net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #include <net/bluetooth/sco.h>
  38 #endif
  39
  40 #include "hci_request.h"
  41 #include "smp.h"
  42 #include "mgmt_util.h"
  43 #include "mgmt_config.h"
  44 #include "msft.h"
  45 #include "eir.h"
  46 #include "aosp.h"
  47
  48 #define MGMT_VERSION    1
  49 #define MGMT_REVISION   22
  50
  51 static const u16 mgmt_commands[] = {
  52         MGMT_OP_READ_INDEX_LIST,
  53         MGMT_OP_READ_INFO,
  54         MGMT_OP_SET_POWERED,
  55         MGMT_OP_SET_DISCOVERABLE,
  56         MGMT_OP_SET_CONNECTABLE,
  57         MGMT_OP_SET_FAST_CONNECTABLE,
  58         MGMT_OP_SET_BONDABLE,
  59         MGMT_OP_SET_LINK_SECURITY,
  60         MGMT_OP_SET_SSP,
  61         MGMT_OP_SET_HS,
  62         MGMT_OP_SET_LE,
  63         MGMT_OP_SET_DEV_CLASS,
  64         MGMT_OP_SET_LOCAL_NAME,
  65         MGMT_OP_ADD_UUID,
  66         MGMT_OP_REMOVE_UUID,
  67         MGMT_OP_LOAD_LINK_KEYS,
  68         MGMT_OP_LOAD_LONG_TERM_KEYS,
  69         MGMT_OP_DISCONNECT,
  70         MGMT_OP_GET_CONNECTIONS,
  71         MGMT_OP_PIN_CODE_REPLY,
  72         MGMT_OP_PIN_CODE_NEG_REPLY,
  73         MGMT_OP_SET_IO_CAPABILITY,
  74         MGMT_OP_PAIR_DEVICE,
  75         MGMT_OP_CANCEL_PAIR_DEVICE,
  76         MGMT_OP_UNPAIR_DEVICE,
  77         MGMT_OP_USER_CONFIRM_REPLY,
  78         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  79         MGMT_OP_USER_PASSKEY_REPLY,
  80         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  81         MGMT_OP_READ_LOCAL_OOB_DATA,
  82         MGMT_OP_ADD_REMOTE_OOB_DATA,
  83         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  84         MGMT_OP_START_DISCOVERY,
  85         MGMT_OP_STOP_DISCOVERY,
  86         MGMT_OP_CONFIRM_NAME,
  87         MGMT_OP_BLOCK_DEVICE,
  88         MGMT_OP_UNBLOCK_DEVICE,
  89         MGMT_OP_SET_DEVICE_ID,
  90         MGMT_OP_SET_ADVERTISING,
  91         MGMT_OP_SET_BREDR,
  92         MGMT_OP_SET_STATIC_ADDRESS,
  93         MGMT_OP_SET_SCAN_PARAMS,
  94         MGMT_OP_SET_SECURE_CONN,
  95         MGMT_OP_SET_DEBUG_KEYS,
  96         MGMT_OP_SET_PRIVACY,
  97         MGMT_OP_LOAD_IRKS,
  98         MGMT_OP_GET_CONN_INFO,
  99         MGMT_OP_GET_CLOCK_INFO,
 100         MGMT_OP_ADD_DEVICE,
 101         MGMT_OP_REMOVE_DEVICE,
 102         MGMT_OP_LOAD_CONN_PARAM,
 103         MGMT_OP_READ_UNCONF_INDEX_LIST,
 104         MGMT_OP_READ_CONFIG_INFO,
 105         MGMT_OP_SET_EXTERNAL_CONFIG,
 106         MGMT_OP_SET_PUBLIC_ADDRESS,
 107         MGMT_OP_START_SERVICE_DISCOVERY,
 108         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 109         MGMT_OP_READ_EXT_INDEX_LIST,
 110         MGMT_OP_READ_ADV_FEATURES,
 111         MGMT_OP_ADD_ADVERTISING,
 112         MGMT_OP_REMOVE_ADVERTISING,
 113         MGMT_OP_GET_ADV_SIZE_INFO,
 114         MGMT_OP_START_LIMITED_DISCOVERY,
 115         MGMT_OP_READ_EXT_INFO,
 116         MGMT_OP_SET_APPEARANCE,
 117         MGMT_OP_GET_PHY_CONFIGURATION,
 118         MGMT_OP_SET_PHY_CONFIGURATION,
 119         MGMT_OP_SET_BLOCKED_KEYS,
 120         MGMT_OP_SET_WIDEBAND_SPEECH,
 121         MGMT_OP_READ_CONTROLLER_CAP,
 122         MGMT_OP_READ_EXP_FEATURES_INFO,
 123         MGMT_OP_SET_EXP_FEATURE,
 124         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 125         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 126         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 127         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 128         MGMT_OP_GET_DEVICE_FLAGS,
 129         MGMT_OP_SET_DEVICE_FLAGS,
 130         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 131         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 132         MGMT_OP_REMOVE_ADV_MONITOR,
 133         MGMT_OP_ADD_EXT_ADV_PARAMS,
 134         MGMT_OP_ADD_EXT_ADV_DATA,
 135         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 136         MGMT_OP_SET_MESH_RECEIVER,
 137         MGMT_OP_MESH_READ_FEATURES,
 138         MGMT_OP_MESH_SEND,
 139         MGMT_OP_MESH_SEND_CANCEL,
 140 };
 141
 142 static const u16 mgmt_events[] = {
 143         MGMT_EV_CONTROLLER_ERROR,
 144         MGMT_EV_INDEX_ADDED,
 145         MGMT_EV_INDEX_REMOVED,
 146         MGMT_EV_NEW_SETTINGS,
 147         MGMT_EV_CLASS_OF_DEV_CHANGED,
 148         MGMT_EV_LOCAL_NAME_CHANGED,
 149         MGMT_EV_NEW_LINK_KEY,
 150         MGMT_EV_NEW_LONG_TERM_KEY,
 151         MGMT_EV_DEVICE_CONNECTED,
 152         MGMT_EV_DEVICE_DISCONNECTED,
 153         MGMT_EV_CONNECT_FAILED,
 154         MGMT_EV_PIN_CODE_REQUEST,
 155         MGMT_EV_USER_CONFIRM_REQUEST,
 156         MGMT_EV_USER_PASSKEY_REQUEST,
 157         MGMT_EV_AUTH_FAILED,
 158         MGMT_EV_DEVICE_FOUND,
 159         MGMT_EV_DISCOVERING,
 160         MGMT_EV_DEVICE_BLOCKED,
 161         MGMT_EV_DEVICE_UNBLOCKED,
 162         MGMT_EV_DEVICE_UNPAIRED,
 163         MGMT_EV_PASSKEY_NOTIFY,
 164         MGMT_EV_NEW_IRK,
 165         MGMT_EV_NEW_CSRK,
 166         MGMT_EV_DEVICE_ADDED,
 167         MGMT_EV_DEVICE_REMOVED,
 168         MGMT_EV_NEW_CONN_PARAM,
 169         MGMT_EV_UNCONF_INDEX_ADDED,
 170         MGMT_EV_UNCONF_INDEX_REMOVED,
 171         MGMT_EV_NEW_CONFIG_OPTIONS,
 172         MGMT_EV_EXT_INDEX_ADDED,
 173         MGMT_EV_EXT_INDEX_REMOVED,
 174         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 175         MGMT_EV_ADVERTISING_ADDED,
 176         MGMT_EV_ADVERTISING_REMOVED,
 177         MGMT_EV_EXT_INFO_CHANGED,
 178         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 179         MGMT_EV_EXP_FEATURE_CHANGED,
 180         MGMT_EV_DEVICE_FLAGS_CHANGED,
 181         MGMT_EV_ADV_MONITOR_ADDED,
 182         MGMT_EV_ADV_MONITOR_REMOVED,
 183         MGMT_EV_CONTROLLER_SUSPEND,
 184         MGMT_EV_CONTROLLER_RESUME,
 185         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 186         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 187 };
 188
 189 static const u16 mgmt_untrusted_commands[] = {
 190         MGMT_OP_READ_INDEX_LIST,
 191         MGMT_OP_READ_INFO,
 192         MGMT_OP_READ_UNCONF_INDEX_LIST,
 193         MGMT_OP_READ_CONFIG_INFO,
 194         MGMT_OP_READ_EXT_INDEX_LIST,
 195         MGMT_OP_READ_EXT_INFO,
 196         MGMT_OP_READ_CONTROLLER_CAP,
 197         MGMT_OP_READ_EXP_FEATURES_INFO,
 198         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 199         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 200 };
 201
 202 static const u16 mgmt_untrusted_events[] = {
 203         MGMT_EV_INDEX_ADDED,
 204         MGMT_EV_INDEX_REMOVED,
 205         MGMT_EV_NEW_SETTINGS,
 206         MGMT_EV_CLASS_OF_DEV_CHANGED,
 207         MGMT_EV_LOCAL_NAME_CHANGED,
 208         MGMT_EV_UNCONF_INDEX_ADDED,
 209         MGMT_EV_UNCONF_INDEX_REMOVED,
 210         MGMT_EV_NEW_CONFIG_OPTIONS,
 211         MGMT_EV_EXT_INDEX_ADDED,
 212         MGMT_EV_EXT_INDEX_REMOVED,
 213         MGMT_EV_EXT_INFO_CHANGED,
 214         MGMT_EV_EXP_FEATURE_CHANGED,
 215 };
 216
 217 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 218
 219 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 220                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 221
 222 /* HCI to MGMT error code conversion table */
 223 static const u8 mgmt_status_table[] = {
 224         MGMT_STATUS_SUCCESS,
