto failed;
6058         }
6059
6060         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6061                                hdev, data, len);
6062         if (!cmd) {
6063                 err = -ENOMEM;
6064                 goto failed;
6065         }
6066
6067         /* Clear the discovery filter first to free any previously
6068          * allocated memory for the UUID list.
6069          */
6070         hci_discovery_filter_clear(hdev);
6071
6072         hdev->discovery.result_filtering = true;
6073         hdev->discovery.type = cp->type;
6074         hdev->discovery.rssi = cp->rssi;
6075         hdev->discovery.uuid_count = uuid_count;
6076
6077         if (uuid_count > 0) {
6078                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6079                                                 GFP_KERNEL);
6080                 if (!hdev->discovery.uuids) {
6081                         err = mgmt_cmd_complete(sk, hdev->id,
6082                                                 MGMT_OP_START_SERVICE_DISCOVERY,
6083                                                 MGMT_STATUS_FAILED,
6084                                                 &cp->type, sizeof(cp->type));
6085                         mgmt_pending_remove(cmd);
6086                         goto failed;
6087                 }
6088         }
6089
6090         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6091                                  start_discovery_complete);
6092         if (err < 0) {
6093                 mgmt_pending_remove(cmd);
6094                 goto failed;
6095         }
6096
6097         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6098
6099 failed:
6100         hci_dev_unlock(hdev);
6101         return err;
6102 }
6103
6104 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
6105 {
6106         struct mgmt_pending_cmd *cmd;
6107
6108         bt_dev_dbg(hdev, "status %u", status);
6109
6110         hci_dev_lock(hdev);
6111
6112         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6113         if (cmd) {
6114                 cmd->cmd_complete(cmd, mgmt_status(status));
6115                 mgmt_pending_remove(cmd);
6116         }
6117
6118         hci_dev_unlock(hdev);
6119 }
6120
6121 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6122 {
6123         struct mgmt_pending_cmd *cmd = data;
6124
6125         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6126                 return;
6127
6128         bt_dev_dbg(hdev, "err %d", err);
6129
6130         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6131                           cmd->param, 1);
6132         mgmt_pending_remove(cmd);
6133
6134         if (!err)
6135                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6136 }
6137
6138 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6139 {
6140         return hci_stop_discovery_sync(hdev);
6141 }
6142
6143 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6144                           u16 len)
6145 {
6146         struct mgmt_cp_stop_discovery *mgmt_cp = data;
6147         struct mgmt_pending_cmd *cmd;
6148         int err;
6149
6150         bt_dev_dbg(hdev, "sock %p", sk);
6151
6152         hci_dev_lock(hdev);
6153
6154         if (!hci_discovery_active(hdev)) {
6155                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6156                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6157                                         sizeof(mgmt_cp->type));
6158                 goto unlock;
6159         }
6160
6161         if (hdev->discovery.type != mgmt_cp->type) {
6162                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6163                                         MGMT_STATUS_INVALID_PARAMS,
6164                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6165                 goto unlock;
6166         }
6167
6168         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6169         if (!cmd) {
6170                 err = -ENOMEM;
6171                 goto unlock;
6172         }
6173
6174         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6175                                  stop_discovery_complete);
6176         if (err < 0) {
6177                 mgmt_pending_remove(cmd);
6178                 goto unlock;
6179         }
6180
6181         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6182
6183 unlock:
6184         hci_dev_unlock(hdev);
6185         return err;
6186 }
6187
6188 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6189                         u16 len)
6190 {
6191         struct mgmt_cp_confirm_name *cp = data;
6192         struct inquiry_entry *e;
6193         int err;
6194
6195         bt_dev_dbg(hdev, "sock %p", sk);
6196
6197         hci_dev_lock(hdev);
6198
6199         if (!hci_discovery_active(hdev)) {
6200                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6201                                         MGMT_STATUS_FAILED, &cp->addr,
6202                                         sizeof(cp->addr));
6203                 goto failed;
6204         }
6205
6206         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6207         if (!e) {
6208                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6209                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6210                                         sizeof(cp->addr));
6211                 goto failed;
6212         }
6213
6214         if (cp->name_known) {
6215                 e->name_state = NAME_KNOWN;
6216                 list_del(&e->list);
6217         } else {
6218                 e->name_state = NAME_NEEDED;
6219                 hci_inquiry_cache_update_resolve(hdev, e);
6220         }
6221
6222         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6223                                 &cp->addr, sizeof(cp->addr));
6224
6225 failed:
6226         hci_dev_unlock(hdev);
6227         return err;
6228 }
6229
6230 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6231                         u16 len)
6232 {
6233         struct mgmt_cp_block_device *cp = data;
6234         u8 status;
6235         int err;
6236
6237         bt_dev_dbg(hdev, "sock %p", sk);
6238
6239         if (!bdaddr_type_is_valid(cp->addr.type))
6240                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6241                                          MGMT_STATUS_INVALID_PARAMS,
6242                                          &cp->addr, sizeof(cp->addr));
6243
6244         hci_dev_lock(hdev);
6245
6246         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6247                                   cp->addr.type);
6248         if (err < 0) {
6249                 status = MGMT_STATUS_FAILED;
6250                 goto done;
6251         }
6252
6253         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6254                    sk);
6255         status = MGMT_STATUS_SUCCESS;
6256
6257 done:
6258         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6259                                 &cp->addr, sizeof(cp->addr));
6260
6261         hci_dev_unlock(hdev);
6262
6263         return err;
6264 }
6265
6266 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6267                           u16 len)
6268 {
6269         struct mgmt_cp_unblock_device *cp = data;
6270         u8 status;
6271         int err;
6272
6273         bt_dev_dbg(hdev, "sock %p", sk);
6274
6275         if (!bdaddr_type_is_valid(cp->addr.type))
6276                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6277                                          MGMT_STATUS_INVALID_PARAMS,
6278                                          &cp->addr, sizeof(cp->addr));
6279
6280         hci_dev_lock(hdev);
6281
6282         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6283                                   cp->addr.type);
6284         if (err < 0) {
6285                 status = MGMT_STATUS_INVALID_PARAMS;
6286                 goto done;
6287         }
6288
6289         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6290                    sk);
6291         status = MGMT_STATUS_SUCCESS;
6292
6293 done:
6294         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6295                                 &cp->addr, sizeof(cp->addr));
6296
6297         hci_dev_unlock(hdev);
6298
6299         return err;
6300 }
6301
6302 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6303 {
6304         return hci_update_eir_sync(hdev);
6305 }
6306
6307 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6308                          u16 len)
6309 {
6310         struct mgmt_cp_set_device_id *cp = data;
6311         int err;
6312         __u16 source;
6313
6314         bt_dev_dbg(hdev, "sock %p", sk);
6315
6316         source = __le16_to_cpu(cp->source);
6317
6318         if (source > 0x0002)
6319                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6320                                        MGMT_STATUS_INVALID_PARAMS);
6321
6322         hci_dev_lock(hdev);
6323
6324         hdev->devid_source = source;
6325         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6326         hdev->devid_product = __le16_to_cpu(cp->product);
6327         hdev->devid_version = __le16_to_cpu(cp->version);
6328
6329         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6330                                 NULL, 0);
6331
6332         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6333
6334         hci_dev_unlock(hdev);
6335
6336         return err;
6337 }
6338
6339 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6340 {
6341         if (err)
6342                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6343         else
6344                 bt_dev_dbg(hdev, "status %d", err);
6345 }
6346
6347 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6348 {
6349         struct cmd_lookup match = { NULL, hdev };
6350         u8 instance;
6351         struct adv_info *adv_instance;
6352         u8 status = mgmt_status(err);
6353
6354         if (status) {
6355                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
6356                                      cmd_status_rsp, &status);
6357                 return;
6358         }
6359
6360         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6361                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6362         else
6363                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6364
6365         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6366                              &match);
6367
6368         new_settings(hdev, match.sk);
6369
6370         if (match.sk)
6371                 sock_put(match.sk);
6372
6373         /* If "Set Advertising" was just disabled and instance advertising was
6374          * set up earlier, then re-enable multi-instance advertising.
6375          */
6376         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6377             list_empty(&hdev->adv_instances))
6378                 return;
6379
6380         instance = hdev->cur_adv_instance;
6381         if (!instance) {
6382                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6383                                                         struct adv_info, list);
6384                 if (!adv_instance)
6385                         return;
6386
6387                 instance = adv_instance->instance;
6388         }
6389
6390         err = hci_schedule_adv_instance_sync(hdev, instance, true);
6391
6392         enable_advertising_instance(hdev, err);
6393 }
6394
6395 static int set_adv_sync(struct hci_dev *hdev, void *data)
6396 {
6397         struct mgmt_pending_cmd *cmd = data;
6398         struct mgmt_mode *cp = cmd->param;
6399         u8 val = !!cp->val;
6400
6401         if (cp->val == 0x02)
6402                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6403         else
6404                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6405
6406         cancel_adv_timeout(hdev);
6407
6408         if (val) {
6409                 /* Switch to instance "0" for the Set Advertising setting.
6410                  * We cannot use update_[adv|scan_rsp]_data() here as the
6411                  * HCI_ADVERTISING flag is not yet set.
6412                  */
6413                 hdev->cur_adv_instance = 0x00;
6414
6415                 if (ext_adv_capable(hdev)) {
6416                         hci_start_ext_adv_sync(hdev, 0x00);
6417                 } else {
6418                         hci_update_adv_data_sync(hdev, 0x00);
6419                         hci_update_scan_rsp_data_sync(hdev, 0x00);
6420                         hci_enable_advertising_sync(hdev);
6421                 }
6422         } else {
6423                 hci_disable_advertising_sync(hdev);
6424         }
6425
6426         return 0;
6427 }
6428
6429 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6430                            u16 len)
6431 {
6432         struct mgmt_mode *cp = data;
6433         struct mgmt_pending_cmd *cmd;
6434         u8 val, status;
6435         int err;
6436
6437         bt_dev_dbg(hdev, "sock %p", sk);
6438
6439         status = mgmt_le_support(hdev);
6440         if (status)
6441                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6442                                        status);
6443
6444         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6445                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6446                                        MGMT_STATUS_INVALID_PARAMS);
6447
6448         if (hdev->advertising_paused)
6449                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6450                                        MGMT_STATUS_BUSY);
6451
6452         hci_dev_lock(hdev);
6453
6454         val = !!cp->val;
6455
6456         /* The following conditions are ones which mean that we should
6457          * not do any HCI communication but directly send a mgmt
6458          * response to user space (after toggling the flag if
6459          * necessary).
6460          */
6461         if (!hdev_is_powered(hdev) ||
6462             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6463              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6464             hci_dev_test_flag(hdev, HCI_MESH) ||
6465             hci_conn_num(hdev, LE_LINK) > 0 ||
6466             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6467              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6468                 bool changed;
6469
6470                 if (cp->val) {
6471                         hdev->cur_adv_instance = 0x00;
6472                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6473                         if (cp->val == 0x02)
6474                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6475                         else
6476                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6477                 } else {
6478                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6479                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6480                 }
6481
6482                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6483                 if (err < 0)
6484                         goto unlock;
6485
6486                 if (changed)
6487                         err = new_settings(hdev, sk);
6488
6489                 goto unlock;
6490         }
6491
6492         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6493             pending_find(MGMT_OP_SET_LE, hdev)) {
6494                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6495                                       MGMT_STATUS_BUSY);
6496                 goto unlock;
6497         }
6498
6499         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6500         if (!cmd)
6501                 err = -ENOMEM;
6502         else
6503                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6504                                          set_advertising_complete);
6505
6506         if (err < 0 && cmd)
6507                 mgmt_pending_remove(cmd);
6508
6509 unlock:
6510         hci_dev_unlock(hdev);
6511         return err;
6512 }
6513
6514 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6515                               void *data, u16 len)
6516 {
6517         struct mgmt_cp_set_static_address *cp = data;
6518         int err;
6519
6520         bt_dev_dbg(hdev, "sock %p", sk);
6521
6522         if (!lmp_le_capable(hdev))
6523                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6524                                        MGMT_STATUS_NOT_SUPPORTED);
6525
6526         if (hdev_is_powered(hdev))
6527                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6528                                        MGMT_STATUS_REJECTED);
6529
6530         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6531                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6532                         return mgmt_cmd_status(sk, hdev->id,
6533                                                MGMT_OP_SET_STATIC_ADDRESS,
6534                                                MGMT_STATUS_INVALID_PARAMS);
6535
6536                 /* Two most significant bits shall be set */
6537                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6538                         return mgmt_cmd_status(sk, hdev->id,
6539                                                MGMT_OP_SET_STATIC_ADDRESS,
6540                                                MGMT_STATUS_INVALID_PARAMS);
6541         }
6542
6543         hci_dev_lock(hdev);
6544
6545         bacpy(&hdev->static_addr, &cp->bdaddr);
6546
6547         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6548         if (err < 0)
6549                 goto unlock;
6550
6551         err = new_settings(hdev, sk);
6552
6553 unlock:
6554         hci_dev_unlock(hdev);
6555         return err;
6556 }
6557
6558 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6559                            void *data, u16 len)
6560 {
6561         struct mgmt_cp_set_scan_params *cp = data;
6562         __u16 interval, window;
6563         int err;
6564
6565         bt_dev_dbg(hdev, "sock %p", sk);
6566
6567         if (!lmp_le_capable(hdev))
6568                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6569                                        MGMT_STATUS_NOT_SUPPORTED);
6570
6571         interval = __le16_to_cpu(cp->interval);
6572
6573         if (interval < 0x0004 || interval > 0x4000)
6574                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6575                                        MGMT_STATUS_INVALID_PARAMS);
6576
6577         window = __le16_to_cpu(cp->window);
6578
6579         if (window < 0x0004 || window > 0x4000)
6580                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6581                                        MGMT_STATUS_INVALID_PARAMS);
6582
6583         if (window > interval)
6584                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6585                                        MGMT_STATUS_INVALID_PARAMS);
6586
6587         hci_dev_lock(hdev);
6588
6589         hdev->le_scan_interval = interval;
6590         hdev->le_scan_window = window;
6591
6592         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6593                                 NULL, 0);
6594
6595         /* If background scan is running, restart it so new parameters are
6596          * loaded.
6597          */
6598         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6599             hdev->discovery.state == DISCOVERY_STOPPED)
6600                 hci_update_passive_scan(hdev);
6601
6602         hci_dev_unlock(hdev);
6603
6604         return err;
6605 }
6606
6607 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6608 {
6609         struct mgmt_pending_cmd *cmd = data;
6610
6611         bt_dev_dbg(hdev, "err %d", err);
6612
6613         if (err) {
6614                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6615                                 mgmt_status(err));
6616         } else {
6617                 struct mgmt_mode *cp = cmd->param;
6618
6619                 if (cp->val)
6620                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6621                 else
6622                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6623
6624                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6625                 new_settings(hdev, cmd->sk);
6626         }
6627
6628         mgmt_pending_free(cmd);
6629 }
6630
6631 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6632 {
6633         struct mgmt_pending_cmd *cmd = data;
6634         struct mgmt_mode *cp = cmd->param;
6635
6636         return hci_write_fast_connectable_sync(hdev, cp->val);
6637 }
6638
6639 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6640                                 void *data, u16 len)
6641 {
6642         struct mgmt_mode *cp = data;
6643         struct mgmt_pending_cmd *cmd;
6644         int err;
6645
6646         bt_dev_dbg(hdev, "sock %p", sk);
6647
6648         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6649             hdev->hci_ver < BLUETOOTH_VER_1_2)
6650                 return mgmt_cmd_status(sk, hdev->id,
6651                                        MGMT_OP_SET_FAST_CONNECTABLE,
6652                                        MGMT_STATUS_NOT_SUPPORTED);
6653
6654         if (cp->val != 0x00 && cp->val != 0x01)
6655                 return mgmt_cmd_status(sk, hdev->id,
6656                                        MGMT_OP_SET_FAST_CONNECTABLE,
6657                                        MGMT_STATUS_INVALID_PARAMS);
6658
6659         hci_dev_lock(hdev);
6660
6661         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6662                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6663                 goto unlock;
6664         }
6665
6666         if (!hdev_is_powered(hdev)) {
6667                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6668                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6669                 new_settings(hdev, sk);
6670                 goto unlock;
6671         }
6672
6673         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6674                                len);
6675         if (!cmd)
6676                 err = -ENOMEM;
6677         else
6678                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6679                                          fast_connectable_complete);
6680
6681         if (err < 0) {
6682                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6683                                 MGMT_STATUS_FAILED);
6684
6685                 if (cmd)
6686                         mgmt_pending_free(cmd);
6687         }
6688
6689 unlock:
6690         hci_dev_unlock(hdev);
6691
6692         return err;
6693 }
6694
6695 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6696 {
6697         struct mgmt_pending_cmd *cmd = data;
6698
6699         bt_dev_dbg(hdev, "err %d", err);
6700
6701         if (err) {
6702                 u8 mgmt_err = mgmt_status(err);
6703
6704                 /* We need to restore the flag if related HCI commands
6705                  * failed.
6706                  */
6707                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6708
6709                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6710         } else {
6711                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6712                 new_settings(hdev, cmd->sk);
6713         }
6714
6715         mgmt_pending_free(cmd);
6716 }
6717
6718 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6719 {
6720         int status;
6721
6722         status = hci_write_fast_connectable_sync(hdev, false);
6723
6724         if (!status)
6725                 status = hci_update_scan_sync(hdev);
6726
6727         /* Since only the advertising data flags will change, there
6728          * is no need to update the scan response data.
6729          */
6730         if (!status)
6731                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6732
6733         return status;
6734 }
6735
6736 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6737 {
6738         struct mgmt_mode *cp = data;
6739         struct mgmt_pending_cmd *cmd;
6740         int err;
6741
6742         bt_dev_dbg(hdev, "sock %p", sk);
6743
6744         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6745                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6746                                        MGMT_STATUS_NOT_SUPPORTED);
6747
6748         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6749                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6750                                        MGMT_STATUS_REJECTED);
6751
6752         if (cp->val != 0x00 && cp->val != 0x01)
6753                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6754                                        MGMT_STATUS_INVALID_PARAMS);
6755
6756         hci_dev_lock(hdev);
6757
6758         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6759                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6760                 goto unlock;
6761         }
6762
6763         if (!hdev_is_powered(hdev)) {
6764                 if (!cp->val) {
6765                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6766                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6767                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6768                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6769                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
6770                 }
6771
6772                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6773
6774                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6775                 if (err < 0)
6776                         goto unlock;
6777
6778                 err = new_settings(hdev, sk);
6779                 goto unlock;
6780         }
6781
6782         /* Reject disabling when powered on */
6783         if (!cp->val) {
6784                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6785                                       MGMT_STATUS_REJECTED);
6786                 goto unlock;
6787         } else {
6788                 /* When configuring a dual-mode controller to operate
6789                  * with LE only and using a static address, then switching
6790                  * BR/EDR back on is not allowed.
6791                  *
6792                  * Dual-mode controllers shall operate with the public
6793                  * address as its identity address for BR/EDR and LE. So
6794                  * reject the attempt to create an invalid configuration.
6795                  *
6796                  * The same restrictions applies when secure connections
6797                  * has been enabled. For BR/EDR this is a controller feature
6798                  * while for LE it is a host stack feature. This means that
6799                  * switching BR/EDR back on when secure connections has been
6800                  * enabled is not a supported transaction.
6801                  */
6802                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6803                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6804                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6805                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6806                                               MGMT_STATUS_REJECTED);
6807                         goto unlock;
6808                 }
6809         }
6810
6811         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6812         if (!cmd)
6813                 err = -ENOMEM;
6814         else
6815                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6816                                          set_bredr_complete);
6817
6818         if (err < 0) {
6819                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6820                                 MGMT_STATUS_FAILED);
6821                 if (cmd)
6822                         mgmt_pending_free(cmd);
6823
6824                 goto unlock;
6825         }
6826
6827         /* We need to flip the bit already here so that
6828          * hci_req_update_adv_data generates the correct flags.
6829          */
6830         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6831
6832 unlock:
6833         hci_dev_unlock(hdev);
6834         return err;
6835 }
6836
6837 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6838 {
6839         struct mgmt_pending_cmd *cmd = data;
6840         struct mgmt_mode *cp;
6841
6842         bt_dev_dbg(hdev, "err %d", err);
6843
6844         if (err) {
6845                 u8 mgmt_err = mgmt_status(err);
6846
6847                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6848                 goto done;
6849         }
6850
6851         cp = cmd->param;
6852
6853         switch (cp->val) {
6854         case 0x00:
6855                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6856                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6857                 break;
6858         case 0x01:
6859                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6860                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6861                 break;
6862         case 0x02:
6863                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6864                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6865                 break;
6866         }
6867
6868         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6869         new_settings(hdev, cmd->sk);
6870
6871 done:
6872         mgmt_pending_free(cmd);
6873 }
6874
6875 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6876 {
6877         struct mgmt_pending_cmd *cmd = data;
6878         struct mgmt_mode *cp = cmd->param;
6879         u8 val = !!cp->val;
6880
6881         /* Force write of val */
6882         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6883
6884         return hci_write_sc_support_sync(hdev, val);
6885 }
6886
6887 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6888                            void *data, u16 len)
6889 {
6890         struct mgmt_mode *cp = data;
6891         struct mgmt_pending_cmd *cmd;
6892         u8 val;
6893         int err;
6894
6895         bt_dev_dbg(hdev, "sock %p", sk);
6896
6897         if (!lmp_sc_capable(hdev) &&
6898             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6899                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6900                                        MGMT_STATUS_NOT_SUPPORTED);
6901
6902         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6903             lmp_sc_capable(hdev) &&
6904             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6905                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6906                                        MGMT_STATUS_REJECTED);
6907
6908         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6909                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6910                                        MGMT_STATUS_INVALID_PARAMS);
6911
6912         hci_dev_lock(hdev);
6913
6914         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6915             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6916                 bool changed;
6917
6918                 if (cp->val) {
6919                         changed = !hci_dev_test_and_set_flag(hdev,
6920                                                              HCI_SC_ENABLED);
6921                         if (cp->val == 0x02)
6922                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6923                         else
6924                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6925                 } else {
6926                         changed = hci_dev_test_and_clear_flag(hdev,
6927                                                               HCI_SC_ENABLED);
6928                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6929                 }
6930
6931                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6932                 if (err < 0)
6933                         goto failed;
6934
6935                 if (changed)
6936                         err = new_settings(hdev, sk);
6937
6938                 goto failed;
6939         }
6940
6941         val = !!cp->val;
6942
6943         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6944             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6945                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6946                 goto failed;
6947         }
6948
6949         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6950         if (!cmd)
6951                 err = -ENOMEM;
6952         else
6953                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6954                                          set_secure_conn_complete);
6955
6956         if (err < 0) {
6957                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6958                                 MGMT_STATUS_FAILED);
6959                 if (cmd)
6960                         mgmt_pending_free(cmd);
6961         }
6962
6963 failed:
6964         hci_dev_unlock(hdev);
6965         return err;
6966 }
6967
6968 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6969                           void *data, u16 len)
6970 {
6971         struct mgmt_mode *cp = data;
6972         bool changed, use_changed;
6973         int err;
6974
6975         bt_dev_dbg(hdev, "sock %p", sk);
6976
6977         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6978                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6979                                        MGMT_STATUS_INVALID_PARAMS);
6980
6981         hci_dev_lock(hdev);
6982
6983         if (cp->val)
6984                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6985         else
6986                 changed = hci_dev_test_and_clear_flag(hdev,
6987                                                       HCI_KEEP_DEBUG_KEYS);
6988
6989         if (cp->val == 0x02)
6990                 use_changed = !hci_dev_test_and_set_flag(hdev,
6991                                                          HCI_USE_DEBUG_KEYS);
6992         else
6993                 use_changed = hci_dev_test_and_clear_flag(hdev,
6994                                                           HCI_USE_DEBUG_KEYS);
6995
6996         if (hdev_is_powered(hdev) && use_changed &&
6997             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6998                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6999                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
7000                              sizeof(mode), &mode);
7001         }
7002
7003         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
7004         if (err < 0)
7005                 goto unlock;
7006
7007         if (changed)
7008                 err = new_settings(hdev, sk);
7009
7010 unlock:
7011         hci_dev_unlock(hdev);
7012         return err;
7013 }
7014
7015 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7016                        u16 len)
7017 {
7018         struct mgmt_cp_set_privacy *cp = cp_data;
7019         bool changed;
7020         int err;
7021
7022         bt_dev_dbg(hdev, "sock %p", sk);
7023
7024         if (!lmp_le_capable(hdev))
7025                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7026                                        MGMT_STATUS_NOT_SUPPORTED);
7027
7028         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7029                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7030                                        MGMT_STATUS_INVALID_PARAMS);
7031
7032 #ifndef TIZEN_BT
7033         /* commenting out since set privacy command is always rejected
7034          * if this condition is enabled.