 225         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 226         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 227         MGMT_STATUS_FAILED,             /* Hardware Failure */
 228         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 229         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 230         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 231         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 232         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 233         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 234         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 235         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 236         MGMT_STATUS_BUSY,               /* Command Disallowed */
 237         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 238         MGMT_STATUS_REJECTED,           /* Rejected Security */
 239         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 240         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 241         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 242         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 243         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 244         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 245         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 246         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 247         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 248         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 249         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 250         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 251         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 252         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 253         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 254         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 255         MGMT_STATUS_FAILED,             /* Unspecified Error */
 256         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 257         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 258         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 259         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 260         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 261         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 262         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 263         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 264         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 265         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 266         MGMT_STATUS_FAILED,             /* Transaction Collision */
 267         MGMT_STATUS_FAILED,             /* Reserved for future use */
 268         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 269         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 270         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 271         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 272         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 273         MGMT_STATUS_FAILED,             /* Reserved for future use */
 274         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 275         MGMT_STATUS_FAILED,             /* Reserved for future use */
 276         MGMT_STATUS_FAILED,             /* Slot Violation */
 277         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 278         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 279         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 280         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 281         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 282         MGMT_STATUS_BUSY,               /* Controller Busy */
 283         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 284         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 285         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 286         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 287         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 288 };
 289
 290 static u8 mgmt_errno_status(int err)
 291 {
 292         switch (err) {
 293         case 0:
 294                 return MGMT_STATUS_SUCCESS;
 295         case -EPERM:
 296                 return MGMT_STATUS_REJECTED;
 297         case -EINVAL:
 298                 return MGMT_STATUS_INVALID_PARAMS;
 299         case -EOPNOTSUPP:
 300                 return MGMT_STATUS_NOT_SUPPORTED;
 301         case -EBUSY:
 302                 return MGMT_STATUS_BUSY;
 303         case -ETIMEDOUT:
 304                 return MGMT_STATUS_AUTH_FAILED;
 305         case -ENOMEM:
 306                 return MGMT_STATUS_NO_RESOURCES;
 307         case -EISCONN:
 308                 return MGMT_STATUS_ALREADY_CONNECTED;
 309         case -ENOTCONN:
 310                 return MGMT_STATUS_DISCONNECTED;
 311         }
 312
 313         return MGMT_STATUS_FAILED;
 314 }
 315
 316 static u8 mgmt_status(int err)
 317 {
 318         if (err < 0)
 319                 return mgmt_errno_status(err);
 320
 321         if (err < ARRAY_SIZE(mgmt_status_table))
 322                 return mgmt_status_table[err];
 323
 324         return MGMT_STATUS_FAILED;
 325 }
 326
 327 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 328                             u16 len, int flag)
 329 {
 330         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 331                                flag, NULL);
 332 }
 333
 334 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 335                               u16 len, int flag, struct sock *skip_sk)
 336 {
 337         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 338                                flag, skip_sk);
 339 }
 340
 341 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 342                       struct sock *skip_sk)
 343 {
 344         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 345                                HCI_SOCK_TRUSTED, skip_sk);
 346 }
 347
 348 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 349 {
 350         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 351                                    skip_sk);
 352 }
 353
 354 static u8 le_addr_type(u8 mgmt_addr_type)
 355 {
 356         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 357                 return ADDR_LE_DEV_PUBLIC;
 358         else
 359                 return ADDR_LE_DEV_RANDOM;
 360 }
 361
 362 void mgmt_fill_version_info(void *ver)
 363 {
 364         struct mgmt_rp_read_version *rp = ver;
 365
 366         rp->version = MGMT_VERSION;
 367         rp->revision = cpu_to_le16(MGMT_REVISION);
 368 }
 369
 370 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 371                         u16 data_len)
 372 {
 373         struct mgmt_rp_read_version rp;
 374
 375         bt_dev_dbg(hdev, "sock %p", sk);
 376
 377         mgmt_fill_version_info(&rp);
 378
 379         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 380                                  &rp, sizeof(rp));
 381 }
 382
 383 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 384                          u16 data_len)
 385 {
 386         struct mgmt_rp_read_commands *rp;