7035          */
7036         if (hdev_is_powered(hdev))
7037                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7038                                        MGMT_STATUS_REJECTED);
7039 #endif
7040
7041         hci_dev_lock(hdev);
7042
7043         /* If user space supports this command it is also expected to
7044          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7045          */
7046         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7047
7048         if (cp->privacy) {
7049                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7050                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7051                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7052                 hci_adv_instances_set_rpa_expired(hdev, true);
7053                 if (cp->privacy == 0x02)
7054                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7055                 else
7056                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7057         } else {
7058                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7059                 memset(hdev->irk, 0, sizeof(hdev->irk));
7060                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7061                 hci_adv_instances_set_rpa_expired(hdev, false);
7062                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7063         }
7064
7065         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7066         if (err < 0)
7067                 goto unlock;
7068
7069         if (changed)
7070                 err = new_settings(hdev, sk);
7071
7072 unlock:
7073         hci_dev_unlock(hdev);
7074         return err;
7075 }
7076
7077 static bool irk_is_valid(struct mgmt_irk_info *irk)
7078 {
7079         switch (irk->addr.type) {
7080         case BDADDR_LE_PUBLIC:
7081                 return true;
7082
7083         case BDADDR_LE_RANDOM:
7084                 /* Two most significant bits shall be set */
7085                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7086                         return false;
7087                 return true;
7088         }
7089
7090         return false;
7091 }
7092
7093 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7094                      u16 len)
7095 {
7096         struct mgmt_cp_load_irks *cp = cp_data;
7097         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7098                                    sizeof(struct mgmt_irk_info));
7099         u16 irk_count, expected_len;
7100         int i, err;
7101
7102         bt_dev_dbg(hdev, "sock %p", sk);
7103
7104         if (!lmp_le_capable(hdev))
7105                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7106                                        MGMT_STATUS_NOT_SUPPORTED);
7107
7108         irk_count = __le16_to_cpu(cp->irk_count);
7109         if (irk_count > max_irk_count) {
7110                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7111                            irk_count);
7112                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7113                                        MGMT_STATUS_INVALID_PARAMS);
7114         }
7115
7116         expected_len = struct_size(cp, irks, irk_count);
7117         if (expected_len != len) {
7118                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7119                            expected_len, len);
7120                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7121                                        MGMT_STATUS_INVALID_PARAMS);
7122         }
7123
7124         bt_dev_dbg(hdev, "irk_count %u", irk_count);
7125
7126         for (i = 0; i < irk_count; i++) {
7127                 struct mgmt_irk_info *key = &cp->irks[i];
7128
7129                 if (!irk_is_valid(key))
7130                         return mgmt_cmd_status(sk, hdev->id,
7131                                                MGMT_OP_LOAD_IRKS,
7132                                                MGMT_STATUS_INVALID_PARAMS);
7133         }
7134
7135         hci_dev_lock(hdev);
7136
7137         hci_smp_irks_clear(hdev);
7138
7139         for (i = 0; i < irk_count; i++) {
7140                 struct mgmt_irk_info *irk = &cp->irks[i];
7141
7142                 if (hci_is_blocked_key(hdev,
7143                                        HCI_BLOCKED_KEY_TYPE_IRK,
7144                                        irk->val)) {
7145                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7146                                     &irk->addr.bdaddr);
7147                         continue;
7148                 }
7149
7150                 hci_add_irk(hdev, &irk->addr.bdaddr,
7151                             le_addr_type(irk->addr.type), irk->val,
7152                             BDADDR_ANY);
7153         }
7154
7155         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7156
7157         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7158
7159         hci_dev_unlock(hdev);
7160
7161         return err;
7162 }
7163
7164 #ifdef TIZEN_BT
7165 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
7166                         void *data, u16 len)
7167 {
7168         struct mgmt_cp_set_advertising_params *cp = data;
7169         __u16 min_interval;
7170         __u16 max_interval;
7171         int err;
7172
7173         BT_DBG("%s", hdev->name);
7174
7175         if (!lmp_le_capable(hdev))
7176                 return mgmt_cmd_status(sk, hdev->id,
7177                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7178                                 MGMT_STATUS_NOT_SUPPORTED);
7179
7180         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7181                 return mgmt_cmd_status(sk, hdev->id,
7182                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7183                                 MGMT_STATUS_BUSY);
7184
7185         min_interval = __le16_to_cpu(cp->interval_min);
7186         max_interval = __le16_to_cpu(cp->interval_max);
7187
7188         if (min_interval > max_interval ||
7189             min_interval < 0x0020 || max_interval > 0x4000)
7190                 return mgmt_cmd_status(sk, hdev->id,
7191                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7192                                 MGMT_STATUS_INVALID_PARAMS);
7193
7194         hci_dev_lock(hdev);
7195
7196         hdev->le_adv_min_interval = min_interval;
7197         hdev->le_adv_max_interval = max_interval;
7198         hdev->adv_filter_policy = cp->filter_policy;
7199         hdev->adv_type = cp->type;
7200
7201         err = mgmt_cmd_complete(sk, hdev->id,
7202                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
7203
7204         hci_dev_unlock(hdev);
7205
7206         return err;
7207 }
7208
7209 static void set_advertising_data_complete(struct hci_dev *hdev,
7210                         u8 status, u16 opcode)
7211 {
7212         struct mgmt_cp_set_advertising_data *cp;
7213         struct mgmt_pending_cmd *cmd;
7214
7215         BT_DBG("status 0x%02x", status);
7216
7217         hci_dev_lock(hdev);
7218
7219         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
7220         if (!cmd)
7221                 goto unlock;
7222
7223         cp = cmd->param;
7224
7225         if (status)
7226                 mgmt_cmd_status(cmd->sk, hdev->id,
7227                                 MGMT_OP_SET_ADVERTISING_DATA,
7228                                 mgmt_status(status));
7229         else
7230                 mgmt_cmd_complete(cmd->sk, hdev->id,
7231                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
7232                                 cp, sizeof(*cp));
7233
7234         mgmt_pending_remove(cmd);
7235
7236 unlock:
7237         hci_dev_unlock(hdev);
7238 }
7239
7240 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
7241                         void *data, u16 len)
7242 {
7243         struct mgmt_pending_cmd *cmd;
7244         struct hci_request req;
7245         struct mgmt_cp_set_advertising_data *cp = data;
7246         struct hci_cp_le_set_adv_data adv;
7247         int err;
7248
7249         BT_DBG("%s", hdev->name);
7250
7251         if (!lmp_le_capable(hdev)) {
7252                 return mgmt_cmd_status(sk, hdev->id,
7253                                 MGMT_OP_SET_ADVERTISING_DATA,
7254                                 MGMT_STATUS_NOT_SUPPORTED);
7255         }
7256
7257         hci_dev_lock(hdev);
7258
7259         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
7260                 err = mgmt_cmd_status(sk, hdev->id,
7261                                 MGMT_OP_SET_ADVERTISING_DATA,
7262                                 MGMT_STATUS_BUSY);
7263                 goto unlocked;
7264         }
7265
7266         if (len > HCI_MAX_AD_LENGTH) {
7267                 err = mgmt_cmd_status(sk, hdev->id,
7268                                 MGMT_OP_SET_ADVERTISING_DATA,
7269                                 MGMT_STATUS_INVALID_PARAMS);
7270                 goto unlocked;
7271         }
7272
7273         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
7274                                hdev, data, len);
7275         if (!cmd) {
7276                 err = -ENOMEM;
7277                 goto unlocked;
7278         }
7279
7280         hci_req_init(&req, hdev);
7281
7282         memset(&adv, 0, sizeof(adv));
7283         memcpy(adv.data, cp->data, len);
7284         adv.length = len;
7285
7286         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
7287
7288         err = hci_req_run(&req, set_advertising_data_complete);
7289         if (err < 0)
7290                 mgmt_pending_remove(cmd);
7291
7292 unlocked:
7293         hci_dev_unlock(hdev);
7294
7295         return err;
7296 }
7297
7298 /* Adv White List feature */
7299 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7300 {
7301         struct mgmt_cp_add_dev_white_list *cp;
7302         struct mgmt_pending_cmd *cmd;
7303
7304         BT_DBG("status 0x%02x", status);
7305
7306         hci_dev_lock(hdev);
7307
7308         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
7309         if (!cmd)
7310                 goto unlock;
7311
7312         cp = cmd->param;
7313
7314         if (status)
7315                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7316                            mgmt_status(status));
7317         else
7318                 mgmt_cmd_complete(cmd->sk, hdev->id,
7319                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
7320
7321         mgmt_pending_remove(cmd);
7322
7323 unlock:
7324         hci_dev_unlock(hdev);
7325 }
7326
7327 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
7328                            void *data, u16 len)
7329 {
7330         struct mgmt_pending_cmd *cmd;
7331         struct mgmt_cp_add_dev_white_list *cp = data;
7332         struct hci_request req;
7333         int err;
7334
7335         BT_DBG("%s", hdev->name);
7336
7337         if (!lmp_le_capable(hdev))
7338                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7339                                   MGMT_STATUS_NOT_SUPPORTED);
7340
7341         if (!hdev_is_powered(hdev))
7342                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7343                                   MGMT_STATUS_REJECTED);
7344
7345         hci_dev_lock(hdev);
7346
7347         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
7348                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7349                                 MGMT_STATUS_BUSY);
7350                 goto unlocked;
7351         }
7352
7353         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
7354         if (!cmd) {
7355                 err = -ENOMEM;
7356                 goto unlocked;
7357         }
7358
7359         hci_req_init(&req, hdev);
7360
7361         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
7362
7363         err = hci_req_run(&req, add_white_list_complete);
7364         if (err < 0) {
7365                 mgmt_pending_remove(cmd);
7366                 goto unlocked;
7367         }
7368
7369 unlocked:
7370         hci_dev_unlock(hdev);
7371
7372         return err;
7373 }
7374
7375 static void remove_from_white_list_complete(struct hci_dev *hdev,
7376                         u8 status, u16 opcode)
7377 {
7378         struct mgmt_cp_remove_dev_from_white_list *cp;
7379         struct mgmt_pending_cmd *cmd;
7380
7381         BT_DBG("status 0x%02x", status);
7382
7383         hci_dev_lock(hdev);
7384
7385         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
7386         if (!cmd)
7387                 goto unlock;
7388
7389         cp = cmd->param;
7390
7391         if (status)
7392                 mgmt_cmd_status(cmd->sk, hdev->id,
7393                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7394                         mgmt_status(status));
7395         else
7396                 mgmt_cmd_complete(cmd->sk, hdev->id,
7397                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
7398                         cp, sizeof(*cp));
7399
7400         mgmt_pending_remove(cmd);
7401
7402 unlock:
7403         hci_dev_unlock(hdev);
7404 }
7405
7406 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
7407                            void *data, u16 len)
7408 {
7409         struct mgmt_pending_cmd *cmd;
7410         struct mgmt_cp_remove_dev_from_white_list *cp = data;
7411         struct hci_request req;
7412         int err;
7413
7414         BT_DBG("%s", hdev->name);
7415
7416         if (!lmp_le_capable(hdev))
7417                 return mgmt_cmd_status(sk, hdev->id,
7418                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7419                                 MGMT_STATUS_NOT_SUPPORTED);
7420
7421         if (!hdev_is_powered(hdev))
7422                 return mgmt_cmd_status(sk, hdev->id,
7423                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7424                                 MGMT_STATUS_REJECTED);
7425
7426         hci_dev_lock(hdev);
7427
7428         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
7429                 err = mgmt_cmd_status(sk, hdev->id,
7430                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7431                                 MGMT_STATUS_BUSY);
7432                 goto unlocked;
7433         }
7434
7435         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7436                                 hdev, data, len);
7437         if (!cmd) {
7438                 err = -ENOMEM;
7439                 goto unlocked;
7440         }
7441
7442         hci_req_init(&req, hdev);
7443
7444         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
7445
7446         err = hci_req_run(&req, remove_from_white_list_complete);
7447         if (err < 0) {
7448                 mgmt_pending_remove(cmd);
7449                 goto unlocked;
7450         }
7451
7452 unlocked:
7453         hci_dev_unlock(hdev);
7454
7455         return err;
7456 }
7457
7458 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
7459                         u16 opcode)
7460 {
7461         struct mgmt_pending_cmd *cmd;
7462
7463         BT_DBG("status 0x%02x", status);
7464
7465         hci_dev_lock(hdev);
7466
7467         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
7468         if (!cmd)
7469                 goto unlock;
7470
7471         if (status)
7472                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7473                            mgmt_status(status));
7474         else
7475                 mgmt_cmd_complete(cmd->sk, hdev->id,
7476                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7477                                 0, NULL, 0);
7478
7479         mgmt_pending_remove(cmd);
7480
7481 unlock:
7482         hci_dev_unlock(hdev);
7483 }
7484
7485 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
7486                            void *data, u16 len)
7487 {
7488         struct mgmt_pending_cmd *cmd;
7489         struct hci_request req;
7490         int err;
7491
7492         BT_DBG("%s", hdev->name);
7493
7494         if (!lmp_le_capable(hdev))
7495                 return mgmt_cmd_status(sk, hdev->id,
7496                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7497                                 MGMT_STATUS_NOT_SUPPORTED);
7498
7499         if (!hdev_is_powered(hdev))
7500                 return mgmt_cmd_status(sk, hdev->id,
7501                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7502                                 MGMT_STATUS_REJECTED);
7503
7504         hci_dev_lock(hdev);
7505
7506         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
7507                 err = mgmt_cmd_status(sk, hdev->id,
7508                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7509                                 MGMT_STATUS_BUSY);
7510                 goto unlocked;
7511         }
7512
7513         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7514                                 hdev, NULL, 0);
7515         if (!cmd) {
7516                 err = -ENOMEM;
7517                 goto unlocked;
7518         }
7519
7520         hci_req_init(&req, hdev);
7521
7522         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
7523
7524         err = hci_req_run(&req, clear_white_list_complete);
7525         if (err < 0) {
7526                 mgmt_pending_remove(cmd);
7527                 goto unlocked;
7528         }
7529
7530 unlocked:
7531         hci_dev_unlock(hdev);
7532
7533         return err;
7534 }
7535
7536 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
7537                         u16 opcode)
7538 {
7539         struct mgmt_cp_set_scan_rsp_data *cp;
7540         struct mgmt_pending_cmd *cmd;
7541
7542         BT_DBG("status 0x%02x", status);
7543
7544         hci_dev_lock(hdev);
7545
7546         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
7547         if (!cmd)
7548                 goto unlock;
7549
7550         cp = cmd->param;
7551
7552         if (status)
7553                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7554                                 mgmt_status(status));
7555         else
7556                 mgmt_cmd_complete(cmd->sk, hdev->id,
7557                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
7558                                 cp, sizeof(*cp));
7559
7560         mgmt_pending_remove(cmd);
7561
7562 unlock:
7563         hci_dev_unlock(hdev);
7564 }
7565
7566 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
7567                         u16 len)
7568 {
7569         struct mgmt_pending_cmd *cmd;
7570         struct hci_request req;
7571         struct mgmt_cp_set_scan_rsp_data *cp = data;
7572         struct hci_cp_le_set_scan_rsp_data rsp;
7573         int err;
7574
7575         BT_DBG("%s", hdev->name);
7576
7577         if (!lmp_le_capable(hdev))
7578                 return mgmt_cmd_status(sk, hdev->id,
7579                                 MGMT_OP_SET_SCAN_RSP_DATA,
7580                                 MGMT_STATUS_NOT_SUPPORTED);
7581
7582         hci_dev_lock(hdev);
7583
7584         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
7585                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7586                                 MGMT_STATUS_BUSY);
7587                 goto unlocked;
7588         }
7589
7590         if (len > HCI_MAX_AD_LENGTH) {
7591                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7592                                 MGMT_STATUS_INVALID_PARAMS);
7593                 goto unlocked;
7594         }
7595
7596         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
7597         if (!cmd) {
7598                 err = -ENOMEM;
7599                 goto unlocked;
7600         }
7601
7602         hci_req_init(&req, hdev);
7603
7604         memset(&rsp, 0, sizeof(rsp));
7605         memcpy(rsp.data, cp->data, len);
7606         rsp.length = len;
7607
7608         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
7609
7610         err = hci_req_run(&req, set_scan_rsp_data_complete);
7611         if (err < 0)
7612                 mgmt_pending_remove(cmd);
7613
7614 unlocked:
7615         hci_dev_unlock(hdev);
7616
7617         return err;
7618 }
7619
7620 static void set_rssi_threshold_complete(struct hci_dev *hdev,
7621                         u8 status, u16 opcode)
7622 {
7623         struct mgmt_pending_cmd *cmd;
7624
7625         BT_DBG("status 0x%02x", status);
7626
7627         hci_dev_lock(hdev);
7628
7629         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7630         if (!cmd)
7631                 goto unlock;
7632
7633         if (status)
7634                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7635                                 mgmt_status(status));
7636         else
7637                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7638                                 NULL, 0);
7639
7640         mgmt_pending_remove(cmd);
7641
7642 unlock:
7643         hci_dev_unlock(hdev);
7644 }
7645
7646 static void set_rssi_disable_complete(struct hci_dev *hdev,
7647                         u8 status, u16 opcode)
7648 {
7649         struct mgmt_pending_cmd *cmd;
7650
7651         BT_DBG("status 0x%02x", status);
7652
7653         hci_dev_lock(hdev);
7654
7655         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7656         if (!cmd)
7657                 goto unlock;
7658
7659         if (status)
7660                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7661                                 mgmt_status(status));
7662         else
7663                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7664                                 0, NULL, 0);
7665
7666         mgmt_pending_remove(cmd);
7667
7668 unlock:
7669         hci_dev_unlock(hdev);
7670 }
7671
7672 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
7673                 void *data, u16 len)
7674 {
7675         int err = 0;
7676         struct hci_cp_set_rssi_threshold th = { 0, };
7677         struct mgmt_cp_set_enable_rssi *cp = data;
7678         struct hci_conn *conn;
7679         struct mgmt_pending_cmd *cmd;
7680         struct hci_request req;
7681         __u8 dest_type;
7682
7683         hci_dev_lock(hdev);
7684
7685         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7686         if (!cmd) {
7687                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7688                                 MGMT_STATUS_FAILED);
7689                 goto unlocked;
7690         }
7691
7692         if (!lmp_le_capable(hdev)) {
7693                 mgmt_pending_remove(cmd);
7694                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7695                                 MGMT_STATUS_NOT_SUPPORTED);
7696                 goto unlocked;
7697         }
7698
7699         if (!hdev_is_powered(hdev)) {
7700                 BT_DBG("%s", hdev->name);
7701                 mgmt_pending_remove(cmd);
7702                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7703                                 MGMT_STATUS_NOT_POWERED);
7704                 goto unlocked;
7705         }
7706
7707         if (cp->link_type == 0x01)
7708                 dest_type = LE_LINK;
7709         else
7710                 dest_type = ACL_LINK;
7711
7712         /* Get LE/ACL link handle info */
7713         conn = hci_conn_hash_lookup_ba(hdev,
7714                         dest_type, &cp->bdaddr);
7715
7716         if (!conn) {
7717                 err = mgmt_cmd_complete(sk, hdev->id,
7718                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
7719                 mgmt_pending_remove(cmd);
7720                 goto unlocked;
7721         }
7722
7723         hci_req_init(&req, hdev);
7724
7725         th.hci_le_ext_opcode = 0x0B;
7726         th.mode = 0x01;
7727         th.conn_handle = conn->handle;
7728         th.alert_mask = 0x07;
7729         th.low_th = cp->low_th;
7730         th.in_range_th = cp->in_range_th;
7731         th.high_th = cp->high_th;
7732
7733         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7734         err = hci_req_run(&req, set_rssi_threshold_complete);
7735
7736         if (err < 0) {
7737                 mgmt_pending_remove(cmd);
7738                 BT_ERR("Error in requesting hci_req_run");
7739                 goto unlocked;
7740         }
7741
7742 unlocked:
7743         hci_dev_unlock(hdev);
7744         return err;
7745 }
7746
7747 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
7748                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7749 {
7750         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
7751         struct mgmt_cp_set_enable_rssi *cp = data;
7752         struct mgmt_pending_cmd *cmd;
7753
7754         if (!cp || !rp)
7755                 goto remove_cmd;
7756
7757         mgmt_rp.status = rp->status;
7758         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7759         mgmt_rp.bt_address = cp->bdaddr;
7760         mgmt_rp.link_type = cp->link_type;
7761
7762         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7763                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7764                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7765
7766         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
7767                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7768
7769         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
7770         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7771                         &mgmt_rp.bt_address, true);
7772
7773 remove_cmd:
7774         hci_dev_lock(hdev);
7775         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7776         if (cmd)
7777                 mgmt_pending_remove(cmd);
7778
7779         hci_dev_unlock(hdev);
7780 }
7781
7782 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
7783                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7784 {
7785         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
7786         struct mgmt_cp_disable_rssi *cp = data;
7787         struct mgmt_pending_cmd *cmd;
7788
7789         if (!cp || !rp)
7790                 goto remove_cmd;
7791
7792         mgmt_rp.status = rp->status;
7793         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7794         mgmt_rp.bt_address = cp->bdaddr;
7795         mgmt_rp.link_type = cp->link_type;
7796
7797         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7798                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7799                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7800
7801         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
7802                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7803
7804         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7805                         &mgmt_rp.bt_address, false);
7806
7807 remove_cmd:
7808         hci_dev_lock(hdev);
7809         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7810         if (cmd)
7811                 mgmt_pending_remove(cmd);
7812
7813         hci_dev_unlock(hdev);
7814 }
7815
7816 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
7817                 void *data, u16 len)
7818 {
7819         struct mgmt_pending_cmd *cmd;
7820         struct hci_request req;
7821         struct hci_cp_set_enable_rssi cp_en = { 0, };
7822         int err;
7823
7824         BT_DBG("Set Disable RSSI.");
7825
7826         cp_en.hci_le_ext_opcode = 0x01;
7827         cp_en.le_enable_cs_Features = 0x00;
7828         cp_en.data[0] = 0x00;
7829         cp_en.data[1] = 0x00;
7830         cp_en.data[2] = 0x00;
7831
7832         hci_dev_lock(hdev);
7833
7834         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7835         if (!cmd) {
7836                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7837                                 MGMT_STATUS_FAILED);
7838                 goto unlocked;
7839         }
7840
7841         if (!lmp_le_capable(hdev)) {
7842                 mgmt_pending_remove(cmd);
7843                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7844                                 MGMT_STATUS_NOT_SUPPORTED);
7845                 goto unlocked;
7846         }
7847
7848         if (!hdev_is_powered(hdev)) {
7849                 BT_DBG("%s", hdev->name);
7850                 mgmt_pending_remove(cmd);
7851                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7852                                 MGMT_STATUS_NOT_POWERED);
7853                 goto unlocked;
7854         }
7855
7856         hci_req_init(&req, hdev);
7857
7858         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7859                         sizeof(struct hci_cp_set_enable_rssi),
7860                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7861                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7862
7863         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7864         err = hci_req_run(&req, set_rssi_disable_complete);
7865
7866         if (err < 0) {
7867                 mgmt_pending_remove(cmd);
7868                 BT_ERR("Error in requesting hci_req_run");
7869                 goto unlocked;
7870         }
7871
7872 unlocked:
7873         hci_dev_unlock(hdev);
7874         return err;
7875 }
7876
7877 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
7878 {
7879         struct hci_cc_rsp_enable_rssi *rp = response;
7880         struct mgmt_pending_cmd *cmd_enable = NULL;
7881         struct mgmt_pending_cmd *cmd_disable = NULL;
7882         struct mgmt_cp_set_enable_rssi *cp_en;
7883         struct mgmt_cp_disable_rssi *cp_dis;
7884
7885         hci_dev_lock(hdev);
7886         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7887         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7888         hci_dev_unlock(hdev);
7889
7890         if (cmd_enable)
7891                 BT_DBG("Enable Request");
7892
7893         if (cmd_disable)
7894                 BT_DBG("Disable Request");
7895
7896         if (cmd_enable) {
7897                 cp_en = cmd_enable->param;
7898
7899                 if (status != 0x00)
7900                         return;
7901
7902                 switch (rp->le_ext_opcode) {
7903                 case 0x01:
7904                         BT_DBG("RSSI enabled.. Setting Threshold...");
7905                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
7906                                         cp_en, sizeof(*cp_en));
7907                         break;
7908
7909                 case 0x0B:
7910                         BT_DBG("Sending RSSI enable success");
7911                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
7912                                         cp_en, rp, rp->status);
7913                         break;
7914                 }
7915
7916         } else if (cmd_disable) {
7917                 cp_dis = cmd_disable->param;
7918
7919                 if (status != 0x00)
7920                         return;
7921
7922                 switch (rp->le_ext_opcode) {
7923                 case 0x01:
7924                         BT_DBG("Sending RSSI disable success");