 387         u16 num_commands, num_events;
 388         size_t rp_size;
 389         int i, err;
 390
 391         bt_dev_dbg(hdev, "sock %p", sk);
 392
 393         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 394                 num_commands = ARRAY_SIZE(mgmt_commands);
 395                 num_events = ARRAY_SIZE(mgmt_events);
 396         } else {
 397                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 398                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 399         }
 400
 401         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 402
 403         rp = kmalloc(rp_size, GFP_KERNEL);
 404         if (!rp)
 405                 return -ENOMEM;
 406
 407         rp->num_commands = cpu_to_le16(num_commands);
 408         rp->num_events = cpu_to_le16(num_events);
 409
 410         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 411                 __le16 *opcode = rp->opcodes;
 412
 413                 for (i = 0; i < num_commands; i++, opcode++)
 414                         put_unaligned_le16(mgmt_commands[i], opcode);
 415
 416                 for (i = 0; i < num_events; i++, opcode++)
 417                         put_unaligned_le16(mgmt_events[i], opcode);
 418         } else {
 419                 __le16 *opcode = rp->opcodes;
 420
 421                 for (i = 0; i < num_commands; i++, opcode++)
 422                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 423
 424                 for (i = 0; i < num_events; i++, opcode++)
 425                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 426         }
 427
 428         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 429                                 rp, rp_size);
 430         kfree(rp);
 431
 432         return err;
 433 }
 434
 435 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 436                            u16 data_len)
 437 {
 438         struct mgmt_rp_read_index_list *rp;
 439         struct hci_dev *d;
 440         size_t rp_len;
 441         u16 count;
 442         int err;
 443
 444         bt_dev_dbg(hdev, "sock %p", sk);
 445
 446         read_lock(&hci_dev_list_lock);
 447
 448         count = 0;
 449         list_for_each_entry(d, &hci_dev_list, list) {
 450                 if (d->dev_type == HCI_PRIMARY &&
 451                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 452                         count++;
 453         }
 454
 455         rp_len = sizeof(*rp) + (2 * count);
 456         rp = kmalloc(rp_len, GFP_ATOMIC);
 457         if (!rp) {
 458                 read_unlock(&hci_dev_list_lock);
 459                 return -ENOMEM;
 460         }
 461
 462         count = 0;
 463         list_for_each_entry(d, &hci_dev_list, list) {
 464                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 465                     hci_dev_test_flag(d, HCI_CONFIG) ||
 466                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 467                         continue;
 468
 469                 /* Devices marked as raw-only are neither configured
 470                  * nor unconfigured controllers.
 471                  */
 472                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 473                         continue;
 474
 475                 if (d->dev_type == HCI_PRIMARY &&
 476                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 477                         rp->index[count++] = cpu_to_le16(d->id);
 478                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 479                 }
 480         }
 481
 482         rp->num_controllers = cpu_to_le16(count);
 483         rp_len = sizeof(*rp) + (2 * count);
 484
 485         read_unlock(&hci_dev_list_lock);
 486
 487         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 488                                 0, rp, rp_len);
 489
 490         kfree(rp);
 491
 492         return err;
 493 }
 494
 495 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 496                                   void *data, u16 data_len)
 497 {
 498         struct mgmt_rp_read_unconf_index_list *rp;
 499         struct hci_dev *d;
 500         size_t rp_len;
 501         u16 count;
 502         int err;
 503
 504         bt_dev_dbg(hdev, "sock %p", sk);
 505
 506         read_lock(&hci_dev_list_lock);
 507
 508         count = 0;
 509         list_for_each_entry(d, &hci_dev_list, list) {
 510                 if (d->dev_type == HCI_PRIMARY &&
 511                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 512                         count++;
 513         }
 514
 515         rp_len = sizeof(*rp) + (2 * count);
 516         rp = kmalloc(rp_len, GFP_ATOMIC);
 517         if (!rp) {
 518                 read_unlock(&hci_dev_list_lock);
 519                 return -ENOMEM;
 520         }
 521
 522         count = 0;
 523         list_for_each_entry(d, &hci_dev_list, list) {
 524                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 525                     hci_dev_test_flag(d, HCI_CONFIG) ||
 526                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 527                         continue;
 528
 529                 /* Devices marked as raw-only are neither configured
 530                  * nor unconfigured controllers.
 531                  */
 532                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 533                         continue;
 534
 535                 if (d->dev_type == HCI_PRIMARY &&
 536                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 537                         rp->index[count++] = cpu_to_le16(d->id);
 538                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 539                 }
 540         }
 541
 542         rp->num_controllers = cpu_to_le16(count);
 543         rp_len = sizeof(*rp) + (2 * count);
 544
 545         read_unlock(&hci_dev_list_lock);
 546
 547         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 548                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 549
 550         kfree(rp);
 551
 552         return err;
 553 }
 554
 555 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 556                                void *data, u16 data_len)
 557 {
 558         struct mgmt_rp_read_ext_index_list *rp;
 559         struct hci_dev *d;
 560         u16 count;
 561         int err;
 562
 563         bt_dev_dbg(hdev, "sock %p", sk);
 564
 565         read_lock(&hci_dev_list_lock);
 566
 567         count = 0;
 568         list_for_each_entry(d, &hci_dev_list, list) {
 569                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 570                         count++;
 571         }
 572
 573         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 574         if (!rp) {
 575                 read_unlock(&hci_dev_list_lock);
 576                 return -ENOMEM;
 577         }
 578
 579         count = 0;
 580         list_for_each_entry(d, &hci_dev_list, list) {
 581                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 582                     hci_dev_test_flag(d, HCI_CONFIG) ||
 583                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 584                         continue;
 585
 586                 /* Devices marked as raw-only are neither configured
 587                  * nor unconfigured controllers.
 588                  */
 589                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 590                         continue;
 591
 592                 if (d->dev_type == HCI_PRIMARY) {
 593                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 594                                 rp->entry[count].type = 0x01;
 595                         else
 596                                 rp->entry[count].type = 0x00;
 597                 } else if (d->dev_type == HCI_AMP) {
 598                         rp->entry[count].type = 0x02;
 599                 } else {
 600                         continue;
 601                 }
 602
 603                 rp->entry[count].bus = d->bus;
 604                 rp->entry[count++].index = cpu_to_le16(d->id);
 605                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 606         }
 607
 608         rp->num_controllers = cpu_to_le16(count);
 609
 610         read_unlock(&hci_dev_list_lock);
 611
 612         /* If this command is called at least once, then all the
 613          * default index and unconfigured index events are disabled
 614          * and from now on only extended index events are used.
 615          */
 616         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 617         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 618         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 619
 620         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 621                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 622                                 struct_size(rp, entry, count));
 623
 624         kfree(rp);
 625
 626         return err;
 627 }
 628
 629 static bool is_configured(struct hci_dev *hdev)
 630 {
 631         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 632             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 633                 return false;
 634
 635         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 636              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 637             !bacmp(&hdev->public_addr, BDADDR_ANY))
 638                 return false;
 639
 640         return true;
 641 }
 642
 643 static __le32 get_missing_options(struct hci_dev *hdev)
 644 {
 645         u32 options = 0;
 646
 647         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 648             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 649                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 650
 651         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 652              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 653             !bacmp(&hdev->public_addr, BDADDR_ANY))
 654                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 655
 656         return cpu_to_le32(options);
 657 }
 658
 659 static int new_options(struct hci_dev *hdev, struct sock *skip)
 660 {
 661         __le32 options = get_missing_options(hdev);
 662
 663         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 664                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 665 }
 666
 667 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 668 {
 669         __le32 options = get_missing_options(hdev);
 670
 671         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 672                                  sizeof(options));
 673 }
 674
 675 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 676                             void *data, u16 data_len)
 677 {
 678         struct mgmt_rp_read_config_info rp;
 679         u32 options = 0;
 680
 681         bt_dev_dbg(hdev, "sock %p", sk);
 682
 683         hci_dev_lock(hdev);
 684
 685         memset(&rp, 0, sizeof(rp));
 686         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 687
 688         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 689                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 690
 691         if (hdev->set_bdaddr)
 692                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 693
 694         rp.supported_options = cpu_to_le32(options);
 695         rp.missing_options = get_missing_options(hdev);
 696
 697         hci_dev_unlock(hdev);
 698
 699         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 700                                  &rp, sizeof(rp));
 701 }
 702
 703 static u32 get_supported_phys(struct hci_dev *hdev)
 704 {
 705         u32 supported_phys = 0;
 706
 707         if (lmp_bredr_capable(hdev)) {
 708                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 709
 710                 if (hdev->features[0][0] & LMP_3SLOT)
 711                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 712
 713                 if (hdev->features[0][0] & LMP_5SLOT)
 714                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 715
 716                 if (lmp_edr_2m_capable(hdev)) {
 717                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 718
 719                         if (lmp_edr_3slot_capable(hdev))
 720                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 721
 722                         if (lmp_edr_5slot_capable(hdev))
 723                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 724
 725                         if (lmp_edr_3m_capable(hdev)) {
 726                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 727
 728                                 if (lmp_edr_3slot_capable(hdev))
 729                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 730
 731                                 if (lmp_edr_5slot_capable(hdev))
 732                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 733                         }
 734                 }
 735         }
 736
 737         if (lmp_le_capable(hdev)) {
 738                 supported_phys |= MGMT_PHY_LE_1M_TX;
 739                 supported_phys |= MGMT_PHY_LE_1M_RX;
 740
 741                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 742                         supported_phys |= MGMT_PHY_LE_2M_TX;
 743                         supported_phys |= MGMT_PHY_LE_2M_RX;
 744                 }
 745
 746                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 747                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 748                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 749                 }
 750         }
 751
 752         return supported_phys;
 753 }
 754
 755 static u32 get_selected_phys(struct hci_dev *hdev)
 756 {
 757         u32 selected_phys = 0;
 758
 759         if (lmp_bredr_capable(hdev)) {
 760                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 761
 762                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 763                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 764
 765                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 766                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 767
 768                 if (lmp_edr_2m_capable(hdev)) {
 769                         if (!(hdev->pkt_type & HCI_2DH1))
 770                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 771
 772                         if (lmp_edr_3slot_capable(hdev) &&
 773                             !(hdev->pkt_type & HCI_2DH3))
 774                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 775
 776                         if (lmp_edr_5slot_capable(hdev) &&
 777                             !(hdev->pkt_type & HCI_2DH5))
 778                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 779
 780                         if (lmp_edr_3m_capable(hdev)) {
 781                                 if (!(hdev->pkt_type & HCI_3DH1))
 782                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 783
 784                                 if (lmp_edr_3slot_capable(hdev) &&
 785                                     !(hdev->pkt_type & HCI_3DH3))
 786                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 787
 788                                 if (lmp_edr_5slot_capable(hdev) &&
 789                                     !(hdev->pkt_type & HCI_3DH5))
 790                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 791                         }
 792                 }
 793         }
 794
 795         if (lmp_le_capable(hdev)) {
 796                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 797                         selected_phys |= MGMT_PHY_LE_1M_TX;
 798
 799                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 800                         selected_phys |= MGMT_PHY_LE_1M_RX;
 801
 802                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 803                         selected_phys |= MGMT_PHY_LE_2M_TX;
 804
 805                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 806                         selected_phys |= MGMT_PHY_LE_2M_RX;
 807
 808                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 809                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 810
 811                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 812                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 813         }
 814
 815         return selected_phys;
 816 }
 817
 818 static u32 get_configurable_phys(struct hci_dev *hdev)