7925                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7926                                         cp_dis, rp, rp->status);
7927                         break;
7928
7929                 case 0x0B:
7930                         /*
7931                          * Only unset RSSI Threshold values for the Link if
7932                          * RSSI is monitored for other BREDR or LE Links
7933                          */
7934                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
7935                                 BT_DBG("Unset Threshold. Other links being monitored");
7936                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7937                                                 cp_dis, rp, rp->status);
7938                         } else {
7939                                 BT_DBG("Unset Threshold. Disabling...");
7940                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
7941                                                 cp_dis, sizeof(*cp_dis));
7942                         }
7943                         break;
7944                 }
7945         }
7946 }
7947
7948 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
7949                 u16 opcode)
7950 {
7951         struct mgmt_pending_cmd *cmd;
7952
7953         BT_DBG("status 0x%02x", status);
7954
7955         hci_dev_lock(hdev);
7956
7957         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7958         if (!cmd)
7959                 goto unlock;
7960
7961         if (status)
7962                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7963                                 mgmt_status(status));
7964         else
7965                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7966                                 NULL, 0);
7967
7968         mgmt_pending_remove(cmd);
7969
7970 unlock:
7971         hci_dev_unlock(hdev);
7972 }
7973
7974 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7975                 void *data, u16 len)
7976 {
7977         struct mgmt_pending_cmd *cmd;
7978         struct hci_request req;
7979         struct mgmt_cp_set_enable_rssi *cp = data;
7980         struct hci_cp_set_enable_rssi cp_en = { 0, };
7981         int err;
7982
7983         BT_DBG("Set Enable RSSI.");
7984
7985         cp_en.hci_le_ext_opcode = 0x01;
7986         cp_en.le_enable_cs_Features = 0x04;
7987         cp_en.data[0] = 0x00;
7988         cp_en.data[1] = 0x00;
7989         cp_en.data[2] = 0x00;
7990
7991         hci_dev_lock(hdev);
7992
7993         if (!lmp_le_capable(hdev)) {
7994                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7995                                 MGMT_STATUS_NOT_SUPPORTED);
7996                 goto unlocked;
7997         }
7998
7999         if (!hdev_is_powered(hdev)) {
8000                 BT_DBG("%s", hdev->name);
8001                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
8002                                 MGMT_STATUS_NOT_POWERED);
8003                 goto unlocked;
8004         }
8005
8006         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
8007                 BT_DBG("%s", hdev->name);
8008                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
8009                                 MGMT_STATUS_BUSY);
8010                 goto unlocked;
8011         }
8012
8013         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
8014                         sizeof(*cp));
8015         if (!cmd) {
8016                 BT_DBG("%s", hdev->name);
8017                 err = -ENOMEM;
8018                 goto unlocked;
8019         }
8020
8021         /* If RSSI is already enabled directly set Threshold values */
8022         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
8023                 hci_dev_unlock(hdev);
8024                 BT_DBG("RSSI Enabled. Directly set Threshold");
8025                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
8026                 return err;
8027         }
8028
8029         hci_req_init(&req, hdev);
8030
8031         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
8032                         sizeof(struct hci_cp_set_enable_rssi),
8033                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
8034                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
8035
8036         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
8037         err = hci_req_run(&req, set_rssi_enable_complete);
8038
8039         if (err < 0) {
8040                 mgmt_pending_remove(cmd);
8041                 BT_ERR("Error in requesting hci_req_run");
8042                 goto unlocked;
8043         }
8044
8045 unlocked:
8046         hci_dev_unlock(hdev);
8047
8048         return err;
8049 }
8050
8051 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8052 {
8053         struct mgmt_pending_cmd *cmd;
8054
8055         BT_DBG("status 0x%02x", status);
8056
8057         hci_dev_lock(hdev);
8058
8059         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
8060         if (!cmd)
8061                 goto unlock;
8062
8063         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8064                         MGMT_STATUS_SUCCESS, &status, 1);
8065
8066         mgmt_pending_remove(cmd);
8067
8068 unlock:
8069         hci_dev_unlock(hdev);
8070 }
8071
8072 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
8073                         u16 len)
8074 {
8075         struct mgmt_pending_cmd *cmd;
8076         struct hci_request req;
8077         struct mgmt_cp_get_raw_rssi *cp = data;
8078         struct hci_cp_get_raw_rssi hci_cp;
8079
8080         struct hci_conn *conn;
8081         int err;
8082         __u8 dest_type;
8083
8084         BT_DBG("Get Raw RSSI.");
8085
8086         hci_dev_lock(hdev);
8087
8088         if (!lmp_le_capable(hdev)) {
8089                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8090                                 MGMT_STATUS_NOT_SUPPORTED);
8091                 goto unlocked;
8092         }
8093
8094         if (cp->link_type == 0x01)
8095                 dest_type = LE_LINK;
8096         else
8097                 dest_type = ACL_LINK;
8098
8099         /* Get LE/BREDR link handle info */
8100         conn = hci_conn_hash_lookup_ba(hdev,
8101                         dest_type, &cp->bt_address);
8102         if (!conn) {
8103                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8104                                                    MGMT_STATUS_NOT_CONNECTED);
8105                 goto unlocked;
8106         }
8107         hci_cp.conn_handle = conn->handle;
8108
8109         if (!hdev_is_powered(hdev)) {
8110                 BT_DBG("%s", hdev->name);
8111                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8112                                 MGMT_STATUS_NOT_POWERED);
8113                 goto unlocked;
8114         }
8115
8116         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
8117                 BT_DBG("%s", hdev->name);
8118                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8119                                 MGMT_STATUS_BUSY);
8120                 goto unlocked;
8121         }
8122
8123         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
8124         if (!cmd) {
8125                 BT_DBG("%s", hdev->name);
8126                 err = -ENOMEM;
8127                 goto unlocked;
8128         }
8129
8130         hci_req_init(&req, hdev);
8131
8132         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
8133         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
8134         err = hci_req_run(&req, get_raw_rssi_complete);
8135
8136         if (err < 0) {
8137                 mgmt_pending_remove(cmd);
8138                 BT_ERR("Error in requesting hci_req_run");
8139         }
8140
8141 unlocked:
8142         hci_dev_unlock(hdev);
8143
8144         return err;
8145 }
8146
8147 void mgmt_raw_rssi_response(struct hci_dev *hdev,
8148                 struct hci_cc_rp_get_raw_rssi *rp, int success)
8149 {
8150         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
8151         struct hci_conn *conn;
8152
8153         mgmt_rp.status = rp->status;
8154         mgmt_rp.rssi_dbm = rp->rssi_dbm;
8155
8156         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
8157         if (!conn)
8158                 return;
8159
8160         bacpy(&mgmt_rp.bt_address, &conn->dst);
8161         if (conn->type == LE_LINK)
8162                 mgmt_rp.link_type = 0x01;
8163         else
8164                 mgmt_rp.link_type = 0x00;
8165
8166         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
8167                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
8168 }
8169
8170 static void set_disable_threshold_complete(struct hci_dev *hdev,
8171                         u8 status, u16 opcode)
8172 {
8173         struct mgmt_pending_cmd *cmd;
8174
8175         BT_DBG("status 0x%02x", status);
8176
8177         hci_dev_lock(hdev);
8178
8179         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
8180         if (!cmd)
8181                 goto unlock;
8182
8183         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8184                         MGMT_STATUS_SUCCESS, &status, 1);
8185
8186         mgmt_pending_remove(cmd);
8187
8188 unlock:
8189         hci_dev_unlock(hdev);
8190 }
8191
8192 /** Removes monitoring for a link*/
8193 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
8194                 void *data, u16 len)
8195 {
8196         int err = 0;
8197         struct hci_cp_set_rssi_threshold th = { 0, };
8198         struct mgmt_cp_disable_rssi *cp = data;
8199         struct hci_conn *conn;
8200         struct mgmt_pending_cmd *cmd;
8201         struct hci_request req;
8202         __u8 dest_type;
8203
8204         BT_DBG("Set Disable RSSI.");
8205
8206         hci_dev_lock(hdev);
8207
8208         if (!lmp_le_capable(hdev)) {
8209                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8210                                 MGMT_STATUS_NOT_SUPPORTED);
8211                 goto unlocked;
8212         }
8213
8214         /* Get LE/ACL link handle info*/
8215         if (cp->link_type == 0x01)
8216                 dest_type = LE_LINK;
8217         else
8218                 dest_type = ACL_LINK;
8219
8220         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
8221         if (!conn) {
8222                 err = mgmt_cmd_complete(sk, hdev->id,
8223                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
8224                 goto unlocked;
8225         }
8226
8227         th.hci_le_ext_opcode = 0x0B;
8228         th.mode = 0x01;
8229         th.conn_handle = conn->handle;
8230         th.alert_mask = 0x00;
8231         th.low_th = 0x00;
8232         th.in_range_th = 0x00;
8233         th.high_th = 0x00;
8234
8235         if (!hdev_is_powered(hdev)) {
8236                 BT_DBG("%s", hdev->name);
8237                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8238                                 0, data, len);
8239                 goto unlocked;
8240         }
8241
8242         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
8243                 BT_DBG("%s", hdev->name);
8244                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8245                                 MGMT_STATUS_BUSY);
8246                 goto unlocked;
8247         }
8248
8249         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
8250                         sizeof(*cp));
8251         if (!cmd) {
8252                 BT_DBG("%s", hdev->name);
8253                 err = -ENOMEM;
8254                 goto unlocked;
8255         }
8256
8257         hci_req_init(&req, hdev);
8258
8259         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
8260         err = hci_req_run(&req, set_disable_threshold_complete);
8261         if (err < 0) {
8262                 mgmt_pending_remove(cmd);
8263                 BT_ERR("Error in requesting hci_req_run");
8264                 goto unlocked;
8265         }
8266
8267 unlocked:
8268         hci_dev_unlock(hdev);
8269
8270         return err;
8271 }
8272
8273 void mgmt_rssi_alert_evt(struct hci_dev *hdev, u16 conn_handle,
8274                 s8 alert_type, s8 rssi_dbm)
8275 {
8276         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
8277         struct hci_conn *conn;
8278
8279         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
8280                         conn_handle, alert_type, rssi_dbm);
8281
8282         conn = hci_conn_hash_lookup_handle(hdev, conn_handle);
8283
8284         if (!conn) {
8285                 BT_ERR("RSSI alert Error: Device not found for handle");
8286                 return;
8287         }
8288         bacpy(&mgmt_ev.bdaddr, &conn->dst);
8289
8290         if (conn->type == LE_LINK)
8291                 mgmt_ev.link_type = 0x01;
8292         else
8293                 mgmt_ev.link_type = 0x00;
8294
8295         mgmt_ev.alert_type = alert_type;
8296         mgmt_ev.rssi_dbm = rssi_dbm;
8297
8298         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
8299                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
8300                         NULL);
8301 }
8302
8303 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
8304 {
8305         struct mgmt_pending_cmd *cmd;
8306         u8 type;
8307         int err;
8308
8309         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
8310
8311         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
8312         if (!cmd)
8313                 return -ENOENT;
8314
8315         type = hdev->le_discovery.type;
8316
8317         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
8318                                 mgmt_status(status), &type, sizeof(type));
8319         mgmt_pending_remove(cmd);
8320
8321         return err;
8322 }
8323
8324 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
8325                 u16 opcode)
8326 {
8327         unsigned long timeout = 0;
8328
8329         BT_DBG("status %d", status);
8330
8331         if (status) {
8332                 hci_dev_lock(hdev);
8333                 mgmt_start_le_discovery_failed(hdev, status);
8334                 hci_dev_unlock(hdev);
8335                 return;
8336         }
8337
8338         hci_dev_lock(hdev);
8339         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
8340         hci_dev_unlock(hdev);
8341
8342         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
8343                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
8344
8345         if (!timeout)
8346                 return;
8347
8348         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
8349 }
8350
8351 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
8352                 void *data, u16 len)
8353 {
8354         struct mgmt_cp_start_le_discovery *cp = data;
8355         struct mgmt_pending_cmd *cmd;
8356         struct hci_cp_le_set_scan_param param_cp;
8357         struct hci_cp_le_set_scan_enable enable_cp;
8358         struct hci_request req;
8359         u8 status, own_addr_type;
8360         int err;
8361
8362         BT_DBG("%s", hdev->name);
8363
8364         if (!hdev_is_powered(hdev)) {
8365                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8366                                 MGMT_STATUS_NOT_POWERED);
8367                 goto unlock;
8368         }
8369
8370         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
8371                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8372                                 MGMT_STATUS_BUSY);
8373                 goto unlock;
8374         }
8375
8376         if (cp->type != DISCOV_TYPE_LE) {
8377                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8378                                 MGMT_STATUS_INVALID_PARAMS);
8379                 goto unlock;
8380         }
8381
8382         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
8383         if (!cmd) {
8384                 err = -ENOMEM;
8385                 goto unlock;
8386         }
8387
8388         hdev->le_discovery.type = cp->type;
8389
8390         hci_req_init(&req, hdev);
8391
8392         status = mgmt_le_support(hdev);
8393         if (status) {
8394                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8395                                 status);
8396                 mgmt_pending_remove(cmd);
8397                 goto unlock;
8398         }
8399
8400         /* If controller is scanning, it means the background scanning
8401          * is running. Thus, we should temporarily stop it in order to
8402          * set the discovery scanning parameters.
8403          */
8404         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
8405                 hci_req_add_le_scan_disable(&req, false);
8406
8407         memset(&param_cp, 0, sizeof(param_cp));
8408
8409         /* All active scans will be done with either a resolvable
8410          * private address (when privacy feature has been enabled)
8411          * or unresolvable private address.
8412          */
8413         err = hci_update_random_address_sync(hdev, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
8414         if (err < 0) {
8415                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8416                                 MGMT_STATUS_FAILED);
8417                 mgmt_pending_remove(cmd);
8418                 goto unlock;
8419         }
8420
8421         param_cp.type = hdev->le_scan_type;
8422         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
8423         param_cp.window = cpu_to_le16(hdev->le_scan_window);
8424         param_cp.own_address_type = own_addr_type;
8425         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
8426                     &param_cp);
8427
8428         memset(&enable_cp, 0, sizeof(enable_cp));
8429         enable_cp.enable = LE_SCAN_ENABLE;
8430         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
8431
8432         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
8433                     &enable_cp);
8434
8435         err = hci_req_run(&req, start_le_discovery_complete);
8436         if (err < 0)
8437                 mgmt_pending_remove(cmd);
8438         else
8439                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
8440
8441 unlock:
8442         return err;
8443 }
8444
8445 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
8446 {
8447         struct mgmt_pending_cmd *cmd;
8448         int err;
8449
8450         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
8451         if (!cmd)
8452                 return -ENOENT;
8453
8454         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
8455                                 mgmt_status(status), &hdev->le_discovery.type,
8456                                 sizeof(hdev->le_discovery.type));
8457         mgmt_pending_remove(cmd);
8458
8459         return err;
8460 }
8461
8462 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
8463                 u16 opcode)
8464 {
8465         BT_DBG("status %d", status);
8466
8467         hci_dev_lock(hdev);
8468
8469         if (status) {
8470                 mgmt_stop_le_discovery_failed(hdev, status);
8471                 goto unlock;
8472         }
8473
8474         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
8475
8476 unlock:
8477         hci_dev_unlock(hdev);
8478 }
8479
8480 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
8481                 void *data, u16 len)
8482 {
8483         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
8484         struct mgmt_pending_cmd *cmd;
8485         struct hci_request req;
8486         int err;
8487
8488         BT_DBG("%s", hdev->name);
8489
8490         hci_dev_lock(hdev);
8491
8492         if (!hci_le_discovery_active(hdev)) {
8493                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8494                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
8495                                         sizeof(mgmt_cp->type));
8496                 goto unlock;
8497         }
8498
8499         if (hdev->le_discovery.type != mgmt_cp->type) {
8500                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8501                                         MGMT_STATUS_INVALID_PARAMS,
8502                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
8503                 goto unlock;
8504         }
8505
8506         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
8507         if (!cmd) {
8508                 err = -ENOMEM;
8509                 goto unlock;
8510         }
8511
8512         hci_req_init(&req, hdev);
8513
8514         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
8515                 BT_DBG("unknown le discovery state %u",
8516                                         hdev->le_discovery.state);
8517
8518                 mgmt_pending_remove(cmd);
8519                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8520                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
8521                                         sizeof(mgmt_cp->type));
8522                 goto unlock;
8523         }
8524
8525         cancel_delayed_work(&hdev->le_scan_disable);
8526         hci_req_add_le_scan_disable(&req, false);
8527
8528         err = hci_req_run(&req, stop_le_discovery_complete);
8529         if (err < 0)
8530                 mgmt_pending_remove(cmd);
8531         else
8532                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
8533
8534 unlock:
8535         hci_dev_unlock(hdev);
8536         return err;
8537 }
8538
8539 /* Separate LE discovery */
8540 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
8541 {
8542         struct mgmt_ev_discovering ev;
8543         struct mgmt_pending_cmd *cmd;
8544
8545         BT_DBG("%s le discovering %u", hdev->name, discovering);
8546
8547         if (discovering)
8548                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
8549         else
8550                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
8551
8552         if (cmd) {
8553                 u8 type = hdev->le_discovery.type;
8554
8555                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
8556                                   sizeof(type));
8557                 mgmt_pending_remove(cmd);
8558         }
8559
8560         memset(&ev, 0, sizeof(ev));
8561         ev.type = hdev->le_discovery.type;
8562         ev.discovering = discovering;
8563
8564         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8565 }
8566
8567 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
8568                         void *data, u16 len)
8569 {
8570         int err;
8571
8572         BT_DBG("%s", hdev->name);
8573
8574         hci_dev_lock(hdev);
8575
8576         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
8577         if (err < 0)
8578                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
8579
8580         hci_dev_unlock(hdev);
8581
8582         return err;
8583 }
8584
8585 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
8586                 u16 to_multiplier)
8587 {
8588         u16 max_latency;
8589
8590         if (min > max || min < 6 || max > 3200)
8591                 return -EINVAL;
8592
8593         if (to_multiplier < 10 || to_multiplier > 3200)
8594                 return -EINVAL;
8595
8596         if (max >= to_multiplier * 8)
8597                 return -EINVAL;
8598
8599         max_latency = (to_multiplier * 8 / max) - 1;
8600
8601         if (latency > 499 || latency > max_latency)
8602                 return -EINVAL;
8603
8604         return 0;
8605 }
8606
8607 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
8608                 u16 len)
8609 {
8610         struct mgmt_cp_le_conn_update *cp = data;
8611
8612         struct hci_conn *conn;
8613         u16 min, max, latency, supervision_timeout;
8614         int err = -1;
8615
8616         if (!hdev_is_powered(hdev))
8617                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8618                                 MGMT_STATUS_NOT_POWERED);
8619
8620         min = __le16_to_cpu(cp->conn_interval_min);
8621         max = __le16_to_cpu(cp->conn_interval_max);
8622         latency = __le16_to_cpu(cp->conn_latency);
8623         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
8624
8625         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
8626                         min, max, latency, supervision_timeout);
8627
8628         err = check_le_conn_update_param(min, max, latency,
8629                         supervision_timeout);
8630
8631         if (err < 0)
8632                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8633                                 MGMT_STATUS_INVALID_PARAMS);
8634
8635         hci_dev_lock(hdev);
8636
8637         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
8638         if (!conn) {
8639                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8640                                 MGMT_STATUS_NOT_CONNECTED);
8641                 hci_dev_unlock(hdev);
8642                 return err;
8643         }
8644
8645         hci_dev_unlock(hdev);
8646
8647         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
8648
8649         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
8650                                  NULL, 0);
8651 }
8652
8653 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
8654                 u16 opcode)
8655 {
8656         struct mgmt_cp_set_manufacturer_data *cp;
8657         struct mgmt_pending_cmd *cmd;
8658
8659         BT_DBG("status 0x%02x", status);
8660
8661         hci_dev_lock(hdev);
8662
8663         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
8664         if (!cmd)
8665                 goto unlock;
8666
8667         cp = cmd->param;
8668
8669         if (status)
8670                 mgmt_cmd_status(cmd->sk, hdev->id,
8671                                 MGMT_OP_SET_MANUFACTURER_DATA,
8672                                 mgmt_status(status));
8673         else
8674                 mgmt_cmd_complete(cmd->sk, hdev->id,
8675                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
8676                                   cp, sizeof(*cp));
8677
8678         mgmt_pending_remove(cmd);
8679
8680 unlock:
8681         hci_dev_unlock(hdev);
8682 }
8683
8684 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
8685                 void *data, u16 len)
8686 {
8687         struct mgmt_pending_cmd *cmd;
8688         struct hci_request req;
8689         struct mgmt_cp_set_manufacturer_data *cp = data;
8690         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
8691         u8 old_len;
8692         int err;
8693
8694         BT_DBG("%s", hdev->name);
8695
8696         if (!lmp_bredr_capable(hdev))
8697                 return mgmt_cmd_status(sk, hdev->id,
8698                                 MGMT_OP_SET_MANUFACTURER_DATA,
8699                                 MGMT_STATUS_NOT_SUPPORTED);
8700
8701         if (cp->data[0] == 0 ||
8702                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
8703                 return mgmt_cmd_status(sk, hdev->id,
8704                                 MGMT_OP_SET_MANUFACTURER_DATA,
8705                                 MGMT_STATUS_INVALID_PARAMS);
8706
8707         if (cp->data[1] != 0xFF)
8708                 return mgmt_cmd_status(sk, hdev->id,
8709                                 MGMT_OP_SET_MANUFACTURER_DATA,
8710                                 MGMT_STATUS_NOT_SUPPORTED);
8711
8712         hci_dev_lock(hdev);
8713
8714         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
8715                 err = mgmt_cmd_status(sk, hdev->id,
8716                                 MGMT_OP_SET_MANUFACTURER_DATA,
8717                                 MGMT_STATUS_BUSY);
8718                 goto unlocked;
8719         }
8720
8721         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
8722                         len);
8723         if (!cmd) {
8724                 err = -ENOMEM;
8725                 goto unlocked;
8726         }
8727
8728         hci_req_init(&req, hdev);
8729
8730         /* if new data is same as previous data then return command
8731          * complete event
8732          */
8733         if (hdev->manufacturer_len == cp->data[0] - 1 &&
8734             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
8735                 mgmt_pending_remove(cmd);
8736                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
8737                                   0, cp, sizeof(*cp));
8738                 err = 0;
8739                 goto unlocked;
8740         }
8741
8742         old_len = hdev->manufacturer_len;
8743         if (old_len > 0)
8744                 memcpy(old_data, hdev->manufacturer_data, old_len);
8745
8746         hdev->manufacturer_len = cp->data[0] - 1;
8747         if (hdev->manufacturer_len > 0)
8748                 memcpy(hdev->manufacturer_data, cp->data + 2,
8749                                 hdev->manufacturer_len);
8750
8751         hci_update_eir_sync(hdev);
8752
8753         err = hci_req_run(&req, set_manufacturer_data_complete);
8754         if (err < 0) {
8755                 mgmt_pending_remove(cmd);
8756                 goto failed;
8757         }
8758
8759 unlocked:
8760         hci_dev_unlock(hdev);
8761
8762         return err;
8763
8764 failed:
8765         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
8766         hdev->manufacturer_len = old_len;
8767         if (hdev->manufacturer_len > 0)
8768                 memcpy(hdev->manufacturer_data, old_data,
8769                        hdev->manufacturer_len);
8770         hci_dev_unlock(hdev);
8771         return err;
8772 }
8773
8774 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
8775                 void *data, u16 len)
8776 {
8777         struct mgmt_cp_le_set_scan_params *cp = data;
8778         __u16 interval, window;
8779         int err;
8780
8781         BT_DBG("%s", hdev->name);
8782
8783         if (!lmp_le_capable(hdev))
8784                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8785                                 MGMT_STATUS_NOT_SUPPORTED);
8786
8787         interval = __le16_to_cpu(cp->interval);
8788
8789         if (interval < 0x0004 || interval > 0x4000)
8790                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8791                                 MGMT_STATUS_INVALID_PARAMS);
8792
8793         window = __le16_to_cpu(cp->window);
8794
8795         if (window < 0x0004 || window > 0x4000)
8796                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8797                                 MGMT_STATUS_INVALID_PARAMS);
8798
8799         if (window > interval)
8800                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8801                                 MGMT_STATUS_INVALID_PARAMS);
8802
8803         hci_dev_lock(hdev);
8804
8805         hdev->le_scan_type = cp->type;
8806         hdev->le_scan_interval = interval;
8807         hdev->le_scan_window = window;
8808
8809         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
8810                                 NULL, 0);
8811
8812         /* If background scan is running, restart it so new parameters are
8813          * loaded.