 819 {
 820         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 821                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 822 }
 823
 824 static u32 get_supported_settings(struct hci_dev *hdev)
 825 {
 826         u32 settings = 0;
 827
 828         settings |= MGMT_SETTING_POWERED;
 829         settings |= MGMT_SETTING_BONDABLE;
 830         settings |= MGMT_SETTING_DEBUG_KEYS;
 831         settings |= MGMT_SETTING_CONNECTABLE;
 832         settings |= MGMT_SETTING_DISCOVERABLE;
 833
 834         if (lmp_bredr_capable(hdev)) {
 835                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 836                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 837                 settings |= MGMT_SETTING_BREDR;
 838                 settings |= MGMT_SETTING_LINK_SECURITY;
 839
 840                 if (lmp_ssp_capable(hdev)) {
 841                         settings |= MGMT_SETTING_SSP;
 842                         if (IS_ENABLED(CONFIG_BT_HS))
 843                                 settings |= MGMT_SETTING_HS;
 844                 }
 845
 846                 if (lmp_sc_capable(hdev))
 847                         settings |= MGMT_SETTING_SECURE_CONN;
 848
 849                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 850                              &hdev->quirks))
 851                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 852         }
 853
 854         if (lmp_le_capable(hdev)) {
 855                 settings |= MGMT_SETTING_LE;
 856                 settings |= MGMT_SETTING_SECURE_CONN;
 857                 settings |= MGMT_SETTING_PRIVACY;
 858                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 859                 settings |= MGMT_SETTING_ADVERTISING;
 860         }
 861
 862         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 863             hdev->set_bdaddr)
 864                 settings |= MGMT_SETTING_CONFIGURATION;
 865
 866         if (cis_central_capable(hdev))
 867                 settings |= MGMT_SETTING_CIS_CENTRAL;
 868
 869         if (cis_peripheral_capable(hdev))
 870                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 871
 872         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 873
 874         return settings;
 875 }
 876
 877 static u32 get_current_settings(struct hci_dev *hdev)
 878 {
 879         u32 settings = 0;
 880
 881         if (hdev_is_powered(hdev))
 882                 settings |= MGMT_SETTING_POWERED;
 883
 884         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 885                 settings |= MGMT_SETTING_CONNECTABLE;
 886
 887         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 888                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 889
 890         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 891                 settings |= MGMT_SETTING_DISCOVERABLE;
 892
 893         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 894                 settings |= MGMT_SETTING_BONDABLE;
 895
 896         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 897                 settings |= MGMT_SETTING_BREDR;
 898
 899         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 900                 settings |= MGMT_SETTING_LE;
 901
 902         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 903                 settings |= MGMT_SETTING_LINK_SECURITY;
 904
 905         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 906                 settings |= MGMT_SETTING_SSP;
 907
 908         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 909                 settings |= MGMT_SETTING_HS;
 910
 911         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 912                 settings |= MGMT_SETTING_ADVERTISING;
 913
 914         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 915                 settings |= MGMT_SETTING_SECURE_CONN;
 916
 917         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 918                 settings |= MGMT_SETTING_DEBUG_KEYS;
 919
 920         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 921                 settings |= MGMT_SETTING_PRIVACY;
 922
 923         /* The current setting for static address has two purposes. The
 924          * first is to indicate if the static address will be used and
 925          * the second is to indicate if it is actually set.
 926          *
 927          * This means if the static address is not configured, this flag
 928          * will never be set. If the address is configured, then if the
 929          * address is actually used decides if the flag is set or not.
 930          *
 931          * For single mode LE only controllers and dual-mode controllers
 932          * with BR/EDR disabled, the existence of the static address will
 933          * be evaluated.
 934          */
 935         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 936             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 937             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 938                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 939                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 940         }
 941
 942         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 943                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 944
 945         if (cis_central_capable(hdev))
 946                 settings |= MGMT_SETTING_CIS_CENTRAL;
 947
 948         if (cis_peripheral_capable(hdev))
 949                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 950
 951         return settings;
 952 }
 953
 954 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 955 {
 956         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 957 }
 958
 959 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 960 {
 961         struct mgmt_pending_cmd *cmd;
 962
 963         /* If there's a pending mgmt command the flags will not yet have
 964          * their final values, so check for this first.
 965          */
 966         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 967         if (cmd) {
 968                 struct mgmt_mode *cp = cmd->param;
 969                 if (cp->val == 0x01)
 970                         return LE_AD_GENERAL;
 971                 else if (cp->val == 0x02)
 972                         return LE_AD_LIMITED;
 973         } else {
 974                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 975                         return LE_AD_LIMITED;
 976                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 977                         return LE_AD_GENERAL;
 978         }
 979
 980         return 0;
 981 }
 982
 983 bool mgmt_get_connectable(struct hci_dev *hdev)
 984 {
 985         struct mgmt_pending_cmd *cmd;
 986
 987         /* If there's a pending mgmt command the flag will not yet have
 988          * it's final value, so check for this first.
 989          */
 990         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 991         if (cmd) {
 992                 struct mgmt_mode *cp = cmd->param;
 993
 994                 return cp->val;
 995         }
 996
 997         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 998 }
 999
1000 static int service_cache_sync(struct hci_dev *hdev, void *data)
1001 {
1002         hci_update_eir_sync(hdev);
1003         hci_update_class_sync(hdev);
1004
1005         return 0;
1006 }
1007
1008 static void service_cache_off(struct work_struct *work)
1009 {
1010         struct hci_dev *hdev = container_of(work, struct hci_dev,
1011                                             service_cache.work);
1012
1013         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1014                 return;
1015
1016         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1017 }
1018
1019 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1020 {
1021         /* The generation of a new RPA and programming it into the
1022          * controller happens in the hci_req_enable_advertising()
1023          * function.
1024          */
1025         if (ext_adv_capable(hdev))
1026                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1027         else
1028                 return hci_enable_advertising_sync(hdev);
1029 }
1030
1031 static void rpa_expired(struct work_struct *work)
1032 {
1033         struct hci_dev *hdev = container_of(work, struct hci_dev,
1034                                             rpa_expired.work);
1035
1036         bt_dev_dbg(hdev, "");
1037
1038         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1039
1040         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1041                 return;
1042
1043         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1044 }
1045
1046 static void discov_off(struct work_struct *work)
1047 {
1048         struct hci_dev *hdev = container_of(work, struct hci_dev,
1049                                             discov_off.work);
1050
1051         bt_dev_dbg(hdev, "");
1052
1053         hci_dev_lock(hdev);
1054
1055         /* When discoverable timeout triggers, then just make sure
1056          * the limited discoverable flag is cleared. Even in the case
1057          * of a timeout triggered from general discoverable, it is
1058          * safe to unconditionally clear the flag.
1059          */
1060         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1061         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1062         hdev->discov_timeout = 0;
1063
1064         hci_update_discoverable(hdev);
1065
1066         mgmt_new_settings(hdev);
1067
1068         hci_dev_unlock(hdev);
1069 }
1070
1071 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1072
1073 static void mesh_send_complete(struct hci_dev *hdev,
1074                                struct mgmt_mesh_tx *mesh_tx, bool silent)
1075 {
1076         u8 handle = mesh_tx->handle;
1077
1078         if (!silent)
1079                 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1080                            sizeof(handle), NULL);
1081
1082         mgmt_mesh_remove(mesh_tx);
1083 }
1084
1085 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1086 {
1087         struct mgmt_mesh_tx *mesh_tx;
1088
1089         hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1090         hci_disable_advertising_sync(hdev);
1091         mesh_tx = mgmt_mesh_next(hdev, NULL);
1092
1093         if (mesh_tx)
1094                 mesh_send_complete(hdev, mesh_tx, false);
1095
1096         return 0;
1097 }
1098
1099 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1100 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1101 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1102 {
1103         struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1104
1105         if (!mesh_tx)
1106                 return;
1107
1108         err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1109                                  mesh_send_start_complete);
1110
1111         if (err < 0)
1112                 mesh_send_complete(hdev, mesh_tx, false);
1113         else
1114                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1115 }
1116
1117 static void mesh_send_done(struct work_struct *work)
1118 {
1119         struct hci_dev *hdev = container_of(work, struct hci_dev,
1120                                             mesh_send_done.work);
1121
1122         if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1123                 return;
1124
1125         hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1126 }
1127
1128 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1129 {
1130         if (hci_dev_test_flag(hdev, HCI_MGMT))
1131                 return;
1132
1133         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1134
1135         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1136         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1137         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1138         INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1139
1140         /* Non-mgmt controlled devices get this bit set
1141          * implicitly so that pairing works for them, however
1142          * for mgmt we require user-space to explicitly enable
1143          * it
1144          */
1145         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1146
1147         hci_dev_set_flag(hdev, HCI_MGMT);
1148 }
1149
1150 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1151                                 void *data, u16 data_len)
1152 {
1153         struct mgmt_rp_read_info rp;
1154
1155         bt_dev_dbg(hdev, "sock %p", sk);
1156
1157         hci_dev_lock(hdev);
1158
1159         memset(&rp, 0, sizeof(rp));
1160
1161         bacpy(&rp.bdaddr, &hdev->bdaddr);
1162
1163         rp.version = hdev->hci_ver;
1164         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1165
1166         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1167         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1168
1169         memcpy(rp.dev_class, hdev->dev_class, 3);
1170
1171         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1172         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1173
1174         hci_dev_unlock(hdev);
1175
1176         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1177                                  sizeof(rp));
1178 }
1179
1180 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1181 {
1182         u16 eir_len = 0;
1183         size_t name_len;
1184
1185         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1186                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1187                                           hdev->dev_class, 3);
1188
1189         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1190                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1191                                           hdev->appearance);
1192
1193         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1194         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1195                                   hdev->dev_name, name_len);
1196
1197         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1198         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1199                                   hdev->short_name, name_len);
1200
1201         return eir_len;
1202 }
1203
1204 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1205                                     void *data, u16 data_len)
1206 {
1207         char buf[512];
1208         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1209         u16 eir_len;
1210
1211         bt_dev_dbg(hdev, "sock %p", sk);
1212
1213         memset(&buf, 0, sizeof(buf));
1214
1215         hci_dev_lock(hdev);
1216
1217         bacpy(&rp->bdaddr, &hdev->bdaddr);
1218
1219         rp->version = hdev->hci_ver;
1220         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1221
1222         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1223         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1224
1225
1226         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1227         rp->eir_len = cpu_to_le16(eir_len);
1228
1229         hci_dev_unlock(hdev);
1230
1231         /* If this command is called at least once, then the events
1232          * for class of device and local name changes are disabled
1233          * and only the new extended controller information event
1234          * is used.
1235          */
1236         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1237         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1238         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1239
1240         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1241                                  sizeof(*rp) + eir_len);
1242 }
1243
1244 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1245 {
1246         char buf[512];
1247         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1248         u16 eir_len;
1249
1250         memset(buf, 0, sizeof(buf));
1251
1252         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1253         ev->eir_len = cpu_to_le16(eir_len);
1254
1255         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1256                                   sizeof(*ev) + eir_len,
1257                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1258 }
1259
1260 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1261 {
1262         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1263
1264         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1265                                  sizeof(settings));
1266 }
1267
1268 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1269 {
1270         struct mgmt_ev_advertising_added ev;
1271
1272         ev.instance = instance;
1273
1274         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1275 }
1276
1277 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1278                               u8 instance)
1279 {
1280         struct mgmt_ev_advertising_removed ev;
1281
1282         ev.instance = instance;
1283
1284         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1285 }
1286
1287 static void cancel_adv_timeout(struct hci_dev *hdev)
1288 {
1289         if (hdev->adv_instance_timeout) {
1290                 hdev->adv_instance_timeout = 0;
1291                 cancel_delayed_work(&hdev->adv_instance_expire);
1292         }
1293 }
1294
1295 /* This function requires the caller holds hdev->lock */
1296 static void restart_le_actions(struct hci_dev *hdev)
1297 {
1298         struct hci_conn_params *p;
1299
1300         list_for_each_entry(p, &hdev->le_conn_params, list) {
1301                 /* Needed for AUTO_OFF case where might not "really"
1302                  * have been powered off.
1303                  */
1304                 list_del_init(&p->action);
1305
1306                 switch (p->auto_connect) {
1307                 case HCI_AUTO_CONN_DIRECT:
1308                 case HCI_AUTO_CONN_ALWAYS:
1309                         list_add(&p->action, &hdev->pend_le_conns);
1310                         break;
1311                 case HCI_AUTO_CONN_REPORT:
1312                         list_add(&p->action, &hdev->pend_le_reports);
1313                         break;
1314                 default:
1315                         break;
1316                 }
1317         }
1318 }
1319
1320 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1321 {
1322         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1323
1324         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1325                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1326 }
1327
1328 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1329 {
1330         struct mgmt_pending_cmd *cmd = data;
1331         struct mgmt_mode *cp;
1332
1333         /* Make sure cmd still outstanding. */
1334         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1335                 return;
1336
1337         cp = cmd->param;
1338
1339         bt_dev_dbg(hdev, "err %d", err);
1340
1341         if (!err) {
1342                 if (cp->val) {
1343                         hci_dev_lock(hdev);
1344                         restart_le_actions(hdev);
1345                         hci_update_passive_scan(hdev);
1346                         hci_dev_unlock(hdev);
1347                 }
1348
1349                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1350
1351                 /* Only call new_setting for power on as power off is deferred
1352                  * to hdev->power_off work which does call hci_dev_do_close.