8814          */
8815         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
8816             hdev->discovery.state == DISCOVERY_STOPPED) {
8817                 struct hci_request req;
8818
8819                 hci_req_init(&req, hdev);
8820
8821                 hci_req_add_le_scan_disable(&req, false);
8822                 hci_req_add_le_passive_scan(&req);
8823
8824                 hci_req_run(&req, NULL);
8825         }
8826
8827         hci_dev_unlock(hdev);
8828
8829         return err;
8830 }
8831
8832 static int set_voice_setting(struct sock *sk, struct hci_dev *hdev,
8833                 void *data, u16 len)
8834 {
8835         struct mgmt_cp_set_voice_setting *cp = data;
8836         struct hci_conn *conn;
8837         struct hci_conn *sco_conn;
8838
8839         int err;
8840
8841         BT_DBG("%s", hdev->name);
8842
8843         if (!lmp_bredr_capable(hdev)) {
8844                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING,
8845                                 MGMT_STATUS_NOT_SUPPORTED);
8846         }
8847
8848         hci_dev_lock(hdev);
8849
8850         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
8851         if (!conn) {
8852                 err = mgmt_cmd_complete(sk, hdev->id,
8853                                 MGMT_OP_SET_VOICE_SETTING, 0, NULL, 0);
8854                 goto unlock;
8855         }
8856
8857         conn->voice_setting = cp->voice_setting;
8858         conn->sco_role = cp->sco_role;
8859
8860         sco_conn = hci_conn_hash_lookup_sco(hdev);
8861         if (sco_conn && bacmp(&sco_conn->dst, &cp->bdaddr) != 0) {
8862                 BT_ERR("There is other SCO connection.");
8863                 goto done;
8864         }
8865
8866         if (conn->sco_role == MGMT_SCO_ROLE_HANDSFREE) {
8867                 if (conn->voice_setting == 0x0063)
8868                         sco_connect_set_wbc(hdev);
8869                 else
8870                         sco_connect_set_nbc(hdev);
8871         } else {
8872                 if (conn->voice_setting == 0x0063)
8873                         sco_connect_set_gw_wbc(hdev);
8874                 else
8875                         sco_connect_set_gw_nbc(hdev);
8876         }
8877
8878 done:
8879         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
8880                         cp, sizeof(cp));
8881
8882 unlock:
8883         hci_dev_unlock(hdev);
8884         return err;
8885 }
8886
8887 static int get_adv_tx_power(struct sock *sk, struct hci_dev *hdev,
8888                 void *data, u16 len)
8889 {
8890         struct mgmt_rp_get_adv_tx_power *rp;
8891         size_t rp_len;
8892         int err;
8893
8894         BT_DBG("%s", hdev->name);
8895
8896         hci_dev_lock(hdev);
8897
8898         rp_len = sizeof(*rp);
8899         rp = kmalloc(rp_len, GFP_KERNEL);
8900         if (!rp) {
8901                 err = -ENOMEM;
8902                 goto unlock;
8903         }
8904
8905         rp->adv_tx_power = hdev->adv_tx_power;
8906
8907         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_TX_POWER, 0, rp,
8908                                 rp_len);
8909
8910         kfree(rp);
8911
8912 unlock:
8913         hci_dev_unlock(hdev);
8914
8915         return err;
8916 }
8917
8918 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
8919 {
8920         struct mgmt_ev_hardware_error ev;
8921
8922         ev.error_code = err_code;
8923         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
8924 }
8925
8926 void mgmt_tx_timeout_error(struct hci_dev *hdev)
8927 {
8928         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
8929 }
8930
8931 void mgmt_multi_adv_state_change_evt(struct hci_dev *hdev, u8 adv_instance,
8932                 u8 state_change_reason, u16 connection_handle)
8933 {
8934         struct mgmt_ev_vendor_specific_multi_adv_state_changed mgmt_ev;
8935
8936         BT_DBG("Multi adv state changed [%2.2X %2.2X %2.2X]",
8937                adv_instance, state_change_reason, connection_handle);
8938
8939         mgmt_ev.adv_instance = adv_instance;
8940         mgmt_ev.state_change_reason = state_change_reason;
8941         mgmt_ev.connection_handle = connection_handle;
8942
8943         mgmt_event(MGMT_EV_MULTI_ADV_STATE_CHANGED, hdev, &mgmt_ev,
8944                 sizeof(struct mgmt_ev_vendor_specific_multi_adv_state_changed),
8945                 NULL);
8946 }
8947
8948 static int enable_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8949                 void *data, u16 len)
8950 {
8951         int err;
8952         struct mgmt_cp_enable_6lowpan *cp = data;
8953
8954         BT_DBG("%s", hdev->name);
8955
8956         hci_dev_lock(hdev);
8957
8958         if (!hdev_is_powered(hdev)) {
8959                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8960                                       MGMT_STATUS_NOT_POWERED);
8961                 goto unlocked;
8962         }
8963
8964         if (!lmp_le_capable(hdev)) {
8965                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8966                                       MGMT_STATUS_NOT_SUPPORTED);
8967                 goto unlocked;
8968         }
8969
8970         if (cp->enable_6lowpan)
8971                 bt_6lowpan_enable();
8972         else
8973                 bt_6lowpan_disable();
8974
8975         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8976                                 MGMT_STATUS_SUCCESS, NULL, 0);
8977 unlocked:
8978         hci_dev_unlock(hdev);
8979         return err;
8980 }
8981
8982 static int connect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8983                 void *data, u16 len)
8984 {
8985         struct mgmt_cp_connect_6lowpan *cp = data;
8986         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
8987         int err;
8988
8989         BT_DBG("%s", hdev->name);
8990
8991         hci_dev_lock(hdev);
8992
8993         if (!lmp_le_capable(hdev)) {
8994                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8995                                       MGMT_STATUS_NOT_SUPPORTED);
8996                 goto unlocked;
8997         }
8998
8999         if (!hdev_is_powered(hdev)) {
9000                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
9001                                       MGMT_STATUS_REJECTED);
9002                 goto unlocked;
9003         }
9004
9005         if (bdaddr_type_is_le(cp->addr.type)) {
9006                 if (cp->addr.type == BDADDR_LE_PUBLIC)
9007                         addr_type = ADDR_LE_DEV_PUBLIC;
9008                 else
9009                         addr_type = ADDR_LE_DEV_RANDOM;
9010         } else {
9011                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
9012                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
9013                 goto unlocked;
9014         }
9015
9016         hci_dev_unlock(hdev);
9017
9018         /* 6lowpan Connect */
9019         err = _bt_6lowpan_connect(&cp->addr.bdaddr, cp->addr.type);
9020
9021         hci_dev_lock(hdev);
9022
9023         if (err < 0) {
9024                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
9025                                         MGMT_STATUS_REJECTED, NULL, 0);
9026
9027                 goto unlocked;
9028         }
9029
9030         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
9031                                 NULL, 0);
9032 unlocked:
9033         hci_dev_unlock(hdev);
9034         return err;
9035 }
9036
9037 static int disconnect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
9038                 void *data, u16 len)
9039 {
9040         struct mgmt_cp_disconnect_6lowpan *cp = data;
9041         struct hci_conn *conn = NULL;
9042         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
9043         int err;
9044
9045         BT_DBG("%s", hdev->name);
9046
9047         hci_dev_lock(hdev);
9048
9049         if (!lmp_le_capable(hdev)) {
9050                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
9051                                       MGMT_STATUS_NOT_SUPPORTED);
9052                 goto unlocked;
9053         }
9054
9055         if (!hdev_is_powered(hdev)) {
9056                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
9057                                       MGMT_STATUS_REJECTED);
9058                 goto unlocked;
9059         }
9060
9061         if (bdaddr_type_is_le(cp->addr.type)) {
9062                 if (cp->addr.type == BDADDR_LE_PUBLIC)
9063                         addr_type = ADDR_LE_DEV_PUBLIC;
9064                 else
9065                         addr_type = ADDR_LE_DEV_RANDOM;
9066         } else {
9067                 err = mgmt_cmd_complete(sk, hdev->id,
9068                                         MGMT_OP_DISCONNECT_6LOWPAN,
9069                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
9070                 goto unlocked;
9071         }
9072
9073         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
9074         if (!conn) {
9075                 err = mgmt_cmd_complete(sk, hdev->id,
9076                                         MGMT_OP_DISCONNECT_6LOWPAN,
9077                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
9078                 goto unlocked;
9079         }
9080
9081         if (conn->dst_type != addr_type) {
9082                 err = mgmt_cmd_complete(sk, hdev->id,
9083                                         MGMT_OP_DISCONNECT_6LOWPAN,
9084                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
9085                 goto unlocked;
9086         }
9087
9088         if (conn->state != BT_CONNECTED) {
9089                 err = mgmt_cmd_complete(sk, hdev->id,
9090                                         MGMT_OP_DISCONNECT_6LOWPAN,
9091                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
9092                 goto unlocked;
9093         }
9094
9095         /* 6lowpan Disconnect */
9096         err = _bt_6lowpan_disconnect(conn->l2cap_data, cp->addr.type);
9097         if (err < 0) {
9098                 err = mgmt_cmd_complete(sk, hdev->id,
9099                                         MGMT_OP_DISCONNECT_6LOWPAN,
9100                                         MGMT_STATUS_REJECTED, NULL, 0);
9101                 goto unlocked;
9102         }
9103
9104         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
9105                                 NULL, 0);
9106
9107 unlocked:
9108         hci_dev_unlock(hdev);
9109         return err;
9110 }
9111
9112 void mgmt_6lowpan_conn_changed(struct hci_dev *hdev, char if_name[16],
9113                 bdaddr_t *bdaddr, u8 addr_type, bool connected)
9114 {
9115         char buf[512];
9116         struct mgmt_ev_6lowpan_conn_state_changed *ev = (void *)buf;
9117         size_t ev_size;
9118
9119         memset(buf, 0, sizeof(buf));
9120         bacpy(&ev->addr.bdaddr, bdaddr);
9121         ev->addr.type = addr_type;
9122         ev->connected = connected;
9123         memcpy(ev->ifname, (__u8 *)if_name, 16);
9124
9125         ev_size = sizeof(*ev);
9126
9127         mgmt_event(MGMT_EV_6LOWPAN_CONN_STATE_CHANGED, hdev, ev, ev_size, NULL);
9128 }
9129
9130 void mgmt_le_read_maximum_data_length_complete(struct hci_dev *hdev, u8 status)
9131 {
9132         struct mgmt_pending_cmd *cmd;
9133         struct mgmt_rp_le_read_maximum_data_length rp;
9134
9135         BT_DBG("%s status %u", hdev->name, status);
9136
9137         cmd = pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev);
9138         if (!cmd)
9139                 return;
9140
9141         if (status)
9142                 mgmt_cmd_status(cmd->sk, hdev->id,
9143                                 MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9144                                 mgmt_status(status));
9145
9146         memset(&rp, 0, sizeof(rp));
9147
9148         rp.max_tx_octets = cpu_to_le16(hdev->le_max_tx_len);
9149         rp.max_tx_time = cpu_to_le16(hdev->le_max_tx_time);
9150         rp.max_rx_octets = cpu_to_le16(hdev->le_max_rx_len);
9151         rp.max_rx_time = cpu_to_le16(hdev->le_max_rx_time);
9152
9153         mgmt_cmd_complete(cmd->sk, hdev->id,
9154                           MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, 0,
9155                           &rp, sizeof(rp));
9156
9157         mgmt_pending_remove(cmd);
9158 }
9159
9160 static int read_maximum_le_data_length(struct sock *sk,
9161                 struct hci_dev *hdev, void *data, u16 len)
9162 {
9163         struct mgmt_pending_cmd *cmd;
9164         int err;
9165
9166         BT_DBG("read_maximum_le_data_length  %s", hdev->name);
9167
9168         hci_dev_lock(hdev);
9169
9170         if (!hdev_is_powered(hdev)) {
9171                 err = mgmt_cmd_status(sk, hdev->id,
9172                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9173                                       MGMT_STATUS_NOT_POWERED);
9174                 goto unlock;
9175         }
9176
9177         if (!lmp_le_capable(hdev)) {
9178                 err = mgmt_cmd_status(sk, hdev->id,
9179                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9180                                       MGMT_STATUS_NOT_SUPPORTED);
9181                 goto unlock;
9182         }
9183
9184         if (pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev)) {
9185                 err = mgmt_cmd_status(sk, hdev->id,
9186                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9187                                       MGMT_STATUS_BUSY);
9188                 goto unlock;
9189         }
9190
9191         cmd = mgmt_pending_add(sk, MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9192                                hdev, data, len);
9193         if (!cmd) {
9194                 err = -ENOMEM;
9195                 goto unlock;
9196         }
9197
9198         err = hci_send_cmd(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
9199         if (err < 0)
9200                 mgmt_pending_remove(cmd);
9201
9202 unlock:
9203         hci_dev_unlock(hdev);
9204         return err;
9205 }
9206
9207 void mgmt_le_write_host_suggested_data_length_complete(struct hci_dev *hdev,
9208                 u8 status)
9209 {
9210         struct mgmt_pending_cmd *cmd;
9211
9212         BT_DBG("status 0x%02x", status);
9213
9214         hci_dev_lock(hdev);
9215
9216         cmd = pending_find(MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH, hdev);
9217         if (!cmd) {
9218                 BT_ERR("cmd not found in the pending list");
9219                 goto unlock;
9220         }
9221
9222         if (status)
9223                 mgmt_cmd_status(cmd->sk, hdev->id,
9224                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9225                                 mgmt_status(status));
9226         else
9227                 mgmt_cmd_complete(cmd->sk, hdev->id,
9228                                   MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9229                                   0, NULL, 0);
9230
9231         mgmt_pending_remove(cmd);
9232
9233 unlock:
9234         hci_dev_unlock(hdev);
9235 }
9236
9237 static int write_host_suggested_le_data_length(struct sock *sk,
9238                 struct hci_dev *hdev, void *data, u16 len)
9239 {
9240         struct mgmt_pending_cmd *cmd;
9241         struct mgmt_cp_le_write_host_suggested_data_length *cp = data;
9242         struct hci_cp_le_write_def_data_len hci_data;
9243         int err = 0;
9244
9245         BT_DBG("Write host suggested data length request for %s", hdev->name);
9246
9247         hci_dev_lock(hdev);
9248
9249         if (!hdev_is_powered(hdev)) {
9250                 err = mgmt_cmd_status(sk, hdev->id,
9251                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9252                                 MGMT_STATUS_NOT_POWERED);
9253                 goto unlock;
9254         }
9255
9256         if (!lmp_le_capable(hdev)) {
9257                 err = mgmt_cmd_status(sk, hdev->id,
9258                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9259                                 MGMT_STATUS_NOT_SUPPORTED);
9260                 goto unlock;
9261         }
9262
9263         if (pending_find(MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH, hdev)) {
9264                 err = mgmt_cmd_status(sk, hdev->id,
9265                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9266                                 MGMT_STATUS_BUSY);
9267                 goto unlock;
9268         }
9269
9270         cmd = mgmt_pending_add(sk, MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9271                                hdev, data, len);
9272         if (!cmd) {
9273                 err = -ENOMEM;
9274                 goto unlock;
9275         }
9276
9277         hci_data.tx_len = cp->def_tx_octets;
9278         hci_data.tx_time = cp->def_tx_time;
9279
9280         err = hci_send_cmd(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN,
9281                            sizeof(hci_data), &hci_data);
9282         if (err < 0)
9283                 mgmt_pending_remove(cmd);
9284
9285 unlock:
9286         hci_dev_unlock(hdev);
9287
9288         return err;
9289 }
9290
9291 void mgmt_le_read_host_suggested_data_length_complete(struct hci_dev *hdev,
9292                 u8 status)
9293 {
9294         struct mgmt_pending_cmd *cmd;
9295         struct mgmt_rp_le_read_host_suggested_data_length rp;
9296
9297         BT_DBG("%s status %u", hdev->name, status);
9298
9299         cmd = pending_find(MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, hdev);
9300         if (!cmd) {
9301                 BT_ERR("cmd not found in the pending list");
9302                 return;
9303         }
9304
9305         if (status)
9306                 mgmt_cmd_status(cmd->sk, hdev->id,
9307                         MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
9308                         mgmt_status(status));
9309
9310         memset(&rp, 0, sizeof(rp));
9311
9312         rp.def_tx_octets = cpu_to_le16(hdev->le_def_tx_len);
9313         rp.def_tx_time = cpu_to_le16(hdev->le_def_tx_time);
9314
9315         mgmt_cmd_complete(cmd->sk, hdev->id,
9316                           MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, 0,
9317                           &rp, sizeof(rp));
9318
9319         mgmt_pending_remove(cmd);
9320 }
9321
9322 static int read_host_suggested_data_length(struct sock *sk,
9323                 struct hci_dev *hdev, void *data, u16 len)
9324 {
9325         struct mgmt_pending_cmd *cmd;
9326         int err;
9327
9328         BT_DBG("read_host_suggested_data_length %s", hdev->name);
9329
9330         hci_dev_lock(hdev);
9331
9332         if (!hdev_is_powered(hdev)) {
9333                 err = mgmt_cmd_status(sk, hdev->id,
9334                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
9335                                 MGMT_STATUS_NOT_POWERED);
9336                 goto unlock;
9337         }
9338
9339         if (!lmp_le_capable(hdev)) {
9340                 err = mgmt_cmd_status(sk, hdev->id,
9341                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
9342                                 MGMT_STATUS_NOT_SUPPORTED);
9343                 goto unlock;
9344         }
9345
9346         if (pending_find(MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, hdev)) {
9347                 err = mgmt_cmd_status(sk, hdev->id,
9348                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
9349                                 MGMT_STATUS_BUSY);
9350                 goto unlock;
9351         }
9352
9353         cmd = mgmt_pending_add(sk, MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
9354                                hdev, data, len);
9355         if (!cmd) {
9356                 err = -ENOMEM;
9357                 goto unlock;
9358         }
9359
9360         err = hci_send_cmd(hdev, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
9361         if (err < 0)
9362                 mgmt_pending_remove(cmd);
9363
9364 unlock:
9365         hci_dev_unlock(hdev);
9366
9367         return err;
9368 }
9369
9370 static int set_le_data_length_params(struct sock *sk, struct hci_dev *hdev,
9371                 void *data, u16 len)
9372 {
9373         struct mgmt_cp_le_set_data_length *cp = data;
9374         struct mgmt_rp_le_set_data_length *rp;
9375         struct mgmt_pending_cmd *cmd;
9376         struct hci_conn *conn;
9377         int err = 0;
9378         u16 max_tx_octets, max_tx_time;
9379         size_t rp_len;
9380
9381         BT_INFO("Set Data length for the device %s", hdev->name);
9382
9383         hci_dev_lock(hdev);
9384
9385         rp_len = sizeof(*rp);
9386         rp = kmalloc(rp_len, GFP_KERNEL);
9387         if (!rp) {
9388                 err = -ENOMEM;
9389                 goto unlock;
9390         }
9391
9392         if (!hdev_is_powered(hdev)) {
9393                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
9394                                       MGMT_STATUS_NOT_POWERED);
9395                 goto unlock;
9396         }
9397
9398         if (!lmp_le_capable(hdev)) {
9399                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
9400                                       MGMT_STATUS_NOT_SUPPORTED);
9401                 goto unlock;
9402         }
9403
9404         if (pending_find(MGMT_OP_LE_SET_DATA_LENGTH, hdev)) {
9405                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
9406                                       MGMT_STATUS_BUSY);
9407                 goto unlock;
9408         }
9409
9410         cmd = mgmt_pending_add(sk, MGMT_OP_LE_SET_DATA_LENGTH, hdev, data, len);
9411         if (!cmd) {
9412                 err = -ENOMEM;
9413                 goto unlock;
9414         }
9415
9416         max_tx_octets = __le16_to_cpu(cp->max_tx_octets);
9417         max_tx_time = __le16_to_cpu(cp->max_tx_time);
9418
9419         BT_DBG("max_tx_octets 0x%4.4x max_tx_time 0x%4.4x latency",
9420                max_tx_octets, max_tx_time);
9421
9422         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
9423         if (!conn) {
9424                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
9425                                 MGMT_STATUS_NOT_CONNECTED);
9426                 goto unlock;
9427         }
9428
9429         hci_dev_unlock(hdev);
9430
9431         err = hci_le_set_data_length(conn, max_tx_octets, max_tx_time);
9432         if (err < 0)
9433                 mgmt_pending_remove(cmd);
9434
9435         rp->handle = conn->handle;
9436         rp->status = 0;
9437
9438         hci_dev_lock(hdev);
9439         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH, 0,
9440                                 rp, rp_len);
9441 unlock:
9442         kfree(rp);
9443         hci_dev_unlock(hdev);
9444
9445         return err;
9446 }
9447
9448 void mgmt_le_data_length_change_complete(struct hci_dev *hdev,
9449                 bdaddr_t *bdaddr, u16 tx_octets, u16 tx_time,
9450                 u16 rx_octets, u16 rx_time)
9451 {
9452         struct mgmt_ev_le_data_length_changed ev;
9453
9454         bacpy(&ev.addr.bdaddr, bdaddr);
9455         ev.max_tx_octets = tx_octets;
9456         ev.max_tx_time = tx_time;
9457         ev.max_rx_octets = rx_octets;
9458         ev.max_rx_time = rx_time;
9459
9460         mgmt_event(MGMT_EV_LE_DATA_LENGTH_CHANGED, hdev, &ev, sizeof(ev), NULL);
9461 }
9462 #endif /* TIZEN_BT */
9463
9464 static bool ltk_is_valid(struct mgmt_ltk_info *key)
9465 {
9466         if (key->initiator != 0x00 && key->initiator != 0x01)
9467                 return false;
9468
9469         switch (key->addr.type) {
9470         case BDADDR_LE_PUBLIC:
9471                 return true;
9472
9473         case BDADDR_LE_RANDOM:
9474                 /* Two most significant bits shall be set */
9475                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
9476                         return false;
9477                 return true;
9478         }
9479
9480         return false;
9481 }
9482
9483 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
9484                                void *cp_data, u16 len)
9485 {
9486         struct mgmt_cp_load_long_term_keys *cp = cp_data;
9487         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
9488                                    sizeof(struct mgmt_ltk_info));
9489         u16 key_count, expected_len;
9490         int i, err;
9491
9492         bt_dev_dbg(hdev, "sock %p", sk);
9493
9494         if (!lmp_le_capable(hdev))
9495                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
9496                                        MGMT_STATUS_NOT_SUPPORTED);
9497
9498         key_count = __le16_to_cpu(cp->key_count);
9499         if (key_count > max_key_count) {
9500                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
9501                            key_count);
9502                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
9503                                        MGMT_STATUS_INVALID_PARAMS);
9504         }
9505
9506         expected_len = struct_size(cp, keys, key_count);
9507         if (expected_len != len) {
9508                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
9509                            expected_len, len);
9510                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
9511                                        MGMT_STATUS_INVALID_PARAMS);
9512         }
9513
9514         bt_dev_dbg(hdev, "key_count %u", key_count);
9515
9516         for (i = 0; i < key_count; i++) {
9517                 struct mgmt_ltk_info *key = &cp->keys[i];
9518
9519                 if (!ltk_is_valid(key))
9520                         return mgmt_cmd_status(sk, hdev->id,
9521                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
9522                                                MGMT_STATUS_INVALID_PARAMS);
9523         }
9524
9525         hci_dev_lock(hdev);
9526
9527         hci_smp_ltks_clear(hdev);
9528
9529         for (i = 0; i < key_count; i++) {
9530                 struct mgmt_ltk_info *key = &cp->keys[i];
9531                 u8 type, authenticated;
9532
9533                 if (hci_is_blocked_key(hdev,
9534                                        HCI_BLOCKED_KEY_TYPE_LTK,
9535                                        key->val)) {
9536                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
9537                                     &key->addr.bdaddr);
9538                         continue;
9539                 }
9540
9541                 switch (key->type) {
9542                 case MGMT_LTK_UNAUTHENTICATED:
9543                         authenticated = 0x00;
9544                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
9545                         break;
9546                 case MGMT_LTK_AUTHENTICATED:
9547                         authenticated = 0x01;
9548                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
9549                         break;
9550                 case MGMT_LTK_P256_UNAUTH:
9551                         authenticated = 0x00;
9552                         type = SMP_LTK_P256;
9553                         break;
9554                 case MGMT_LTK_P256_AUTH:
9555                         authenticated = 0x01;
9556                         type = SMP_LTK_P256;
9557                         break;
9558                 case MGMT_LTK_P256_DEBUG:
9559                         authenticated = 0x00;
9560                         type = SMP_LTK_P256_DEBUG;
9561                         fallthrough;
9562                 default:
9563                         continue;
9564                 }
9565
9566                 hci_add_ltk(hdev, &key->addr.bdaddr,
9567                             le_addr_type(key->addr.type), type, authenticated,
9568                             key->val, key->enc_size, key->ediv, key->rand);
9569         }
9570
9571         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
9572                            NULL, 0);
9573
9574         hci_dev_unlock(hdev);
9575
9576         return err;
9577 }
9578
9579 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
9580 {
9581         struct mgmt_pending_cmd *cmd = data;
9582         struct hci_conn *conn = cmd->user_data;
9583         struct mgmt_cp_get_conn_info *cp = cmd->param;
9584         struct mgmt_rp_get_conn_info rp;
9585         u8 status;
9586
9587         bt_dev_dbg(hdev, "err %d", err);
9588
9589         memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
9590
9591         status = mgmt_status(err);
9592         if (status == MGMT_STATUS_SUCCESS) {
9593                 rp.rssi = conn->rssi;
9594                 rp.tx_power = conn->tx_power;
9595                 rp.max_tx_power = conn->max_tx_power;
9596         } else {
9597                 rp.rssi = HCI_RSSI_INVALID;
9598                 rp.tx_power = HCI_TX_POWER_INVALID;
9599                 rp.max_tx_power = HCI_TX_POWER_INVALID;
9600         }
9601
9602         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
9603                           &rp, sizeof(rp));
9604
9605         mgmt_pending_free(cmd);
9606 }
9607
9608 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
9609 {
9610         struct mgmt_pending_cmd *cmd = data;
9611         struct mgmt_cp_get_conn_info *cp = cmd->param;
9612         struct hci_conn *conn;
9613         int err;
9614         __le16   handle;
9615
9616         /* Make sure we are still connected */
9617         if (cp->addr.type == BDADDR_BREDR)
9618                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
9619                                                &cp->addr.bdaddr);
9620         else
9621                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
9622
9623         if (!conn || conn->state != BT_CONNECTED)
9624                 return MGMT_STATUS_NOT_CONNECTED;
9625
9626         cmd->user_data = conn;
9627         handle = cpu_to_le16(conn->handle);
9628
9629         /* Refresh RSSI each time */
9630         err = hci_read_rssi_sync(hdev, handle);
9631
9632         /* For LE links TX power does not change thus we don't need to
9633          * query for it once value is known.
9634          */
9635         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
9636                      conn->tx_power == HCI_TX_POWER_INVALID))
9637                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
9638
9639         /* Max TX power needs to be read only once per connection */
9640         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
9641                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
9642
9643         return err;
9644 }
9645
9646 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
9647                          u16 len)
9648 {
9649         struct mgmt_cp_get_conn_info *cp = data;
9650         struct mgmt_rp_get_conn_info rp;
9651         struct hci_conn *conn;
9652         unsigned long conn_info_age;
9653         int err = 0;
9654
9655         bt_dev_dbg(hdev, "sock %p", sk);
9656
9657         memset(&rp, 0, sizeof(rp));
9658         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
9659         rp.addr.type = cp->addr.type;
9660
9661         if (!bdaddr_type_is_valid(cp->addr.type))
9662                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9663                                          MGMT_STATUS_INVALID_PARAMS,
9664                                          &rp, sizeof(rp));
9665
9666         hci_dev_lock(hdev);
9667
9668         if (!hdev_is_powered(hdev)) {
9669                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9670                                         MGMT_STATUS_NOT_POWERED, &rp,
9671                                         sizeof(rp));
9672                 goto unlock;
9673         }
9674
9675         if (cp->addr.type == BDADDR_BREDR)
9676                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
9677                                                &cp->addr.bdaddr);
9678         else
9679                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
9680
9681         if (!conn || conn->state != BT_CONNECTED) {
9682                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9683                                         MGMT_STATUS_NOT_CONNECTED, &rp,
9684                                         sizeof(rp));
9685                 goto unlock;
9686         }
9687
9688         /* To avoid client trying to guess when to poll again for information we
9689          * calculate conn info age as random value between min/max set in hdev.
9690          */
9691         conn_info_age = hdev->conn_info_min_age +
9692                         prandom_u32_max(hdev->conn_info_max_age -
9693                                         hdev->conn_info_min_age);
9694
9695         /* Query controller to refresh cached values if they are too old or were
9696          * never read.
9697          */
9698         if (time_after(jiffies, conn->conn_info_timestamp +
9699                        msecs_to_jiffies(conn_info_age)) ||
9700             !conn->conn_info_timestamp) {
9701                 struct mgmt_pending_cmd *cmd;
9702
9703                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
9704                                        len);
9705                 if (!cmd) {
9706                         err = -ENOMEM;
9707                 } else {
9708                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
9709                                                  cmd, get_conn_info_complete);
9710                 }
9711
9712                 if (err < 0) {
9713                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9714                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
9715
9716                         if (cmd)
9717                                 mgmt_pending_free(cmd);
9718
9719                         goto unlock;
9720                 }
9721
9722                 conn->conn_info_timestamp = jiffies;
9723         } else {
9724                 /* Cache is valid, just reply with values cached in hci_conn */
9725                 rp.rssi = conn->rssi;
9726                 rp.tx_power = conn->tx_power;
9727                 rp.max_tx_power = conn->max_tx_power;
9728
9729                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9730                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9731         }
9732
9733 unlock:
9734         hci_dev_unlock(hdev);
9735         return err;
9736 }
9737
9738 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
9739 {
9740         struct mgmt_pending_cmd *cmd = data;
9741         struct mgmt_cp_get_clock_info *cp = cmd->param;
9742         struct mgmt_rp_get_clock_info rp;
9743         struct hci_conn *conn = cmd->user_data;
9744         u8 status = mgmt_status(err);
9745
9746         bt_dev_dbg(hdev, "err %d", err);
9747
9748         memset(&rp, 0, sizeof(rp));
9749         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
9750         rp.addr.type = cp->addr.type;
9751
9752         if (err)
9753                 goto complete;
9754
9755         rp.local_clock = cpu_to_le32(hdev->clock);
9756
9757         if (conn) {
9758                 rp.piconet_clock = cpu_to_le32(conn->clock);
9759                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
9760         }
9761
9762 complete:
9763         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
9764                           sizeof(rp));
9765
9766         mgmt_pending_free(cmd);
9767 }
9768
9769 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
9770 {
9771         struct mgmt_pending_cmd *cmd = data;
9772         struct mgmt_cp_get_clock_info *cp = cmd->param;
9773         struct hci_cp_read_clock hci_cp;
9774         struct hci_conn *conn;
9775
9776         memset(&hci_cp, 0, sizeof(hci_cp));
9777         hci_read_clock_sync(hdev, &hci_cp);
9778
9779         /* Make sure connection still exists */
9780         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
9781         if (!conn || conn->state != BT_CONNECTED)
9782                 return MGMT_STATUS_NOT_CONNECTED;
9783
9784         cmd->user_data = conn;
9785         hci_cp.handle = cpu_to_le16(conn->handle);
9786         hci_cp.which = 0x01; /* Piconet clock */
9787
9788         return hci_read_clock_sync(hdev, &hci_cp);
9789 }
9790
9791 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
9792                                                                 u16 len)
9793 {
9794         struct mgmt_cp_get_clock_info *cp = data;
9795         struct mgmt_rp_get_clock_info rp;
9796         struct mgmt_pending_cmd *cmd;
9797         struct hci_conn *conn;
9798         int err;
9799
9800         bt_dev_dbg(hdev, "sock %p", sk);
9801
9802         memset(&rp, 0, sizeof(rp));
9803         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
9804         rp.addr.type = cp->addr.type;
9805
9806         if (cp->addr.type != BDADDR_BREDR)
9807                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
9808                                          MGMT_STATUS_INVALID_PARAMS,
9809                                          &rp, sizeof(rp));
9810
9811         hci_dev_lock(hdev);
9812
9813         if (!hdev_is_powered(hdev)) {
9814                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
9815                                         MGMT_STATUS_NOT_POWERED, &rp,
9816                                         sizeof(rp));
9817                 goto unlock;
9818         }
9819
9820         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
9821                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
9822                                                &cp->addr.bdaddr);
9823                 if (!conn || conn->state != BT_CONNECTED) {
9824                         err = mgmt_cmd_complete(sk, hdev->id,
9825                                                 MGMT_OP_GET_CLOCK_INFO,
9826                                                 MGMT_STATUS_NOT_CONNECTED,
9827                                                 &rp, sizeof(rp));
9828                         goto unlock;
9829                 }
9830         } else {
9831                 conn = NULL;
9832         }
9833
9834         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
9835         if (!cmd)
9836                 err = -ENOMEM;
9837         else
9838                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
9839                                          get_clock_info_complete);
9840
9841         if (err < 0) {
9842                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
9843                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
9844
9845                 if (cmd)
9846                         mgmt_pending_free(cmd);
9847         }
9848
9849
9850 unlock:
9851         hci_dev_unlock(hdev);
9852         return err;
9853 }
9854
9855 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
9856 {
9857         struct hci_conn *conn;
9858
9859         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
9860         if (!conn)
9861                 return false;
9862
9863         if (conn->dst_type != type)
9864                 return false;
9865
9866         if (conn->state != BT_CONNECTED)
9867                 return false;
9868
9869         return true;
9870 }
9871
9872 /* This function requires the caller holds hdev->lock */
9873 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
9874                                u8 addr_type, u8 auto_connect)
9875 {
9876         struct hci_conn_params *params;
9877
9878         params = hci_conn_params_add(hdev, addr, addr_type);
9879         if (!params)
9880                 return -EIO;
9881
9882         if (params->auto_connect == auto_connect)
9883                 return 0;
9884
9885         list_del_init(&params->action);
9886
9887         switch (auto_connect) {
9888         case HCI_AUTO_CONN_DISABLED:
9889         case HCI_AUTO_CONN_LINK_LOSS:
9890                 /* If auto connect is being disabled when we're trying to
9891                  * connect to device, keep connecting.
9892                  */
9893                 if (params->explicit_connect)
9894                         list_add(&params->action, &hdev->pend_le_conns);
9895                 break;
9896         case HCI_AUTO_CONN_REPORT:
9897                 if (params->explicit_connect)
9898                         list_add(&params->action, &hdev->pend_le_conns);
9899                 else
9900                         list_add(&params->action, &hdev->pend_le_reports);
9901                 break;
9902         case HCI_AUTO_CONN_DIRECT:
9903         case HCI_AUTO_CONN_ALWAYS:
9904                 if (!is_connected(hdev, addr, addr_type))
9905                         list_add(&params->action, &hdev->pend_le_conns);
9906                 break;
9907         }
9908
9909         params->auto_connect = auto_connect;
9910
9911         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
9912                    addr, addr_type, auto_connect);
9913
9914         return 0;
9915 }
9916
9917 static void device_added(struct sock *sk, struct hci_dev *hdev,
9918                          bdaddr_t *bdaddr, u8 type, u8 action)
9919 {
9920         struct mgmt_ev_device_added ev;
9921
9922         bacpy(&ev.addr.bdaddr, bdaddr);
9923         ev.addr.type = type;
9924         ev.action = action;
9925
9926         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
9927 }
9928
9929 static int add_device_sync(struct hci_dev *hdev, void *data)
9930 {
9931         return hci_update_passive_scan_sync(hdev);
9932 }
9933
9934 static int add_device(struct sock *sk, struct hci_dev *hdev,
9935                       void *data, u16 len)
9936 {
9937         struct mgmt_cp_add_device *cp = data;
9938         u8 auto_conn, addr_type;
9939         struct hci_conn_params *params;
9940         int err;
9941         u32 current_flags = 0;
9942         u32 supported_flags;
9943
9944         bt_dev_dbg(hdev, "sock %p", sk);
9945
9946         if (!bdaddr_type_is_valid(cp->addr.type) ||
9947             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
9948                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9949                                          MGMT_STATUS_INVALID_PARAMS,
9950                                          &cp->addr, sizeof(cp->addr));
9951
9952         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
9953                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9954                                          MGMT_STATUS_INVALID_PARAMS,
9955                                          &cp->addr, sizeof(cp->addr));
9956
9957         hci_dev_lock(hdev);
9958
9959         if (cp->addr.type == BDADDR_BREDR) {
9960                 /* Only incoming connections action is supported for now */
9961                 if (cp->action != 0x01) {
9962                         err = mgmt_cmd_complete(sk, hdev->id,
9963                                                 MGMT_OP_ADD_DEVICE,
9964                                                 MGMT_STATUS_INVALID_PARAMS,
9965                                                 &cp->addr, sizeof(cp->addr));
9966                         goto unlock;
9967                 }
9968
9969                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
9970                                                      &cp->addr.bdaddr,
9971                                                      cp->addr.type, 0);
9972                 if (err)
9973                         goto unlock;
9974
9975                 hci_update_scan(hdev);
9976
9977                 goto added;
9978         }
9979
9980         addr_type = le_addr_type(cp->addr.type);
9981
9982         if (cp->action == 0x02)
9983                 auto_conn = HCI_AUTO_CONN_ALWAYS;
9984         else if (cp->action == 0x01)
9985                 auto_conn = HCI_AUTO_CONN_DIRECT;
9986         else
9987                 auto_conn = HCI_AUTO_CONN_REPORT;
9988
9989         /* Kernel internally uses conn_params with resolvable private
9990          * address, but Add Device allows only identity addresses.
9991          * Make sure it is enforced before calling
9992          * hci_conn_params_lookup.
9993          */
9994         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9995                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9996                                         MGMT_STATUS_INVALID_PARAMS,
9997                                         &cp->addr, sizeof(cp->addr));
9998                 goto unlock;
9999         }
10000
10001         /* If the connection parameters don't exist for this device,
10002          * they will be created and configured with defaults.
10003          */
10004         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
10005                                 auto_conn) < 0) {
10006                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
10007                                         MGMT_STATUS_FAILED, &cp->addr,
10008                                         sizeof(cp->addr));
10009                 goto unlock;
10010         } else {
10011                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
10012                                                 addr_type);
10013                 if (params)
10014                         current_flags = params->flags;
10015         }
10016
10017         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
10018         if (err < 0)
10019                 goto unlock;
10020
10021 added:
10022         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
10023         supported_flags = hdev->conn_flags;
10024         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
10025                              supported_flags, current_flags);
10026
10027         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
10028                                 MGMT_STATUS_SUCCESS, &cp->addr,
10029                                 sizeof(cp->addr));
10030
10031 unlock:
10032         hci_dev_unlock(hdev);
10033         return err;
10034 }
10035
10036 static void device_removed(struct sock *sk, struct hci_dev *hdev,
10037                            bdaddr_t *bdaddr, u8 type)
10038 {
10039         struct mgmt_ev_device_removed ev;
10040
10041         bacpy(&ev.addr.bdaddr, bdaddr);
10042         ev.addr.type = type;
10043
10044         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
10045 }
10046
10047 static int remove_device_sync(struct hci_dev *hdev, void *data)
10048 {
10049         return hci_update_passive_scan_sync(hdev);
10050 }
10051
10052 static int remove_device(struct sock *sk, struct hci_dev *hdev,
10053                          void *data, u16 len)
10054 {
10055         struct mgmt_cp_remove_device *cp = data;
10056         int err;
10057
10058         bt_dev_dbg(hdev, "sock %p", sk);
10059
10060         hci_dev_lock(hdev);
10061
10062         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
10063                 struct hci_conn_params *params;
10064                 u8 addr_type;
10065
10066                 if (!bdaddr_type_is_valid(cp->addr.type)) {
10067                         err = mgmt_cmd_complete(sk, hdev->id,
10068                                                 MGMT_OP_REMOVE_DEVICE,
10069                                                 MGMT_STATUS_INVALID_PARAMS,
10070                                                 &cp->addr, sizeof(cp->addr));
10071                         goto unlock;
10072                 }
10073
10074                 if (cp->addr.type == BDADDR_BREDR) {
10075                         err = hci_bdaddr_list_del(&hdev->accept_list,
10076                                                   &cp->addr.bdaddr,
10077                                                   cp->addr.type);
10078                         if (err) {
10079                                 err = mgmt_cmd_complete(sk, hdev->id,
10080                                                         MGMT_OP_REMOVE_DEVICE,
10081                                                         MGMT_STATUS_INVALID_PARAMS,
10082                                                         &cp->addr,
10083                                                         sizeof(cp->addr));
10084                                 goto unlock;
10085                         }
10086
10087                         hci_update_scan(hdev);
10088
10089                         device_removed(sk, hdev, &cp->addr.bdaddr,
10090                                        cp->addr.type);
10091                         goto complete;
10092                 }
10093
10094                 addr_type = le_addr_type(cp->addr.type);
10095
10096                 /* Kernel internally uses conn_params with resolvable private
10097                  * address, but Remove Device allows only identity addresses.
10098                  * Make sure it is enforced before calling
10099                  * hci_conn_params_lookup.
10100                  */
10101                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
10102                         err = mgmt_cmd_complete(sk, hdev->id,
10103                                                 MGMT_OP_REMOVE_DEVICE,
10104                                                 MGMT_STATUS_INVALID_PARAMS,
10105                                                 &cp->addr, sizeof(cp->addr));
10106                         goto unlock;
10107                 }
10108
10109                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
10110                                                 addr_type);
10111                 if (!params) {
10112                         err = mgmt_cmd_complete(sk, hdev->id,
10113                                                 MGMT_OP_REMOVE_DEVICE,
10114                                                 MGMT_STATUS_INVALID_PARAMS,
10115                                                 &cp->addr, sizeof(cp->addr));
10116                         goto unlock;
10117                 }
10118
10119                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
10120                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
10121                         err = mgmt_cmd_complete(sk, hdev->id,
10122                                                 MGMT_OP_REMOVE_DEVICE,
10123                                                 MGMT_STATUS_INVALID_PARAMS,
10124                                                 &cp->addr, sizeof(cp->addr));
10125                         goto unlock;
10126                 }
10127
10128                 list_del(&params->action);
10129                 list_del(&params->list);
10130                 kfree(params);
10131
10132                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
10133         } else {
10134                 struct hci_conn_params *p, *tmp;
10135                 struct bdaddr_list *b, *btmp;
10136
10137                 if (cp->addr.type) {
10138                         err = mgmt_cmd_complete(sk, hdev->id,
10139                                                 MGMT_OP_REMOVE_DEVICE,
10140                                                 MGMT_STATUS_INVALID_PARAMS,
10141                                                 &cp->addr, sizeof(cp->addr));
10142                         goto unlock;
10143                 }
10144
10145                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
10146                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
10147                         list_del(&b->list);
10148                         kfree(b);
10149                 }
10150
10151                 hci_update_scan(hdev);
10152
10153                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
10154                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
10155                                 continue;
10156                         device_removed(sk, hdev, &p->addr, p->addr_type);
10157                         if (p->explicit_connect) {
10158                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
10159                                 continue;
10160                         }
10161                         list_del(&p->action);
10162                         list_del(&p->list);
10163                         kfree(p);
10164                 }
10165
10166                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
10167         }
10168
10169         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
10170
10171 complete:
10172         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
10173                                 MGMT_STATUS_SUCCESS, &cp->addr,
10174                                 sizeof(cp->addr));
10175 unlock:
10176         hci_dev_unlock(hdev);
10177         return err;
10178 }
10179
10180 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
10181                            u16 len)
10182 {
10183         struct mgmt_cp_load_conn_param *cp = data;
10184         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
10185                                      sizeof(struct mgmt_conn_param));
10186         u16 param_count, expected_len;
10187         int i;
10188
10189         if (!lmp_le_capable(hdev))
10190                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
10191                                        MGMT_STATUS_NOT_SUPPORTED);
10192
10193         param_count = __le16_to_cpu(cp->param_count);
10194         if (param_count > max_param_count) {
10195                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
10196                            param_count);
10197                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
10198                                        MGMT_STATUS_INVALID_PARAMS);
10199         }
10200
10201         expected_len = struct_size(cp, params, param_count);
10202         if (expected_len != len) {
10203                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
10204                            expected_len, len);
10205                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
10206                                        MGMT_STATUS_INVALID_PARAMS);
10207         }
10208
10209         bt_dev_dbg(hdev, "param_count %u", param_count);
10210
10211         hci_dev_lock(hdev);
10212
10213         hci_conn_params_clear_disabled(hdev);
10214
10215         for (i = 0; i < param_count; i++) {
10216                 struct mgmt_conn_param *param = &cp->params[i];
10217                 struct hci_conn_params *hci_param;
10218                 u16 min, max, latency, timeout;
10219                 u8 addr_type;
10220
10221                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
10222                            param->addr.type);
10223
10224                 if (param->addr.type == BDADDR_LE_PUBLIC) {
10225                         addr_type = ADDR_LE_DEV_PUBLIC;
10226                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
10227                         addr_type = ADDR_LE_DEV_RANDOM;
10228                 } else {
10229                         bt_dev_err(hdev, "ignoring invalid connection parameters");
10230                         continue;
10231                 }
10232
10233                 min = le16_to_cpu(param->min_interval);
10234                 max = le16_to_cpu(param->max_interval);
10235                 latency = le16_to_cpu(param->latency);
10236                 timeout = le16_to_cpu(param->timeout);
10237
10238                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
10239                            min, max, latency, timeout);
10240
10241                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
10242                         bt_dev_err(hdev, "ignoring invalid connection parameters");
10243                         continue;
10244                 }
10245
10246                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
10247                                                 addr_type);
10248                 if (!hci_param) {
10249                         bt_dev_err(hdev, "failed to add connection parameters");
10250                         continue;
10251                 }
10252
10253                 hci_param->conn_min_interval = min;
10254                 hci_param->conn_max_interval = max;
10255                 hci_param->conn_latency = latency;
10256                 hci_param->supervision_timeout = timeout;
10257         }
10258
10259         hci_dev_unlock(hdev);
10260
10261         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
10262                                  NULL, 0);
10263 }
10264
10265 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
10266                                void *data, u16 len)
10267 {
10268         struct mgmt_cp_set_external_config *cp = data;
10269         bool changed;
10270         int err;
10271
10272         bt_dev_dbg(hdev, "sock %p", sk);
10273
10274         if (hdev_is_powered(hdev))
10275                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
10276                                        MGMT_STATUS_REJECTED);
10277
10278         if (cp->config != 0x00 && cp->config != 0x01)
10279                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
10280                                          MGMT_STATUS_INVALID_PARAMS);
10281
10282         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
10283                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
10284                                        MGMT_STATUS_NOT_SUPPORTED);
10285
10286         hci_dev_lock(hdev);
10287
10288         if (cp->config)
10289                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
10290         else
10291                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
10292
10293         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
10294         if (err < 0)
10295                 goto unlock;
10296
10297         if (!changed)
10298                 goto unlock;
10299
10300         err = new_options(hdev, sk);
10301
10302         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
10303                 mgmt_index_removed(hdev);
10304
10305                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
10306                         hci_dev_set_flag(hdev, HCI_CONFIG);
10307                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
10308
10309                         queue_work(hdev->req_workqueue, &hdev->power_on);
10310                 } else {
10311                         set_bit(HCI_RAW, &hdev->flags);
10312                         mgmt_index_added(hdev);
10313                 }
10314         }
10315
10316 unlock:
10317         hci_dev_unlock(hdev);
10318         return err;
10319 }
10320
10321 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
10322                               void *data, u16 len)
10323 {
10324         struct mgmt_cp_set_public_address *cp = data;
10325         bool changed;
10326         int err;
10327
10328         bt_dev_dbg(hdev, "sock %p", sk);
10329
10330         if (hdev_is_powered(hdev))
10331                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
10332                                        MGMT_STATUS_REJECTED);
10333
10334         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
10335                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
10336                                        MGMT_STATUS_INVALID_PARAMS);
10337
10338         if (!hdev->set_bdaddr)
10339                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
10340                                        MGMT_STATUS_NOT_SUPPORTED);
10341
10342         hci_dev_lock(hdev);
10343
10344         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
10345         bacpy(&hdev->public_addr, &cp->bdaddr);
10346
10347         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
10348         if (err < 0)
10349                 goto unlock;
10350
10351         if (!changed)
10352                 goto unlock;
10353
10354         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
10355                 err = new_options(hdev, sk);
10356
10357         if (is_configured(hdev)) {
10358                 mgmt_index_removed(hdev);
10359
10360                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
10361
10362                 hci_dev_set_flag(hdev, HCI_CONFIG);
10363                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
10364
10365                 queue_work(hdev->req_workqueue, &hdev->power_on);
10366         }
10367
10368 unlock:
10369         hci_dev_unlock(hdev);
10370         return err;
10371 }
10372
10373 #ifdef TIZEN_BT
10374 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
10375                             u8 name_len)
10376 {
10377         char buf[512];
10378         struct mgmt_ev_device_name_update *ev = (void *)buf;
10379         u16 eir_len = 0;
10380
10381         if (name_len <= 0)
10382                 return -EINVAL;
10383
10384         bacpy(&ev->addr.bdaddr, bdaddr);
10385         ev->addr.type = BDADDR_BREDR;
10386
10387         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
10388                                   name_len);
10389
10390         ev->eir_len = cpu_to_le16(eir_len);
10391
10392         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
10393                           sizeof(*ev) + eir_len, NULL);
10394 }
10395
10396 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10397                                u8 link_type, u8 addr_type, u8 status)
10398 {
10399         struct mgmt_ev_conn_update_failed ev;
10400
10401         bacpy(&ev.addr.bdaddr, bdaddr);
10402         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10403         ev.status = status;
10404
10405         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
10406                                 &ev, sizeof(ev), NULL);
10407 }
10408
10409 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
10410                          u8 link_type, u8 addr_type, u16 conn_interval,
10411                          u16 conn_latency, u16 supervision_timeout)
10412 {
10413         struct mgmt_ev_conn_updated ev;
10414
10415         bacpy(&ev.addr.bdaddr, bdaddr);
10416         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10417         ev.conn_interval = cpu_to_le16(conn_interval);
10418         ev.conn_latency = cpu_to_le16(conn_latency);
10419         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
10420
10421         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
10422                                 &ev, sizeof(ev), NULL);
10423 }
10424
10425 /* le device found event - Pass adv type */
10426 void mgmt_le_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10427                 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, u8 *eir,
10428                 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, u8 adv_type)
10429 {
10430         char buf[512];
10431         struct mgmt_ev_le_device_found *ev = (void *)buf;
10432         size_t ev_size;
10433
10434         if (!hci_discovery_active(hdev) && !hci_le_discovery_active(hdev))
10435                 return;
10436
10437         /* Make sure that the buffer is big enough. The 5 extra bytes
10438          * are for the potential CoD field.