1353                  */
1354                 if (cp->val)
1355                         new_settings(hdev, cmd->sk);
1356         } else {
1357                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1358                                 mgmt_status(err));
1359         }
1360
1361         mgmt_pending_remove(cmd);
1362 }
1363
1364 static int set_powered_sync(struct hci_dev *hdev, void *data)
1365 {
1366         struct mgmt_pending_cmd *cmd = data;
1367         struct mgmt_mode *cp = cmd->param;
1368
1369         BT_DBG("%s", hdev->name);
1370
1371         return hci_set_powered_sync(hdev, cp->val);
1372 }
1373
1374 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1375                        u16 len)
1376 {
1377         struct mgmt_mode *cp = data;
1378         struct mgmt_pending_cmd *cmd;
1379         int err;
1380
1381         bt_dev_dbg(hdev, "sock %p", sk);
1382
1383         if (cp->val != 0x00 && cp->val != 0x01)
1384                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1385                                        MGMT_STATUS_INVALID_PARAMS);
1386
1387         hci_dev_lock(hdev);
1388
1389         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1390                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1391                                       MGMT_STATUS_BUSY);
1392                 goto failed;
1393         }
1394
1395         if (!!cp->val == hdev_is_powered(hdev)) {
1396                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1397                 goto failed;
1398         }
1399
1400         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1401         if (!cmd) {
1402                 err = -ENOMEM;
1403                 goto failed;
1404         }
1405
1406         err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1407                                  mgmt_set_powered_complete);
1408
1409         if (err < 0)
1410                 mgmt_pending_remove(cmd);
1411
1412 failed:
1413         hci_dev_unlock(hdev);
1414         return err;
1415 }
1416
1417 int mgmt_new_settings(struct hci_dev *hdev)
1418 {
1419         return new_settings(hdev, NULL);
1420 }
1421
1422 struct cmd_lookup {
1423         struct sock *sk;
1424         struct hci_dev *hdev;
1425         u8 mgmt_status;
1426 };
1427
1428 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1429 {
1430         struct cmd_lookup *match = data;
1431
1432         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1433
1434         list_del(&cmd->list);
1435
1436         if (match->sk == NULL) {
1437                 match->sk = cmd->sk;
1438                 sock_hold(match->sk);
1439         }
1440
1441         mgmt_pending_free(cmd);
1442 }
1443
1444 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1445 {
1446         u8 *status = data;
1447
1448         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1449         mgmt_pending_remove(cmd);
1450 }
1451
1452 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1453 {
1454         if (cmd->cmd_complete) {
1455                 u8 *status = data;
1456
1457                 cmd->cmd_complete(cmd, *status);
1458                 mgmt_pending_remove(cmd);
1459
1460                 return;
1461         }
1462
1463         cmd_status_rsp(cmd, data);
1464 }
1465
1466 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1467 {
1468         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1469                                  cmd->param, cmd->param_len);
1470 }
1471
1472 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1473 {
1474         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1475                                  cmd->param, sizeof(struct mgmt_addr_info));
1476 }
1477
1478 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1479 {
1480         if (!lmp_bredr_capable(hdev))
1481                 return MGMT_STATUS_NOT_SUPPORTED;
1482         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1483                 return MGMT_STATUS_REJECTED;
1484         else
1485                 return MGMT_STATUS_SUCCESS;
1486 }
1487
1488 static u8 mgmt_le_support(struct hci_dev *hdev)
1489 {
1490         if (!lmp_le_capable(hdev))
1491                 return MGMT_STATUS_NOT_SUPPORTED;
1492         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1493                 return MGMT_STATUS_REJECTED;
1494         else
1495                 return MGMT_STATUS_SUCCESS;
1496 }
1497
1498 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1499                                            int err)
1500 {
1501         struct mgmt_pending_cmd *cmd = data;
1502
1503         bt_dev_dbg(hdev, "err %d", err);
1504
1505         /* Make sure cmd still outstanding. */
1506         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1507                 return;
1508
1509         hci_dev_lock(hdev);
1510
1511         if (err) {
1512                 u8 mgmt_err = mgmt_status(err);
1513                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1514                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1515                 goto done;
1516         }
1517
1518         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1519             hdev->discov_timeout > 0) {
1520                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1521                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1522         }
1523
1524         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1525         new_settings(hdev, cmd->sk);
1526
1527 done:
1528         mgmt_pending_remove(cmd);
1529         hci_dev_unlock(hdev);
1530 }
1531
1532 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1533 {
1534         BT_DBG("%s", hdev->name);
1535
1536         return hci_update_discoverable_sync(hdev);
1537 }
1538
1539 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1540                             u16 len)
1541 {
1542         struct mgmt_cp_set_discoverable *cp = data;
1543         struct mgmt_pending_cmd *cmd;
1544         u16 timeout;
1545         int err;
1546
1547         bt_dev_dbg(hdev, "sock %p", sk);
1548
1549         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1550             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1551                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1552                                        MGMT_STATUS_REJECTED);
1553
1554         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1555                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1556                                        MGMT_STATUS_INVALID_PARAMS);
1557
1558         timeout = __le16_to_cpu(cp->timeout);
1559
1560         /* Disabling discoverable requires that no timeout is set,
1561          * and enabling limited discoverable requires a timeout.
1562          */
1563         if ((cp->val == 0x00 && timeout > 0) ||
1564             (cp->val == 0x02 && timeout == 0))
1565                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1566                                        MGMT_STATUS_INVALID_PARAMS);
1567
1568         hci_dev_lock(hdev);
1569
1570         if (!hdev_is_powered(hdev) && timeout > 0) {
1571                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1572                                       MGMT_STATUS_NOT_POWERED);
1573                 goto failed;
1574         }
1575
1576         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1577             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1578                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1579                                       MGMT_STATUS_BUSY);
1580                 goto failed;
1581         }
1582
1583         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1584                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1585                                       MGMT_STATUS_REJECTED);
1586                 goto failed;
1587         }
1588
1589         if (hdev->advertising_paused) {
1590                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1591                                       MGMT_STATUS_BUSY);
1592                 goto failed;
1593         }
1594
1595         if (!hdev_is_powered(hdev)) {
1596                 bool changed = false;
1597
1598                 /* Setting limited discoverable when powered off is
1599                  * not a valid operation since it requires a timeout
1600                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1601                  */
1602                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1603                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1604                         changed = true;
1605                 }
1606
1607                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1608                 if (err < 0)
1609                         goto failed;
1610
1611                 if (changed)
1612                         err = new_settings(hdev, sk);
1613
1614                 goto failed;
1615         }
1616
1617         /* If the current mode is the same, then just update the timeout
1618          * value with the new value. And if only the timeout gets updated,
1619          * then no need for any HCI transactions.