10439          */
10440         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
10441                 return;
10442
10443         memset(buf, 0, sizeof(buf));
10444
10445         bacpy(&ev->addr.bdaddr, bdaddr);
10446         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10447         ev->rssi = rssi;
10448         ev->flags = cpu_to_le32(flags);
10449         ev->adv_type = adv_type;
10450
10451         if (eir_len > 0)
10452                 memcpy(ev->eir, eir, eir_len);
10453
10454         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, NULL))
10455                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
10456                                           dev_class, 3);
10457
10458         if (scan_rsp_len > 0)
10459                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
10460
10461         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10462         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
10463
10464         mgmt_event(MGMT_EV_LE_DEVICE_FOUND, hdev, ev, ev_size, NULL);
10465 }
10466 #endif
10467
10468 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
10469                                              int err)
10470 {
10471         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
10472         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
10473         u8 *h192, *r192, *h256, *r256;
10474         struct mgmt_pending_cmd *cmd = data;
10475         struct sk_buff *skb = cmd->skb;
10476         u8 status = mgmt_status(err);
10477         u16 eir_len;
10478
10479         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
10480                 return;
10481
10482         if (!status) {
10483                 if (!skb)
10484                         status = MGMT_STATUS_FAILED;
10485                 else if (IS_ERR(skb))
10486                         status = mgmt_status(PTR_ERR(skb));
10487                 else
10488                         status = mgmt_status(skb->data[0]);
10489         }
10490
10491         bt_dev_dbg(hdev, "status %u", status);
10492
10493         mgmt_cp = cmd->param;
10494
10495         if (status) {
10496                 status = mgmt_status(status);
10497                 eir_len = 0;
10498
10499                 h192 = NULL;
10500                 r192 = NULL;
10501                 h256 = NULL;
10502                 r256 = NULL;
10503         } else if (!bredr_sc_enabled(hdev)) {
10504                 struct hci_rp_read_local_oob_data *rp;
10505
10506                 if (skb->len != sizeof(*rp)) {
10507                         status = MGMT_STATUS_FAILED;
10508                         eir_len = 0;
10509                 } else {
10510                         status = MGMT_STATUS_SUCCESS;
10511                         rp = (void *)skb->data;
10512
10513                         eir_len = 5 + 18 + 18;
10514                         h192 = rp->hash;
10515                         r192 = rp->rand;
10516                         h256 = NULL;
10517                         r256 = NULL;
10518                 }
10519         } else {
10520                 struct hci_rp_read_local_oob_ext_data *rp;
10521
10522                 if (skb->len != sizeof(*rp)) {
10523                         status = MGMT_STATUS_FAILED;
10524                         eir_len = 0;
10525                 } else {
10526                         status = MGMT_STATUS_SUCCESS;
10527                         rp = (void *)skb->data;
10528
10529                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
10530                                 eir_len = 5 + 18 + 18;
10531                                 h192 = NULL;
10532                                 r192 = NULL;
10533                         } else {
10534                                 eir_len = 5 + 18 + 18 + 18 + 18;
10535                                 h192 = rp->hash192;
10536                                 r192 = rp->rand192;
10537                         }
10538
10539                         h256 = rp->hash256;
10540                         r256 = rp->rand256;
10541                 }
10542         }
10543
10544         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
10545         if (!mgmt_rp)
10546                 goto done;
10547
10548         if (eir_len == 0)
10549                 goto send_rsp;
10550
10551         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
10552                                   hdev->dev_class, 3);
10553
10554         if (h192 && r192) {
10555                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10556                                           EIR_SSP_HASH_C192, h192, 16);
10557                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10558                                           EIR_SSP_RAND_R192, r192, 16);
10559         }
10560
10561         if (h256 && r256) {
10562                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10563                                           EIR_SSP_HASH_C256, h256, 16);
10564                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10565                                           EIR_SSP_RAND_R256, r256, 16);
10566         }
10567
10568 send_rsp:
10569         mgmt_rp->type = mgmt_cp->type;
10570         mgmt_rp->eir_len = cpu_to_le16(eir_len);
10571
10572         err = mgmt_cmd_complete(cmd->sk, hdev->id,
10573                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
10574                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
10575         if (err < 0 || status)
10576                 goto done;
10577
10578         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
10579
10580         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
10581                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
10582                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
10583 done:
10584         if (skb && !IS_ERR(skb))
10585                 kfree_skb(skb);
10586
10587         kfree(mgmt_rp);
10588         mgmt_pending_remove(cmd);
10589 }
10590
10591 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
10592                                   struct mgmt_cp_read_local_oob_ext_data *cp)
10593 {
10594         struct mgmt_pending_cmd *cmd;
10595         int err;
10596
10597         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
10598                                cp, sizeof(*cp));
10599         if (!cmd)
10600                 return -ENOMEM;
10601
10602         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
10603                                  read_local_oob_ext_data_complete);
10604
10605         if (err < 0) {
10606                 mgmt_pending_remove(cmd);
10607                 return err;
10608         }
10609
10610         return 0;
10611 }
10612
10613 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
10614                                    void *data, u16 data_len)
10615 {
10616         struct mgmt_cp_read_local_oob_ext_data *cp = data;
10617         struct mgmt_rp_read_local_oob_ext_data *rp;
10618         size_t rp_len;
10619         u16 eir_len;
10620         u8 status, flags, role, addr[7], hash[16], rand[16];
10621         int err;
10622
10623         bt_dev_dbg(hdev, "sock %p", sk);
10624
10625         if (hdev_is_powered(hdev)) {
10626                 switch (cp->type) {
10627                 case BIT(BDADDR_BREDR):
10628                         status = mgmt_bredr_support(hdev);
10629                         if (status)
10630                                 eir_len = 0;
10631                         else
10632                                 eir_len = 5;
10633                         break;
10634                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
10635                         status = mgmt_le_support(hdev);
10636                         if (status)
10637                                 eir_len = 0;
10638                         else
10639                                 eir_len = 9 + 3 + 18 + 18 + 3;
10640                         break;
10641                 default:
10642                         status = MGMT_STATUS_INVALID_PARAMS;
10643                         eir_len = 0;
10644                         break;
10645                 }
10646         } else {
10647                 status = MGMT_STATUS_NOT_POWERED;
10648                 eir_len = 0;
10649         }
10650
10651         rp_len = sizeof(*rp) + eir_len;
10652         rp = kmalloc(rp_len, GFP_ATOMIC);
10653         if (!rp)
10654                 return -ENOMEM;
10655
10656         if (!status && !lmp_ssp_capable(hdev)) {
10657                 status = MGMT_STATUS_NOT_SUPPORTED;
10658                 eir_len = 0;
10659         }
10660
10661         if (status)
10662                 goto complete;
10663
10664         hci_dev_lock(hdev);
10665
10666         eir_len = 0;
10667         switch (cp->type) {
10668         case BIT(BDADDR_BREDR):
10669                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
10670                         err = read_local_ssp_oob_req(hdev, sk, cp);
10671                         hci_dev_unlock(hdev);
10672                         if (!err)
10673                                 goto done;
10674
10675                         status = MGMT_STATUS_FAILED;
10676                         goto complete;
10677                 } else {
10678                         eir_len = eir_append_data(rp->eir, eir_len,
10679                                                   EIR_CLASS_OF_DEV,
10680                                                   hdev->dev_class, 3);
10681                 }
10682                 break;
10683         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
10684                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
10685                     smp_generate_oob(hdev, hash, rand) < 0) {
10686                         hci_dev_unlock(hdev);
10687                         status = MGMT_STATUS_FAILED;
10688                         goto complete;
10689                 }
10690
10691                 /* This should return the active RPA, but since the RPA
10692                  * is only programmed on demand, it is really hard to fill
10693                  * this in at the moment. For now disallow retrieving
10694                  * local out-of-band data when privacy is in use.
10695                  *
10696                  * Returning the identity address will not help here since
10697                  * pairing happens before the identity resolving key is
10698                  * known and thus the connection establishment happens
10699                  * based on the RPA and not the identity address.
10700                  */
10701                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
10702                         hci_dev_unlock(hdev);
10703                         status = MGMT_STATUS_REJECTED;
10704                         goto complete;
10705                 }
10706
10707                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
10708                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
10709                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
10710                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
10711                         memcpy(addr, &hdev->static_addr, 6);
10712                         addr[6] = 0x01;
10713                 } else {
10714                         memcpy(addr, &hdev->bdaddr, 6);
10715                         addr[6] = 0x00;
10716                 }
10717
10718                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
10719                                           addr, sizeof(addr));
10720
10721                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
10722                         role = 0x02;
10723                 else
10724                         role = 0x01;
10725
10726                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
10727                                           &role, sizeof(role));
10728
10729                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
10730                         eir_len = eir_append_data(rp->eir, eir_len,
10731                                                   EIR_LE_SC_CONFIRM,
10732                                                   hash, sizeof(hash));
10733
10734                         eir_len = eir_append_data(rp->eir, eir_len,
10735                                                   EIR_LE_SC_RANDOM,
10736                                                   rand, sizeof(rand));
10737                 }
10738
10739                 flags = mgmt_get_adv_discov_flags(hdev);
10740
10741                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
10742                         flags |= LE_AD_NO_BREDR;
10743
10744                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
10745                                           &flags, sizeof(flags));
10746                 break;
10747         }
10748
10749         hci_dev_unlock(hdev);
10750
10751         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
10752
10753         status = MGMT_STATUS_SUCCESS;
10754
10755 complete:
10756         rp->type = cp->type;
10757         rp->eir_len = cpu_to_le16(eir_len);
10758
10759         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
10760                                 status, rp, sizeof(*rp) + eir_len);
10761         if (err < 0 || status)
10762                 goto done;
10763
10764         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
10765                                  rp, sizeof(*rp) + eir_len,
10766                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
10767
10768 done:
10769         kfree(rp);
10770
10771         return err;
10772 }
10773
10774 static u32 get_supported_adv_flags(struct hci_dev *hdev)
10775 {
10776         u32 flags = 0;
10777
10778         flags |= MGMT_ADV_FLAG_CONNECTABLE;
10779         flags |= MGMT_ADV_FLAG_DISCOV;
10780         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
10781         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
10782         flags |= MGMT_ADV_FLAG_APPEARANCE;
10783         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
10784         flags |= MGMT_ADV_PARAM_DURATION;
10785         flags |= MGMT_ADV_PARAM_TIMEOUT;
10786         flags |= MGMT_ADV_PARAM_INTERVALS;
10787         flags |= MGMT_ADV_PARAM_TX_POWER;
10788         flags |= MGMT_ADV_PARAM_SCAN_RSP;
10789
10790         /* In extended adv TX_POWER returned from Set Adv Param
10791          * will be always valid.
10792          */
10793         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
10794                 flags |= MGMT_ADV_FLAG_TX_POWER;
10795
10796         if (ext_adv_capable(hdev)) {
10797                 flags |= MGMT_ADV_FLAG_SEC_1M;
10798                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
10799                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
10800
10801                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
10802                         flags |= MGMT_ADV_FLAG_SEC_2M;
10803
10804                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
10805                         flags |= MGMT_ADV_FLAG_SEC_CODED;
10806         }
10807
10808         return flags;
10809 }
10810
10811 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
10812                              void *data, u16 data_len)
10813 {
10814         struct mgmt_rp_read_adv_features *rp;
10815         size_t rp_len;
10816         int err;
10817         struct adv_info *adv_instance;
10818         u32 supported_flags;
10819         u8 *instance;
10820
10821         bt_dev_dbg(hdev, "sock %p", sk);
10822
10823         if (!lmp_le_capable(hdev))
10824                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
10825                                        MGMT_STATUS_REJECTED);
10826
10827         hci_dev_lock(hdev);
10828
10829         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
10830         rp = kmalloc(rp_len, GFP_ATOMIC);
10831         if (!rp) {
10832                 hci_dev_unlock(hdev);
10833                 return -ENOMEM;
10834         }
10835
10836         supported_flags = get_supported_adv_flags(hdev);
10837
10838         rp->supported_flags = cpu_to_le32(supported_flags);
10839         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
10840         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
10841         rp->max_instances = hdev->le_num_of_adv_sets;
10842         rp->num_instances = hdev->adv_instance_cnt;
10843
10844         instance = rp->instance;
10845         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
10846                 /* Only instances 1-le_num_of_adv_sets are externally visible */
10847                 if (adv_instance->instance <= hdev->adv_instance_cnt) {
10848                         *instance = adv_instance->instance;
10849                         instance++;
10850                 } else {
10851                         rp->num_instances--;
10852                         rp_len--;
10853                 }
10854         }
10855
10856         hci_dev_unlock(hdev);
10857
10858         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
10859                                 MGMT_STATUS_SUCCESS, rp, rp_len);
10860
10861         kfree(rp);
10862
10863         return err;
10864 }
10865
10866 static u8 calculate_name_len(struct hci_dev *hdev)
10867 {
10868         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
10869
10870         return eir_append_local_name(hdev, buf, 0);
10871 }
10872
10873 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
10874                            bool is_adv_data)
10875 {
10876         u8 max_len = HCI_MAX_AD_LENGTH;
10877
10878         if (is_adv_data) {
10879                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
10880                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
10881                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
10882                         max_len -= 3;
10883
10884                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
10885                         max_len -= 3;
10886         } else {
10887                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
10888                         max_len -= calculate_name_len(hdev);
10889
10890                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
10891                         max_len -= 4;
10892         }
10893
10894         return max_len;
10895 }
10896
10897 static bool flags_managed(u32 adv_flags)
10898 {
10899         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
10900                             MGMT_ADV_FLAG_LIMITED_DISCOV |
10901                             MGMT_ADV_FLAG_MANAGED_FLAGS);
10902 }
10903
10904 static bool tx_power_managed(u32 adv_flags)
10905 {
10906         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
10907 }
10908
10909 static bool name_managed(u32 adv_flags)
10910 {
10911         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
10912 }
10913
10914 static bool appearance_managed(u32 adv_flags)
10915 {
10916         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
10917 }
10918
10919 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
10920                               u8 len, bool is_adv_data)
10921 {
10922         int i, cur_len;
10923         u8 max_len;
10924
10925         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
10926
10927         if (len > max_len)
10928                 return false;
10929
10930         /* Make sure that the data is correctly formatted. */
10931         for (i = 0; i < len; i += (cur_len + 1)) {
10932                 cur_len = data[i];
10933
10934                 if (!cur_len)
10935                         continue;
10936
10937                 if (data[i + 1] == EIR_FLAGS &&
10938                     (!is_adv_data || flags_managed(adv_flags)))
10939                         return false;
10940
10941                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
10942                         return false;
10943
10944                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
10945                         return false;
10946
10947                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
10948                         return false;
10949
10950                 if (data[i + 1] == EIR_APPEARANCE &&
10951                     appearance_managed(adv_flags))
10952                         return false;
10953
10954                 /* If the current field length would exceed the total data
10955                  * length, then it's invalid.
10956                  */
10957                 if (i + cur_len >= len)
10958                         return false;
10959         }
10960
10961         return true;
10962 }
10963
10964 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
10965 {
10966         u32 supported_flags, phy_flags;
10967
10968         /* The current implementation only supports a subset of the specified
10969          * flags. Also need to check mutual exclusiveness of sec flags.
10970          */
10971         supported_flags = get_supported_adv_flags(hdev);
10972         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
10973         if (adv_flags & ~supported_flags ||
10974             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
10975                 return false;
10976
10977         return true;
10978 }
10979
10980 static bool adv_busy(struct hci_dev *hdev)
10981 {
10982         return pending_find(MGMT_OP_SET_LE, hdev);
10983 }
10984
10985 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
10986                              int err)
10987 {
10988         struct adv_info *adv, *n;
10989
10990         bt_dev_dbg(hdev, "err %d", err);
10991
10992         hci_dev_lock(hdev);
10993
10994         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
10995                 u8 instance;
10996
10997                 if (!adv->pending)
10998                         continue;
10999
11000                 if (!err) {
11001                         adv->pending = false;
11002                         continue;
11003                 }
11004
11005                 instance = adv->instance;
11006
11007                 if (hdev->cur_adv_instance == instance)
11008                         cancel_adv_timeout(hdev);
11009
11010                 hci_remove_adv_instance(hdev, instance);
11011                 mgmt_advertising_removed(sk, hdev, instance);
11012         }
11013
11014         hci_dev_unlock(hdev);
11015 }
11016
11017 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
11018 {
11019         struct mgmt_pending_cmd *cmd = data;
11020         struct mgmt_cp_add_advertising *cp = cmd->param;
11021         struct mgmt_rp_add_advertising rp;
11022
11023         memset(&rp, 0, sizeof(rp));
11024
11025         rp.instance = cp->instance;
11026
11027         if (err)
11028                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
11029                                 mgmt_status(err));
11030         else
11031                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
11032                                   mgmt_status(err), &rp, sizeof(rp));
11033
11034         add_adv_complete(hdev, cmd->sk, cp->instance, err);
11035
11036         mgmt_pending_free(cmd);
11037 }
11038
11039 static int add_advertising_sync(struct hci_dev *hdev, void *data)
11040 {
11041         struct mgmt_pending_cmd *cmd = data;
11042         struct mgmt_cp_add_advertising *cp = cmd->param;
11043
11044         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
11045 }
11046
11047 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
11048                            void *data, u16 data_len)
11049 {
11050         struct mgmt_cp_add_advertising *cp = data;
11051         struct mgmt_rp_add_advertising rp;
11052         u32 flags;
11053         u8 status;
11054         u16 timeout, duration;
11055         unsigned int prev_instance_cnt;
11056         u8 schedule_instance = 0;
11057         struct adv_info *adv, *next_instance;
11058         int err;
11059         struct mgmt_pending_cmd *cmd;
11060
11061         bt_dev_dbg(hdev, "sock %p", sk);
11062
11063         status = mgmt_le_support(hdev);
11064         if (status)
11065                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
11066                                        status);
11067
11068         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
11069                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
11070                                        MGMT_STATUS_INVALID_PARAMS);
11071
11072         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
11073                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
11074                                        MGMT_STATUS_INVALID_PARAMS);
11075
11076         flags = __le32_to_cpu(cp->flags);
11077         timeout = __le16_to_cpu(cp->timeout);
11078         duration = __le16_to_cpu(cp->duration);
11079
11080         if (!requested_adv_flags_are_valid(hdev, flags))
11081                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
11082                                        MGMT_STATUS_INVALID_PARAMS);
11083
11084         hci_dev_lock(hdev);
11085
11086         if (timeout && !hdev_is_powered(hdev)) {
11087                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
11088                                       MGMT_STATUS_REJECTED);
11089                 goto unlock;
11090         }
11091
11092         if (adv_busy(hdev)) {
11093                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
11094                                       MGMT_STATUS_BUSY);
11095                 goto unlock;
11096         }
11097
11098         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
11099             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
11100                                cp->scan_rsp_len, false)) {
11101                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
11102                                       MGMT_STATUS_INVALID_PARAMS);
11103                 goto unlock;
11104         }
11105
11106         prev_instance_cnt = hdev->adv_instance_cnt;
11107
11108         adv = hci_add_adv_instance(hdev, cp->instance, flags,
11109                                    cp->adv_data_len, cp->data,
11110                                    cp->scan_rsp_len,
11111                                    cp->data + cp->adv_data_len,
11112                                    timeout, duration,
11113                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
11114                                    hdev->le_adv_min_interval,
11115                                    hdev->le_adv_max_interval, 0);
11116         if (IS_ERR(adv)) {
11117                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
11118                                       MGMT_STATUS_FAILED);
11119                 goto unlock;
11120         }
11121
11122         /* Only trigger an advertising added event if a new instance was
11123          * actually added.
11124          */
11125         if (hdev->adv_instance_cnt > prev_instance_cnt)
11126                 mgmt_advertising_added(sk, hdev, cp->instance);
11127
11128         if (hdev->cur_adv_instance == cp->instance) {
11129                 /* If the currently advertised instance is being changed then
11130                  * cancel the current advertising and schedule the next
11131                  * instance. If there is only one instance then the overridden
11132                  * advertising data will be visible right away.
11133                  */
11134                 cancel_adv_timeout(hdev);
11135
11136                 next_instance = hci_get_next_instance(hdev, cp->instance);
11137                 if (next_instance)
11138                         schedule_instance = next_instance->instance;
11139         } else if (!hdev->adv_instance_timeout) {
11140                 /* Immediately advertise the new instance if no other
11141                  * instance is currently being advertised.
11142                  */
11143                 schedule_instance = cp->instance;
11144         }
11145
11146         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
11147          * there is no instance to be advertised then we have no HCI
11148          * communication to make. Simply return.
11149          */
11150         if (!hdev_is_powered(hdev) ||
11151             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
11152             !schedule_instance) {
11153                 rp.instance = cp->instance;
11154                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
11155                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11156                 goto unlock;
11157         }
11158
11159         /* We're good to go, update advertising data, parameters, and start
11160          * advertising.
11161          */
11162         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
11163                                data_len);
11164         if (!cmd) {
11165                 err = -ENOMEM;
11166                 goto unlock;
11167         }
11168
11169         cp->instance = schedule_instance;
11170
11171         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
11172                                  add_advertising_complete);
11173         if (err < 0)
11174                 mgmt_pending_free(cmd);
11175
11176 unlock:
11177         hci_dev_unlock(hdev);
11178
11179         return err;
11180 }
11181
11182 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
11183                                         int err)
11184 {
11185         struct mgmt_pending_cmd *cmd = data;
11186         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
11187         struct mgmt_rp_add_ext_adv_params rp;
11188         struct adv_info *adv;
11189         u32 flags;
11190
11191         BT_DBG("%s", hdev->name);
11192
11193         hci_dev_lock(hdev);
11194
11195         adv = hci_find_adv_instance(hdev, cp->instance);
11196         if (!adv)
11197                 goto unlock;
11198
11199         rp.instance = cp->instance;
11200         rp.tx_power = adv->tx_power;
11201
11202         /* While we're at it, inform userspace of the available space for this
11203          * advertisement, given the flags that will be used.
11204          */
11205         flags = __le32_to_cpu(cp->flags);
11206         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
11207         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
11208
11209         if (err) {
11210                 /* If this advertisement was previously advertising and we
11211                  * failed to update it, we signal that it has been removed and
11212                  * delete its structure
11213                  */
11214                 if (!adv->pending)
11215                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
11216
11217                 hci_remove_adv_instance(hdev, cp->instance);
11218
11219                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
11220                                 mgmt_status(err));
11221         } else {
11222                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
11223                                   mgmt_status(err), &rp, sizeof(rp));
11224         }
11225
11226 unlock:
11227         if (cmd)
11228                 mgmt_pending_free(cmd);
11229
11230         hci_dev_unlock(hdev);
11231 }
11232
11233 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
11234 {
11235         struct mgmt_pending_cmd *cmd = data;
11236         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
11237
11238         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
11239 }
11240
11241 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
11242                               void *data, u16 data_len)
11243 {
11244         struct mgmt_cp_add_ext_adv_params *cp = data;
11245         struct mgmt_rp_add_ext_adv_params rp;
11246         struct mgmt_pending_cmd *cmd = NULL;
11247         struct adv_info *adv;
11248         u32 flags, min_interval, max_interval;
11249         u16 timeout, duration;
11250         u8 status;
11251         s8 tx_power;
11252         int err;
11253
11254         BT_DBG("%s", hdev->name);
11255
11256         status = mgmt_le_support(hdev);
11257         if (status)
11258                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11259                                        status);
11260
11261         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
11262                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11263                                        MGMT_STATUS_INVALID_PARAMS);
11264
11265         /* The purpose of breaking add_advertising into two separate MGMT calls
11266          * for params and data is to allow more parameters to be added to this
11267          * structure in the future. For this reason, we verify that we have the
11268          * bare minimum structure we know of when the interface was defined. Any
11269          * extra parameters we don't know about will be ignored in this request.
11270          */
11271         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
11272                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11273                                        MGMT_STATUS_INVALID_PARAMS);
11274
11275         flags = __le32_to_cpu(cp->flags);
11276
11277         if (!requested_adv_flags_are_valid(hdev, flags))
11278                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11279                                        MGMT_STATUS_INVALID_PARAMS);
11280
11281         hci_dev_lock(hdev);
11282
11283         /* In new interface, we require that we are powered to register */
11284         if (!hdev_is_powered(hdev)) {
11285                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11286                                       MGMT_STATUS_REJECTED);
11287                 goto unlock;
11288         }
11289
11290         if (adv_busy(hdev)) {
11291                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11292                                       MGMT_STATUS_BUSY);
11293                 goto unlock;
11294         }
11295
11296         /* Parse defined parameters from request, use defaults otherwise */
11297         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
11298                   __le16_to_cpu(cp->timeout) : 0;
11299
11300         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
11301                    __le16_to_cpu(cp->duration) :
11302                    hdev->def_multi_adv_rotation_duration;
11303
11304         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
11305                        __le32_to_cpu(cp->min_interval) :
11306                        hdev->le_adv_min_interval;
11307
11308         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
11309                        __le32_to_cpu(cp->max_interval) :
11310                        hdev->le_adv_max_interval;
11311
11312         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
11313                    cp->tx_power :
11314                    HCI_ADV_TX_POWER_NO_PREFERENCE;
11315
11316         /* Create advertising instance with no advertising or response data */
11317         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
11318                                    timeout, duration, tx_power, min_interval,
11319                                    max_interval, 0);
11320
11321         if (IS_ERR(adv)) {
11322                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11323                                       MGMT_STATUS_FAILED);
11324                 goto unlock;
11325         }
11326
11327         /* Submit request for advertising params if ext adv available */
11328         if (ext_adv_capable(hdev)) {
11329                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
11330                                        data, data_len);
11331                 if (!cmd) {
11332                         err = -ENOMEM;
11333                         hci_remove_adv_instance(hdev, cp->instance);
11334                         goto unlock;
11335                 }
11336
11337                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
11338                                          add_ext_adv_params_complete);
11339                 if (err < 0)
11340                         mgmt_pending_free(cmd);
11341         } else {
11342                 rp.instance = cp->instance;
11343                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
11344                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
11345                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
11346                 err = mgmt_cmd_complete(sk, hdev->id,
11347                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
11348                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11349         }
11350
11351 unlock:
11352         hci_dev_unlock(hdev);
11353
11354         return err;
11355 }
11356
11357 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
11358 {
11359         struct mgmt_pending_cmd *cmd = data;
11360         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
11361         struct mgmt_rp_add_advertising rp;
11362
11363         add_adv_complete(hdev, cmd->sk, cp->instance, err);
11364
11365         memset(&rp, 0, sizeof(rp));
11366
11367         rp.instance = cp->instance;
11368
11369         if (err)
11370                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
11371                                 mgmt_status(err));
11372         else
11373                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
11374                                   mgmt_status(err), &rp, sizeof(rp));
11375
11376         mgmt_pending_free(cmd);
11377 }
11378
11379 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
11380 {
11381         struct mgmt_pending_cmd *cmd = data;
11382         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
11383         int err;
11384
11385         if (ext_adv_capable(hdev)) {
11386                 err = hci_update_adv_data_sync(hdev, cp->instance);
11387                 if (err)
11388                         return err;
11389
11390                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
11391                 if (err)
11392                         return err;
11393
11394                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
11395         }
11396
11397         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
11398 }
11399
11400 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
11401                             u16 data_len)
11402 {
11403         struct mgmt_cp_add_ext_adv_data *cp = data;
11404         struct mgmt_rp_add_ext_adv_data rp;
11405         u8 schedule_instance = 0;
11406         struct adv_info *next_instance;
11407         struct adv_info *adv_instance;
11408         int err = 0;
11409         struct mgmt_pending_cmd *cmd;
11410
11411         BT_DBG("%s", hdev->name);
11412
11413         hci_dev_lock(hdev);
11414
11415         adv_instance = hci_find_adv_instance(hdev, cp->instance);
11416
11417         if (!adv_instance) {
11418                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11419                                       MGMT_STATUS_INVALID_PARAMS);
11420                 goto unlock;
11421         }
11422
11423         /* In new interface, we require that we are powered to register */
11424         if (!hdev_is_powered(hdev)) {
11425                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11426                                       MGMT_STATUS_REJECTED);
11427                 goto clear_new_instance;
11428         }
11429
11430         if (adv_busy(hdev)) {
11431                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11432                                       MGMT_STATUS_BUSY);
11433                 goto clear_new_instance;
11434         }
11435
11436         /* Validate new data */
11437         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
11438                                cp->adv_data_len, true) ||
11439             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
11440                                cp->adv_data_len, cp->scan_rsp_len, false)) {
11441                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11442                                       MGMT_STATUS_INVALID_PARAMS);
11443                 goto clear_new_instance;
11444         }
11445
11446         /* Set the data in the advertising instance */
11447         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
11448                                   cp->data, cp->scan_rsp_len,
11449                                   cp->data + cp->adv_data_len);
11450
11451         /* If using software rotation, determine next instance to use */
11452         if (hdev->cur_adv_instance == cp->instance) {
11453                 /* If the currently advertised instance is being changed
11454                  * then cancel the current advertising and schedule the
11455                  * next instance. If there is only one instance then the
11456                  * overridden advertising data will be visible right
11457                  * away
11458                  */
11459                 cancel_adv_timeout(hdev);
11460
11461                 next_instance = hci_get_next_instance(hdev, cp->instance);
11462                 if (next_instance)
11463                         schedule_instance = next_instance->instance;
11464         } else if (!hdev->adv_instance_timeout) {
11465                 /* Immediately advertise the new instance if no other
11466                  * instance is currently being advertised.
11467                  */
11468                 schedule_instance = cp->instance;
11469         }
11470
11471         /* If the HCI_ADVERTISING flag is set or there is no instance to
11472          * be advertised then we have no HCI communication to make.
11473          * Simply return.
11474          */
11475         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
11476                 if (adv_instance->pending) {
11477                         mgmt_advertising_added(sk, hdev, cp->instance);
11478                         adv_instance->pending = false;
11479                 }
11480                 rp.instance = cp->instance;
11481                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11482                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11483                 goto unlock;
11484         }
11485
11486         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
11487                                data_len);
11488         if (!cmd) {
11489                 err = -ENOMEM;
11490                 goto clear_new_instance;
11491         }
11492
11493         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
11494                                  add_ext_adv_data_complete);
11495         if (err < 0) {
11496                 mgmt_pending_free(cmd);
11497                 goto clear_new_instance;
11498         }
11499
11500         /* We were successful in updating data, so trigger advertising_added
11501          * event if this is an instance that wasn't previously advertising. If
11502          * a failure occurs in the requests we initiated, we will remove the
11503          * instance again in add_advertising_complete
11504          */
11505         if (adv_instance->pending)
11506                 mgmt_advertising_added(sk, hdev, cp->instance);
11507
11508         goto unlock;
11509
11510 clear_new_instance:
11511         hci_remove_adv_instance(hdev, cp->instance);
11512
11513 unlock:
11514         hci_dev_unlock(hdev);
11515
11516         return err;
11517 }
11518
11519 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
11520                                         int err)
11521 {
11522         struct mgmt_pending_cmd *cmd = data;
11523         struct mgmt_cp_remove_advertising *cp = cmd->param;
11524         struct mgmt_rp_remove_advertising rp;
11525
11526         bt_dev_dbg(hdev, "err %d", err);
11527
11528         memset(&rp, 0, sizeof(rp));
11529         rp.instance = cp->instance;
11530
11531         if (err)
11532                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
11533                                 mgmt_status(err));
11534         else
11535                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
11536                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11537
11538         mgmt_pending_free(cmd);
11539 }
11540
11541 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
11542 {
11543         struct mgmt_pending_cmd *cmd = data;
11544         struct mgmt_cp_remove_advertising *cp = cmd->param;
11545         int err;
11546
11547         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
11548         if (err)
11549                 return err;
11550
11551         if (list_empty(&hdev->adv_instances))
11552                 err = hci_disable_advertising_sync(hdev);
11553
11554         return err;
11555 }
11556
11557 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
11558                               void *data, u16 data_len)
11559 {
11560         struct mgmt_cp_remove_advertising *cp = data;
11561         struct mgmt_pending_cmd *cmd;
11562         int err;
11563
11564         bt_dev_dbg(hdev, "sock %p", sk);
11565
11566         hci_dev_lock(hdev);
11567
11568         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
11569                 err = mgmt_cmd_status(sk, hdev->id,
11570                                       MGMT_OP_REMOVE_ADVERTISING,
11571                                       MGMT_STATUS_INVALID_PARAMS);
11572                 goto unlock;
11573         }
11574
11575         if (pending_find(MGMT_OP_SET_LE, hdev)) {
11576                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
11577                                       MGMT_STATUS_BUSY);
11578                 goto unlock;
11579         }
11580
11581         if (list_empty(&hdev->adv_instances)) {
11582                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
11583                                       MGMT_STATUS_INVALID_PARAMS);
11584                 goto unlock;
11585         }
11586
11587         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
11588                                data_len);
11589         if (!cmd) {
11590                 err = -ENOMEM;
11591                 goto unlock;
11592         }
11593
11594         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
11595                                  remove_advertising_complete);
11596         if (err < 0)
11597                 mgmt_pending_free(cmd);
11598
11599 unlock:
11600         hci_dev_unlock(hdev);
11601
11602         return err;
11603 }
11604
11605 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
11606                              void *data, u16 data_len)
11607 {
11608         struct mgmt_cp_get_adv_size_info *cp = data;
11609         struct mgmt_rp_get_adv_size_info rp;
11610         u32 flags, supported_flags;
11611
11612         bt_dev_dbg(hdev, "sock %p", sk);
11613
11614         if (!lmp_le_capable(hdev))
11615                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11616                                        MGMT_STATUS_REJECTED);
11617
11618         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
11619                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11620                                        MGMT_STATUS_INVALID_PARAMS);
11621
11622         flags = __le32_to_cpu(cp->flags);
11623
11624         /* The current implementation only supports a subset of the specified
11625          * flags.
11626          */
11627         supported_flags = get_supported_adv_flags(hdev);
11628         if (flags & ~supported_flags)
11629                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11630                                        MGMT_STATUS_INVALID_PARAMS);
11631
11632         rp.instance = cp->instance;
11633         rp.flags = cp->flags;
11634         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
11635         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
11636
11637         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11638                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11639 }
11640
11641 static const struct hci_mgmt_handler mgmt_handlers[] = {
11642         { NULL }, /* 0x0000 (no command) */
11643         { read_version,            MGMT_READ_VERSION_SIZE,
11644                                                 HCI_MGMT_NO_HDEV |
11645                                                 HCI_MGMT_UNTRUSTED },
11646         { read_commands,           MGMT_READ_COMMANDS_SIZE,
11647                                                 HCI_MGMT_NO_HDEV |
11648                                                 HCI_MGMT_UNTRUSTED },
11649         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
11650                                                 HCI_MGMT_NO_HDEV |
11651                                                 HCI_MGMT_UNTRUSTED },
11652         { read_controller_info,    MGMT_READ_INFO_SIZE,
11653                                                 HCI_MGMT_UNTRUSTED },
11654         { set_powered,             MGMT_SETTING_SIZE },
11655         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
11656         { set_connectable,         MGMT_SETTING_SIZE },
11657         { set_fast_connectable,    MGMT_SETTING_SIZE },
11658         { set_bondable,            MGMT_SETTING_SIZE },
11659         { set_link_security,       MGMT_SETTING_SIZE },
11660         { set_ssp,                 MGMT_SETTING_SIZE },
11661         { set_hs,                  MGMT_SETTING_SIZE },
11662         { set_le,                  MGMT_SETTING_SIZE },
11663         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
11664         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
11665         { add_uuid,                MGMT_ADD_UUID_SIZE },
11666         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
11667         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
11668                                                 HCI_MGMT_VAR_LEN },
11669         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
11670                                                 HCI_MGMT_VAR_LEN },
11671         { disconnect,              MGMT_DISCONNECT_SIZE },
11672         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
11673         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
11674         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
11675         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
11676         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
11677         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
11678         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
11679         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
11680         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
11681         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
11682         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
11683         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
11684         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
11685                                                 HCI_MGMT_VAR_LEN },
11686         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
11687         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
11688         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
11689         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
11690         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
11691         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
11692         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
11693         { set_advertising,         MGMT_SETTING_SIZE },
11694         { set_bredr,               MGMT_SETTING_SIZE },
11695         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
11696         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
11697         { set_secure_conn,         MGMT_SETTING_SIZE },
11698         { set_debug_keys,          MGMT_SETTING_SIZE },
11699         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
11700         { load_irks,               MGMT_LOAD_IRKS_SIZE,
11701                                                 HCI_MGMT_VAR_LEN },
11702         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
11703         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
11704         { add_device,              MGMT_ADD_DEVICE_SIZE },
11705         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
11706         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
11707                                                 HCI_MGMT_VAR_LEN },
11708         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
11709                                                 HCI_MGMT_NO_HDEV |
11710                                                 HCI_MGMT_UNTRUSTED },
11711         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
11712                                                 HCI_MGMT_UNCONFIGURED |
11713                                                 HCI_MGMT_UNTRUSTED },
11714         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
11715                                                 HCI_MGMT_UNCONFIGURED },
11716         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
11717                                                 HCI_MGMT_UNCONFIGURED },
11718         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
11719                                                 HCI_MGMT_VAR_LEN },
11720         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
11721         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
11722                                                 HCI_MGMT_NO_HDEV |
11723                                                 HCI_MGMT_UNTRUSTED },
11724         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
11725         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
11726                                                 HCI_MGMT_VAR_LEN },
11727         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
11728         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
11729         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
11730         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
11731                                                 HCI_MGMT_UNTRUSTED },
11732         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
11733         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
11734         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
11735         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
11736                                                 HCI_MGMT_VAR_LEN },
11737         { set_wideband_speech,     MGMT_SETTING_SIZE },
11738         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
11739                                                 HCI_MGMT_UNTRUSTED },
11740         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
11741                                                 HCI_MGMT_UNTRUSTED |
11742                                                 HCI_MGMT_HDEV_OPTIONAL },
11743         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
11744                                                 HCI_MGMT_VAR_LEN |
11745                                                 HCI_MGMT_HDEV_OPTIONAL },
11746         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
11747                                                 HCI_MGMT_UNTRUSTED },
11748         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
11749                                                 HCI_MGMT_VAR_LEN },
11750         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
11751                                                 HCI_MGMT_UNTRUSTED },
11752         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
11753                                                 HCI_MGMT_VAR_LEN },
11754         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
11755         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
11756         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
11757         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
11758                                                 HCI_MGMT_VAR_LEN },
11759         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
11760         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
11761                                                 HCI_MGMT_VAR_LEN },
11762         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
11763                                                 HCI_MGMT_VAR_LEN },
11764         { add_adv_patterns_monitor_rssi,
11765                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
11766                                                 HCI_MGMT_VAR_LEN },
11767         { set_mesh,                MGMT_SET_MESH_RECEIVER_SIZE,
11768                                                 HCI_MGMT_VAR_LEN },
11769         { mesh_features,           MGMT_MESH_READ_FEATURES_SIZE },
11770         { mesh_send,               MGMT_MESH_SEND_SIZE,
11771                                                 HCI_MGMT_VAR_LEN },
11772         { mesh_send_cancel,        MGMT_MESH_SEND_CANCEL_SIZE },
11773 };
11774
11775 #ifdef TIZEN_BT
11776 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
11777         { NULL }, /* 0x0000 (no command) */
11778         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
11779         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
11780                                                 HCI_MGMT_VAR_LEN },
11781         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
11782                                                 HCI_MGMT_VAR_LEN },
11783         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
11784         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
11785         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
11786         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
11787         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
11788         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
11789         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
11790         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
11791         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
11792         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
11793         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
11794         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
11795         { set_voice_setting,       MGMT_SET_VOICE_SETTING_SIZE },
11796         { get_adv_tx_power,        MGMT_GET_ADV_TX_POWER_SIZE },
11797         { enable_bt_6lowpan,       MGMT_ENABLE_BT_6LOWPAN_SIZE },
11798         { connect_bt_6lowpan,      MGMT_CONNECT_6LOWPAN_SIZE },
11799         { disconnect_bt_6lowpan,   MGMT_DISCONNECT_6LOWPAN_SIZE },
11800         { read_maximum_le_data_length,
11801                                    MGMT_LE_READ_MAXIMUM_DATA_LENGTH_SIZE },
11802         { write_host_suggested_le_data_length,
11803                                    MGMT_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH_SIZE },
11804         { read_host_suggested_data_length,
11805                                    MGMT_LE_READ_HOST_SUGGESTED_DATA_LENGTH_SIZE },
11806         { set_le_data_length_params,
11807                                    MGMT_LE_SET_DATA_LENGTH_SIZE },
11808 };
11809 #endif
11810
11811 void mgmt_index_added(struct hci_dev *hdev)
11812 {
11813         struct mgmt_ev_ext_index ev;
11814
11815         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
11816                 return;
11817
11818         switch (hdev->dev_type) {
11819         case HCI_PRIMARY:
11820                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
11821                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
11822                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
11823                         ev.type = 0x01;
11824                 } else {
11825                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
11826                                          HCI_MGMT_INDEX_EVENTS);
11827                         ev.type = 0x00;
11828                 }
11829                 break;
11830         case HCI_AMP:
11831                 ev.type = 0x02;
11832                 break;
11833         default:
11834                 return;
11835         }
11836
11837         ev.bus = hdev->bus;
11838
11839         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
11840                          HCI_MGMT_EXT_INDEX_EVENTS);
11841 }
11842
11843 void mgmt_index_removed(struct hci_dev *hdev)
11844 {
11845         struct mgmt_ev_ext_index ev;
11846         u8 status = MGMT_STATUS_INVALID_INDEX;
11847
11848         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
11849                 return;
11850
11851         switch (hdev->dev_type) {
11852         case HCI_PRIMARY:
11853                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
11854
11855                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
11856                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
11857                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
11858                         ev.type = 0x01;
11859                 } else {
11860                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
11861                                          HCI_MGMT_INDEX_EVENTS);
11862                         ev.type = 0x00;
11863                 }
11864                 break;
11865         case HCI_AMP:
11866                 ev.type = 0x02;
11867                 break;
11868         default:
11869                 return;
11870         }
11871
11872         ev.bus = hdev->bus;
11873
11874         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
11875                          HCI_MGMT_EXT_INDEX_EVENTS);
11876
11877         /* Cancel any remaining timed work */
11878         if (!hci_dev_test_flag(hdev, HCI_MGMT))
11879                 return;
11880         cancel_delayed_work_sync(&hdev->discov_off);
11881         cancel_delayed_work_sync(&hdev->service_cache);
11882         cancel_delayed_work_sync(&hdev->rpa_expired);
11883 }
11884
11885 void mgmt_power_on(struct hci_dev *hdev, int err)
11886 {
11887         struct cmd_lookup match = { NULL, hdev };
11888
11889         bt_dev_dbg(hdev, "err %d", err);
11890
11891         hci_dev_lock(hdev);
11892
11893         if (!err) {
11894                 restart_le_actions(hdev);
11895                 hci_update_passive_scan(hdev);
11896         }
11897
11898         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
11899
11900         new_settings(hdev, match.sk);
11901
11902         if (match.sk)
11903                 sock_put(match.sk);
11904
11905         hci_dev_unlock(hdev);
11906 }
11907
11908 void __mgmt_power_off(struct hci_dev *hdev)
11909 {
11910         struct cmd_lookup match = { NULL, hdev };
11911         u8 status, zero_cod[] = { 0, 0, 0 };
11912
11913         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
11914
11915         /* If the power off is because of hdev unregistration let
11916          * use the appropriate INVALID_INDEX status. Otherwise use
11917          * NOT_POWERED. We cover both scenarios here since later in
11918          * mgmt_index_removed() any hci_conn callbacks will have already
11919          * been triggered, potentially causing misleading DISCONNECTED
11920          * status responses.
11921          */
11922         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
11923                 status = MGMT_STATUS_INVALID_INDEX;
11924         else
11925                 status = MGMT_STATUS_NOT_POWERED;
11926
11927         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
11928
11929         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
11930                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
11931                                    zero_cod, sizeof(zero_cod),
11932                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11933                 ext_info_changed(hdev, NULL);
11934         }
11935
11936         new_settings(hdev, match.sk);
11937
11938         if (match.sk)
11939                 sock_put(match.sk);
11940 }
11941
11942 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
11943 {
11944         struct mgmt_pending_cmd *cmd;
11945         u8 status;
11946
11947         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11948         if (!cmd)
11949                 return;
11950
11951         if (err == -ERFKILL)
11952                 status = MGMT_STATUS_RFKILLED;
11953         else
11954                 status = MGMT_STATUS_FAILED;
11955
11956         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
11957
11958         mgmt_pending_remove(cmd);
11959 }
11960
11961 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
11962                        bool persistent)
11963 {
11964         struct mgmt_ev_new_link_key ev;
11965
11966         memset(&ev, 0, sizeof(ev));
11967
11968         ev.store_hint = persistent;
11969         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11970         ev.key.addr.type = BDADDR_BREDR;
11971         ev.key.type = key->type;
11972         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
11973         ev.key.pin_len = key->pin_len;
11974
11975         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
11976 }
11977
11978 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
11979 {
11980         switch (ltk->type) {
11981         case SMP_LTK:
11982         case SMP_LTK_RESPONDER:
11983                 if (ltk->authenticated)
11984                         return MGMT_LTK_AUTHENTICATED;
11985                 return MGMT_LTK_UNAUTHENTICATED;
11986         case SMP_LTK_P256:
11987                 if (ltk->authenticated)
11988                         return MGMT_LTK_P256_AUTH;
11989                 return MGMT_LTK_P256_UNAUTH;
11990         case SMP_LTK_P256_DEBUG:
11991                 return MGMT_LTK_P256_DEBUG;
11992         }
11993
11994         return MGMT_LTK_UNAUTHENTICATED;
11995 }
11996
11997 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
11998 {
11999         struct mgmt_ev_new_long_term_key ev;
12000
12001         memset(&ev, 0, sizeof(ev));
12002
12003         /* Devices using resolvable or non-resolvable random addresses
12004          * without providing an identity resolving key don't require
12005          * to store long term keys. Their addresses will change the
12006          * next time around.
12007          *
12008          * Only when a remote device provides an identity address
12009          * make sure the long term key is stored. If the remote
12010          * identity is known, the long term keys are internally
12011          * mapped to the identity address. So allow static random
12012          * and public addresses here.
12013          */
12014         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
12015             (key->bdaddr.b[5] & 0xc0) != 0xc0)
12016                 ev.store_hint = 0x00;
12017         else
12018                 ev.store_hint = persistent;
12019
12020         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
12021         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
12022         ev.key.type = mgmt_ltk_type(key);
12023         ev.key.enc_size = key->enc_size;
12024         ev.key.ediv = key->ediv;
12025         ev.key.rand = key->rand;
12026
12027         if (key->type == SMP_LTK)
12028                 ev.key.initiator = 1;
12029
12030         /* Make sure we copy only the significant bytes based on the
12031          * encryption key size, and set the rest of the value to zeroes.
12032          */
12033         memcpy(ev.key.val, key->val, key->enc_size);
12034         memset(ev.key.val + key->enc_size, 0,
12035                sizeof(ev.key.val) - key->enc_size);
12036
12037         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
12038 }
12039
12040 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
12041 {
12042         struct mgmt_ev_new_irk ev;
12043
12044         memset(&ev, 0, sizeof(ev));
12045
12046         ev.store_hint = persistent;
12047
12048         bacpy(&ev.rpa, &irk->rpa);
12049         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
12050         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
12051         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
12052
12053         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
12054 }
12055
12056 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
12057                    bool persistent)
12058 {
12059         struct mgmt_ev_new_csrk ev;
12060
12061         memset(&ev, 0, sizeof(ev));
12062
12063         /* Devices using resolvable or non-resolvable random addresses
12064          * without providing an identity resolving key don't require
12065          * to store signature resolving keys. Their addresses will change
12066          * the next time around.
12067          *
12068          * Only when a remote device provides an identity address
12069          * make sure the signature resolving key is stored. So allow
12070          * static random and public addresses here.
12071          */
12072         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
12073             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
12074                 ev.store_hint = 0x00;
12075         else
12076                 ev.store_hint = persistent;
12077
12078         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
12079         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
12080         ev.key.type = csrk->type;
12081         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
12082
12083         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
12084 }
12085
12086 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
12087                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
12088                          u16 max_interval, u16 latency, u16 timeout)
12089 {
12090         struct mgmt_ev_new_conn_param ev;
12091
12092         if (!hci_is_identity_address(bdaddr, bdaddr_type))
12093                 return;
12094
12095         memset(&ev, 0, sizeof(ev));
12096         bacpy(&ev.addr.bdaddr, bdaddr);
12097         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
12098         ev.store_hint = store_hint;
12099         ev.min_interval = cpu_to_le16(min_interval);
12100         ev.max_interval = cpu_to_le16(max_interval);
12101         ev.latency = cpu_to_le16(latency);
12102         ev.timeout = cpu_to_le16(timeout);
12103
12104         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
12105 }
12106
12107 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
12108                            u8 *name, u8 name_len)
12109 {
12110         struct sk_buff *skb;
12111         struct mgmt_ev_device_connected *ev;
12112         u16 eir_len = 0;
12113         u32 flags = 0;
12114
12115         /* allocate buff for LE or BR/EDR adv */
12116         if (conn->le_adv_data_len > 0)
12117                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
12118                                      sizeof(*ev) + conn->le_adv_data_len);
12119         else
12120                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
12121                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
12122                                      eir_precalc_len(sizeof(conn->dev_class)));
12123
12124         ev = skb_put(skb, sizeof(*ev));
12125         bacpy(&ev->addr.bdaddr, &conn->dst);
12126         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
12127
12128         if (conn->out)
12129                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
12130
12131         ev->flags = __cpu_to_le32(flags);
12132
12133         /* We must ensure that the EIR Data fields are ordered and
12134          * unique. Keep it simple for now and avoid the problem by not
12135          * adding any BR/EDR data to the LE adv.
12136          */
12137         if (conn->le_adv_data_len > 0) {
12138                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
12139                 eir_len = conn->le_adv_data_len;
12140         } else {
12141                 if (name)
12142                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
12143
12144                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
12145                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
12146                                                     conn->dev_class, sizeof(conn->dev_class));
12147         }
12148
12149         ev->eir_len = cpu_to_le16(eir_len);
12150
12151         mgmt_event_skb(skb, NULL);
12152 }
12153
12154 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
12155 {
12156         struct sock **sk = data;
12157
12158         cmd->cmd_complete(cmd, 0);
12159
12160         *sk = cmd->sk;
12161         sock_hold(*sk);
12162
12163         mgmt_pending_remove(cmd);
12164 }
12165
12166 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
12167 {
12168         struct hci_dev *hdev = data;
12169         struct mgmt_cp_unpair_device *cp = cmd->param;
12170
12171         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
12172
12173         cmd->cmd_complete(cmd, 0);
12174         mgmt_pending_remove(cmd);
12175 }
12176
12177 bool mgmt_powering_down(struct hci_dev *hdev)
12178 {
12179         struct mgmt_pending_cmd *cmd;
12180         struct mgmt_mode *cp;
12181
12182         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
12183         if (!cmd)
12184                 return false;
12185
12186         cp = cmd->param;
12187         if (!cp->val)
12188                 return true;
12189
12190         return false;
12191 }
12192
12193 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12194                               u8 link_type, u8 addr_type, u8 reason,
12195                               bool mgmt_connected)
12196 {
12197         struct mgmt_ev_device_disconnected ev;
12198         struct sock *sk = NULL;
12199
12200         /* The connection is still in hci_conn_hash so test for 1
12201          * instead of 0 to know if this is the last one.
12202          */
12203         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
12204                 cancel_delayed_work(&hdev->power_off);
12205                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
12206         }
12207
12208         if (!mgmt_connected)
12209                 return;
12210
12211         if (link_type != ACL_LINK && link_type != LE_LINK)
12212                 return;
12213
12214         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
12215
12216         bacpy(&ev.addr.bdaddr, bdaddr);
12217         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12218         ev.reason = reason;
12219
12220         /* Report disconnects due to suspend */
12221         if (hdev->suspended)
12222                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
12223
12224         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
12225
12226         if (sk)
12227                 sock_put(sk);
12228
12229         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
12230                              hdev);
12231 }
12232
12233 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
12234                             u8 link_type, u8 addr_type, u8 status)
12235 {
12236         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
12237         struct mgmt_cp_disconnect *cp;
12238         struct mgmt_pending_cmd *cmd;
12239
12240         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
12241                              hdev);
12242
12243         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
12244         if (!cmd)
12245                 return;
12246
12247         cp = cmd->param;
12248
12249         if (bacmp(bdaddr, &cp->addr.bdaddr))
12250                 return;
12251
12252         if (cp->addr.type != bdaddr_type)
12253                 return;
12254
12255         cmd->cmd_complete(cmd, mgmt_status(status));
12256         mgmt_pending_remove(cmd);
12257 }
12258
12259 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
12260                          u8 addr_type, u8 status)
12261 {
12262         struct mgmt_ev_connect_failed ev;
12263
12264         /* The connection is still in hci_conn_hash so test for 1
12265          * instead of 0 to know if this is the last one.
12266          */
12267         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
12268                 cancel_delayed_work(&hdev->power_off);
12269                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
12270         }
12271
12272         bacpy(&ev.addr.bdaddr, bdaddr);
12273         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12274         ev.status = mgmt_status(status);
12275
12276         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
12277 }
12278
12279 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
12280 {
12281         struct mgmt_ev_pin_code_request ev;
12282
12283         bacpy(&ev.addr.bdaddr, bdaddr);
12284         ev.addr.type = BDADDR_BREDR;
12285         ev.secure = secure;
12286
12287         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
12288 }
12289
12290 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12291                                   u8 status)
12292 {
12293         struct mgmt_pending_cmd *cmd;
12294
12295         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
12296         if (!cmd)
12297                 return;
12298
12299         cmd->cmd_complete(cmd, mgmt_status(status));
12300         mgmt_pending_remove(cmd);
12301 }
12302
12303 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12304                                       u8 status)
12305 {
12306         struct mgmt_pending_cmd *cmd;
12307
12308         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
12309         if (!cmd)
12310                 return;
12311
12312         cmd->cmd_complete(cmd, mgmt_status(status));
12313         mgmt_pending_remove(cmd);
12314 }
12315
12316 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
12317                               u8 link_type, u8 addr_type, u32 value,
12318                               u8 confirm_hint)
12319 {
12320         struct mgmt_ev_user_confirm_request ev;
12321
12322         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
12323
12324         bacpy(&ev.addr.bdaddr, bdaddr);
12325         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12326         ev.confirm_hint = confirm_hint;
12327         ev.value = cpu_to_le32(value);
12328
12329         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
12330                           NULL);
12331 }
12332
12333 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
12334                               u8 link_type, u8 addr_type)
12335 {
12336         struct mgmt_ev_user_passkey_request ev;
12337
12338         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
12339
12340         bacpy(&ev.addr.bdaddr, bdaddr);
12341         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12342
12343         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
12344                           NULL);
12345 }
12346
12347 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12348                                       u8 link_type, u8 addr_type, u8 status,
12349                                       u8 opcode)
12350 {
12351         struct mgmt_pending_cmd *cmd;
12352
12353         cmd = pending_find(opcode, hdev);
12354         if (!cmd)
12355                 return -ENOENT;
12356
12357         cmd->cmd_complete(cmd, mgmt_status(status));
12358         mgmt_pending_remove(cmd);
12359
12360         return 0;
12361 }
12362
12363 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12364                                      u8 link_type, u8 addr_type, u8 status)
12365 {
12366         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12367                                           status, MGMT_OP_USER_CONFIRM_REPLY);
12368 }
12369
12370 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12371                                          u8 link_type, u8 addr_type, u8 status)
12372 {
12373         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12374                                           status,
12375                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
12376 }
12377
12378 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12379                                      u8 link_type, u8 addr_type, u8 status)
12380 {
12381         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12382                                           status, MGMT_OP_USER_PASSKEY_REPLY);
12383 }
12384
12385 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12386                                          u8 link_type, u8 addr_type, u8 status)
12387 {
12388         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12389                                           status,
12390                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
12391 }
12392
12393 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
12394                              u8 link_type, u8 addr_type, u32 passkey,
12395                              u8 entered)
12396 {
12397         struct mgmt_ev_passkey_notify ev;
12398
12399         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
12400
12401         bacpy(&ev.addr.bdaddr, bdaddr);
12402         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12403         ev.passkey = __cpu_to_le32(passkey);
12404         ev.entered = entered;
12405
12406         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
12407 }
12408
12409 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
12410 {
12411         struct mgmt_ev_auth_failed ev;
12412         struct mgmt_pending_cmd *cmd;
12413         u8 status = mgmt_status(hci_status);
12414
12415         bacpy(&ev.addr.bdaddr, &conn->dst);
12416         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
12417         ev.status = status;
12418
12419         cmd = find_pairing(conn);
12420
12421         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
12422                     cmd ? cmd->sk : NULL);
12423
12424         if (cmd) {
12425                 cmd->cmd_complete(cmd, status);
12426                 mgmt_pending_remove(cmd);
12427         }
12428 }
12429
12430 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
12431 {
12432         struct cmd_lookup match = { NULL, hdev };
12433         bool changed;
12434
12435         if (status) {
12436                 u8 mgmt_err = mgmt_status(status);
12437                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
12438                                      cmd_status_rsp, &mgmt_err);
12439                 return;
12440         }
12441
12442         if (test_bit(HCI_AUTH, &hdev->flags))
12443                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
12444         else
12445                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
12446
12447         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
12448                              &match);
12449
12450         if (changed)
12451                 new_settings(hdev, match.sk);
12452
12453         if (match.sk)
12454                 sock_put(match.sk);
12455 }
12456
12457 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
12458 {
12459         struct cmd_lookup *match = data;
12460
12461         if (match->sk == NULL) {
12462                 match->sk = cmd->sk;
12463                 sock_hold(match->sk);
12464         }
12465 }
12466
12467 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
12468                                     u8 status)
12469 {
12470         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
12471
12472         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
12473         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
12474         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
12475
12476         if (!status) {
12477                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
12478                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
12479                 ext_info_changed(hdev, NULL);
12480         }
12481
12482         if (match.sk)
12483                 sock_put(match.sk);
12484 }
12485
12486 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
12487 {
12488         struct mgmt_cp_set_local_name ev;
12489         struct mgmt_pending_cmd *cmd;
12490
12491         if (status)
12492                 return;
12493
12494         memset(&ev, 0, sizeof(ev));
12495         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
12496         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
12497
12498         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
12499         if (!cmd) {
12500                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
12501
12502                 /* If this is a HCI command related to powering on the
12503                  * HCI dev don't send any mgmt signals.
12504                  */
12505                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
12506                         return;
12507         }
12508
12509         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
12510                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
12511         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
12512 }
12513
12514 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
12515 {
12516         int i;
12517
12518         for (i = 0; i < uuid_count; i++) {
12519                 if (!memcmp(uuid, uuids[i], 16))
12520                         return true;
12521         }
12522
12523         return false;
12524 }
12525
12526 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
12527 {
12528         u16 parsed = 0;
12529
12530         while (parsed < eir_len) {
12531                 u8 field_len = eir[0];
12532                 u8 uuid[16];
12533                 int i;
12534
12535                 if (field_len == 0)
12536                         break;
12537
12538                 if (eir_len - parsed < field_len + 1)
12539                         break;
12540
12541                 switch (eir[1]) {
12542                 case EIR_UUID16_ALL:
12543                 case EIR_UUID16_SOME:
12544                         for (i = 0; i + 3 <= field_len; i += 2) {
12545                                 memcpy(uuid, bluetooth_base_uuid, 16);
12546                                 uuid[13] = eir[i + 3];
12547                                 uuid[12] = eir[i + 2];
12548                                 if (has_uuid(uuid, uuid_count, uuids))
12549                                         return true;
12550                         }
12551                         break;
12552                 case EIR_UUID32_ALL:
12553                 case EIR_UUID32_SOME:
12554                         for (i = 0; i + 5 <= field_len; i += 4) {
12555                                 memcpy(uuid, bluetooth_base_uuid, 16);
12556                                 uuid[15] = eir[i + 5];
12557                                 uuid[14] = eir[i + 4];
12558                                 uuid[13] = eir[i + 3];
12559                                 uuid[12] = eir[i + 2];
12560                                 if (has_uuid(uuid, uuid_count, uuids))
12561                                         return true;
12562                         }
12563                         break;
12564                 case EIR_UUID128_ALL:
12565                 case EIR_UUID128_SOME:
12566                         for (i = 0; i + 17 <= field_len; i += 16) {
12567                                 memcpy(uuid, eir + i + 2, 16);
12568                                 if (has_uuid(uuid, uuid_count, uuids))
12569                                         return true;
12570                         }
12571                         break;
12572                 }
12573
12574                 parsed += field_len + 1;
12575                 eir += field_len + 1;
12576         }
12577
12578         return false;
12579 }
12580
12581 static void restart_le_scan(struct hci_dev *hdev)
12582 {
12583         /* If controller is not scanning we are done. */
12584         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
12585                 return;
12586
12587         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
12588                        hdev->discovery.scan_start +
12589                        hdev->discovery.scan_duration))
12590                 return;
12591
12592         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
12593                            DISCOV_LE_RESTART_DELAY);
12594 }
12595
12596 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
12597                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
12598 {
12599         /* If a RSSI threshold has been specified, and
12600          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
12601          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
12602          * is set, let it through for further processing, as we might need to
12603          * restart the scan.
12604          *
12605          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
12606          * the results are also dropped.
12607          */
12608         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
12609             (rssi == HCI_RSSI_INVALID ||
12610             (rssi < hdev->discovery.rssi &&
12611              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
12612                 return  false;
12613
12614         if (hdev->discovery.uuid_count != 0) {
12615                 /* If a list of UUIDs is provided in filter, results with no
12616                  * matching UUID should be dropped.
12617                  */
12618                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
12619                                    hdev->discovery.uuids) &&
12620                     !eir_has_uuids(scan_rsp, scan_rsp_len,
12621                                    hdev->discovery.uuid_count,
12622                                    hdev->discovery.uuids))
12623                         return false;
12624         }
12625
12626         /* If duplicate filtering does not report RSSI changes, then restart
12627          * scanning to ensure updated result with updated RSSI values.
12628          */
12629         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
12630                 restart_le_scan(hdev);
12631
12632                 /* Validate RSSI value against the RSSI threshold once more. */
12633                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
12634                     rssi < hdev->discovery.rssi)
12635                         return false;
12636         }
12637
12638         return true;
12639 }
12640
12641 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
12642                                   bdaddr_t *bdaddr, u8 addr_type)
12643 {
12644         struct mgmt_ev_adv_monitor_device_lost ev;
12645
12646         ev.monitor_handle = cpu_to_le16(handle);
12647         bacpy(&ev.addr.bdaddr, bdaddr);
12648         ev.addr.type = addr_type;
12649
12650         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
12651                    NULL);
12652 }
12653
12654 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
12655                                                struct sk_buff *skb,
12656                                                struct sock *skip_sk,
12657                                                u16 handle)
12658 {
12659         struct sk_buff *advmon_skb;
12660         size_t advmon_skb_len;
12661         __le16 *monitor_handle;
12662
12663         if (!skb)
12664                 return;
12665
12666         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
12667                           sizeof(struct mgmt_ev_device_found)) + skb->len;
12668         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
12669                                     advmon_skb_len);
12670         if (!advmon_skb)
12671                 return;
12672
12673         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
12674          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
12675          * store monitor_handle of the matched monitor.
12676          */
12677         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
12678         *monitor_handle = cpu_to_le16(handle);
12679         skb_put_data(advmon_skb, skb->data, skb->len);
12680
12681         mgmt_event_skb(advmon_skb, skip_sk);
12682 }
12683
12684 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
12685                                           bdaddr_t *bdaddr, bool report_device,
12686                                           struct sk_buff *skb,
12687                                           struct sock *skip_sk)
12688 {
12689         struct monitored_device *dev, *tmp;
12690         bool matched = false;
12691         bool notified = false;
12692
12693         /* We have received the Advertisement Report because:
12694          * 1. the kernel has initiated active discovery
12695          * 2. if not, we have pend_le_reports > 0 in which case we are doing
12696          *    passive scanning
12697          * 3. if none of the above is true, we have one or more active
12698          *    Advertisement Monitor
12699          *
12700          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
12701          * and report ONLY one advertisement per device for the matched Monitor
12702          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
12703          *
12704          * For case 3, since we are not active scanning and all advertisements
12705          * received are due to a matched Advertisement Monitor, report all
12706          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
12707          */
12708         if (report_device && !hdev->advmon_pend_notify) {
12709                 mgmt_event_skb(skb, skip_sk);
12710                 return;
12711         }
12712
12713         hdev->advmon_pend_notify = false;
12714
12715         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
12716                 if (!bacmp(&dev->bdaddr, bdaddr)) {
12717                         matched = true;
12718
12719                         if (!dev->notified) {
12720                                 mgmt_send_adv_monitor_device_found(hdev, skb,
12721                                                                    skip_sk,
12722                                                                    dev->handle);
12723                                 notified = true;
12724                                 dev->notified = true;
12725                         }
12726                 }
12727
12728                 if (!dev->notified)
12729                         hdev->advmon_pend_notify = true;
12730         }
12731
12732         if (!report_device &&
12733             ((matched && !notified) || !msft_monitor_supported(hdev))) {
12734                 /* Handle 0 indicates that we are not active scanning and this
12735                  * is a subsequent advertisement report for an already matched
12736                  * Advertisement Monitor or the controller offloading support
12737                  * is not available.
12738                  */
12739                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
12740         }
12741
12742         if (report_device)
12743                 mgmt_event_skb(skb, skip_sk);
12744         else
12745                 kfree_skb(skb);
12746 }
12747
12748 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
12749                               u8 addr_type, s8 rssi, u32 flags, u8 *eir,
12750                               u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
12751                               u64 instant)
12752 {
12753         struct sk_buff *skb;
12754         struct mgmt_ev_mesh_device_found *ev;
12755         int i, j;
12756
12757         if (!hdev->mesh_ad_types[0])
12758                 goto accepted;
12759
12760         /* Scan for requested AD types */
12761         if (eir_len > 0) {
12762                 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
12763                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
12764                                 if (!hdev->mesh_ad_types[j])
12765                                         break;
12766
12767                                 if (hdev->mesh_ad_types[j] == eir[i + 1])
12768                                         goto accepted;
12769                         }
12770                 }
12771         }
12772
12773         if (scan_rsp_len > 0) {
12774                 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
12775                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
12776                                 if (!hdev->mesh_ad_types[j])
12777                                         break;
12778
12779                                 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
12780                                         goto accepted;
12781                         }
12782                 }
12783         }
12784
12785         return;
12786
12787 accepted:
12788         skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
12789                              sizeof(*ev) + eir_len + scan_rsp_len);
12790         if (!skb)
12791                 return;
12792
12793         ev = skb_put(skb, sizeof(*ev));
12794
12795         bacpy(&ev->addr.bdaddr, bdaddr);
12796         ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
12797         ev->rssi = rssi;
12798         ev->flags = cpu_to_le32(flags);
12799         ev->instant = cpu_to_le64(instant);
12800
12801         if (eir_len > 0)
12802                 /* Copy EIR or advertising data into event */
12803                 skb_put_data(skb, eir, eir_len);
12804
12805         if (scan_rsp_len > 0)
12806                 /* Append scan response data to event */
12807                 skb_put_data(skb, scan_rsp, scan_rsp_len);
12808
12809         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
12810
12811         mgmt_event_skb(skb, NULL);
12812 }
12813
12814 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
12815                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
12816                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
12817                        u64 instant)
12818 {
12819         struct sk_buff *skb;
12820         struct mgmt_ev_device_found *ev;
12821         bool report_device = hci_discovery_active(hdev);
12822
12823         if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
12824                 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
12825                                   eir, eir_len, scan_rsp, scan_rsp_len,
12826                                   instant);
12827
12828         /* Don't send events for a non-kernel initiated discovery. With
12829          * LE one exception is if we have pend_le_reports > 0 in which
12830          * case we're doing passive scanning and want these events.
12831          */
12832         if (!hci_discovery_active(hdev)) {
12833                 if (link_type == ACL_LINK)
12834                         return;
12835                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
12836                         report_device = true;
12837                 else if (!hci_is_adv_monitoring(hdev))
12838                         return;
12839         }
12840
12841         if (hdev->discovery.result_filtering) {
12842                 /* We are using service discovery */
12843                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
12844                                      scan_rsp_len))
12845                         return;
12846         }
12847
12848         if (hdev->discovery.limited) {
12849                 /* Check for limited discoverable bit */
12850                 if (dev_class) {
12851                         if (!(dev_class[1] & 0x20))
12852                                 return;
12853                 } else {
12854                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
12855                         if (!flags || !(flags[0] & LE_AD_LIMITED))
12856                                 return;
12857                 }
12858         }
12859
12860         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
12861         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
12862                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
12863         if (!skb)
12864                 return;
12865
12866         ev = skb_put(skb, sizeof(*ev));
12867
12868         /* In case of device discovery with BR/EDR devices (pre 1.2), the
12869          * RSSI value was reported as 0 when not available. This behavior
12870          * is kept when using device discovery. This is required for full
12871          * backwards compatibility with the API.
12872          *
12873          * However when using service discovery, the value 127 will be
12874          * returned when the RSSI is not available.
12875          */
12876         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
12877             link_type == ACL_LINK)
12878                 rssi = 0;
12879
12880         bacpy(&ev->addr.bdaddr, bdaddr);
12881         ev->addr.type = link_to_bdaddr(link_type, addr_type);
12882         ev->rssi = rssi;
12883         ev->flags = cpu_to_le32(flags);
12884
12885         if (eir_len > 0)
12886                 /* Copy EIR or advertising data into event */
12887                 skb_put_data(skb, eir, eir_len);
12888
12889         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
12890                 u8 eir_cod[5];
12891
12892                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
12893                                            dev_class, 3);
12894                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
12895         }
12896
12897         if (scan_rsp_len > 0)
12898                 /* Append scan response data to event */
12899                 skb_put_data(skb, scan_rsp, scan_rsp_len);
12900
12901         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
12902
12903         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
12904 }
12905
12906 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
12907                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
12908 {
12909         struct sk_buff *skb;
12910         struct mgmt_ev_device_found *ev;
12911         u16 eir_len = 0;
12912         u32 flags = 0;
12913
12914         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
12915                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
12916
12917         ev = skb_put(skb, sizeof(*ev));
12918         bacpy(&ev->addr.bdaddr, bdaddr);
12919         ev->addr.type = link_to_bdaddr(link_type, addr_type);
12920         ev->rssi = rssi;
12921
12922         if (name)
12923                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
12924         else
12925                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
12926
12927         ev->eir_len = cpu_to_le16(eir_len);
12928         ev->flags = cpu_to_le32(flags);
12929
12930         mgmt_event_skb(skb, NULL);
12931 }
12932
12933 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
12934 {
12935         struct mgmt_ev_discovering ev;
12936
12937         bt_dev_dbg(hdev, "discovering %u", discovering);
12938
12939         memset(&ev, 0, sizeof(ev));
12940         ev.type = hdev->discovery.type;
12941         ev.discovering = discovering;
12942
12943         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
12944 }
12945
12946 void mgmt_suspending(struct hci_dev *hdev, u8 state)
12947 {
12948         struct mgmt_ev_controller_suspend ev;
12949
12950         ev.suspend_state = state;
12951         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
12952 }
12953
12954 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
12955                    u8 addr_type)
12956 {
12957         struct mgmt_ev_controller_resume ev;
12958
12959         ev.wake_reason = reason;
12960         if (bdaddr) {
12961                 bacpy(&ev.addr.bdaddr, bdaddr);
12962                 ev.addr.type = addr_type;
12963         } else {
12964                 memset(&ev.addr, 0, sizeof(ev.addr));
12965         }
12966
12967         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
12968 }
12969
12970 static struct hci_mgmt_chan chan = {
12971         .channel        = HCI_CHANNEL_CONTROL,
12972         .handler_count  = ARRAY_SIZE(mgmt_handlers),
12973         .handlers       = mgmt_handlers,
12974 #ifdef TIZEN_BT
12975         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
12976         .tizen_handlers = tizen_mgmt_handlers,
12977 #endif
12978         .hdev_init      = mgmt_init_hdev,
12979 };
12980
12981 int mgmt_init(void)
12982 {
12983         return hci_mgmt_chan_register(&chan);
12984 }
12985
12986 void mgmt_exit(void)
12987 {
12988         hci_mgmt_chan_unregister(&chan);
12989 }
12990
12991 void mgmt_cleanup(struct sock *sk)
12992 {
12993         struct mgmt_mesh_tx *mesh_tx;
12994         struct hci_dev *hdev;
12995
12996         read_lock(&hci_dev_list_lock);
12997
12998         list_for_each_entry(hdev, &hci_dev_list, list) {
12999                 do {
13000                         mesh_tx = mgmt_mesh_next(hdev, sk);
13001
13002                         if (mesh_tx)
13003                                 mesh_send_complete(hdev, mesh_tx, true);
13004                 } while (mesh_tx);
13005         }
13006
13007         read_unlock(&hci_dev_list_lock);
13008 }