1620          */
1621         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1622             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1623                                                    HCI_LIMITED_DISCOVERABLE)) {
1624                 cancel_delayed_work(&hdev->discov_off);
1625                 hdev->discov_timeout = timeout;
1626
1627                 if (cp->val && hdev->discov_timeout > 0) {
1628                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1629                         queue_delayed_work(hdev->req_workqueue,
1630                                            &hdev->discov_off, to);
1631                 }
1632
1633                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1634                 goto failed;
1635         }
1636
1637         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1638         if (!cmd) {
1639                 err = -ENOMEM;
1640                 goto failed;
1641         }
1642
1643         /* Cancel any potential discoverable timeout that might be
1644          * still active and store new timeout value. The arming of
1645          * the timeout happens in the complete handler.
1646          */
1647         cancel_delayed_work(&hdev->discov_off);
1648         hdev->discov_timeout = timeout;
1649
1650         if (cp->val)
1651                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1652         else
1653                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1654
1655         /* Limited discoverable mode */
1656         if (cp->val == 0x02)
1657                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1658         else
1659                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1660
1661         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1662                                  mgmt_set_discoverable_complete);
1663
1664         if (err < 0)
1665                 mgmt_pending_remove(cmd);
1666
1667 failed:
1668         hci_dev_unlock(hdev);
1669         return err;
1670 }
1671
1672 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1673                                           int err)
1674 {
1675         struct mgmt_pending_cmd *cmd = data;
1676
1677         bt_dev_dbg(hdev, "err %d", err);
1678
1679         /* Make sure cmd still outstanding. */
1680         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1681                 return;
1682
1683         hci_dev_lock(hdev);
1684
1685         if (err) {
1686                 u8 mgmt_err = mgmt_status(err);
1687                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1688                 goto done;
1689         }
1690
1691         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1692         new_settings(hdev, cmd->sk);
1693
1694 done:
1695         if (cmd)
1696                 mgmt_pending_remove(cmd);
1697
1698         hci_dev_unlock(hdev);
1699 }
1700
1701 static int set_connectable_update_settings(struct hci_dev *hdev,
1702                                            struct sock *sk, u8 val)
1703 {
1704         bool changed = false;
1705         int err;
1706
1707         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1708                 changed = true;
1709
1710         if (val) {
1711                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1712         } else {
1713                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1714                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1715         }
1716
1717         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1718         if (err < 0)
1719                 return err;
1720
1721         if (changed) {
1722                 hci_update_scan(hdev);
1723                 hci_update_passive_scan(hdev);
1724                 return new_settings(hdev, sk);
1725         }
1726
1727         return 0;
1728 }
1729
1730 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1731 {
1732         BT_DBG("%s", hdev->name);
1733
1734         return hci_update_connectable_sync(hdev);
1735 }
1736
1737 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1738                            u16 len)
1739 {
1740         struct mgmt_mode *cp = data;
1741         struct mgmt_pending_cmd *cmd;
1742         int err;
1743
1744         bt_dev_dbg(hdev, "sock %p", sk);
1745
1746         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1747             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1748                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1749                                        MGMT_STATUS_REJECTED);
1750
1751         if (cp->val != 0x00 && cp->val != 0x01)
1752                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1753                                        MGMT_STATUS_INVALID_PARAMS);
1754
1755         hci_dev_lock(hdev);
1756
1757         if (!hdev_is_powered(hdev)) {
1758                 err = set_connectable_update_settings(hdev, sk, cp->val);
1759                 goto failed;
1760         }
1761
1762         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1763             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1764                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1765                                       MGMT_STATUS_BUSY);
1766                 goto failed;
1767         }
1768
1769         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1770         if (!cmd) {
1771                 err = -ENOMEM;
1772                 goto failed;
1773         }
1774
1775         if (cp->val) {
1776                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1777         } else {
1778                 if (hdev->discov_timeout > 0)
1779                         cancel_delayed_work(&hdev->discov_off);
1780
1781                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1782                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1783                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1784         }
1785
1786         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1787                                  mgmt_set_connectable_complete);
1788
1789         if (err < 0)
1790                 mgmt_pending_remove(cmd);
1791
1792 failed:
1793         hci_dev_unlock(hdev);
1794         return err;
1795 }
1796
1797 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1798                         u16 len)
1799 {
1800         struct mgmt_mode *cp = data;
1801         bool changed;
1802         int err;
1803
1804         bt_dev_dbg(hdev, "sock %p", sk);
1805
1806         if (cp->val != 0x00 && cp->val != 0x01)
1807                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1808                                        MGMT_STATUS_INVALID_PARAMS);
1809
1810         hci_dev_lock(hdev);
1811
1812         if (cp->val)
1813                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1814         else
1815                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1816
1817         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1818         if (err < 0)
1819                 goto unlock;
1820
1821         if (changed) {
1822                 /* In limited privacy mode the change of bondable mode
1823                  * may affect the local advertising address.
1824                  */
1825                 hci_update_discoverable(hdev);
1826
1827                 err = new_settings(hdev, sk);
1828         }
1829
1830 unlock:
1831         hci_dev_unlock(hdev);
1832         return err;
1833 }
1834
1835 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1836                              u16 len)
1837 {
1838         struct mgmt_mode *cp = data;
1839         struct mgmt_pending_cmd *cmd;
1840         u8 val, status;
1841         int err;
1842
1843         bt_dev_dbg(hdev, "sock %p", sk);
1844
1845         status = mgmt_bredr_support(hdev);
1846         if (status)
1847                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1848                                        status);
1849
1850         if (cp->val != 0x00 && cp->val != 0x01)
1851                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1852                                        MGMT_STATUS_INVALID_PARAMS);
1853
1854         hci_dev_lock(hdev);
1855
1856         if (!hdev_is_powered(hdev)) {
1857                 bool changed = false;
1858
1859                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1860                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1861                         changed = true;
1862                 }
1863
1864                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1865                 if (err < 0)
1866                         goto failed;
1867
1868                 if (changed)
1869                         err = new_settings(hdev, sk);
1870
1871                 goto failed;
1872         }
1873
1874         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1875                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1876                                       MGMT_STATUS_BUSY);
1877                 goto failed;
1878         }
1879
1880         val = !!cp->val;
1881
1882         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1883                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1884                 goto failed;
1885         }
1886
1887         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1888         if (!cmd) {
1889                 err = -ENOMEM;
1890                 goto failed;
1891         }
1892
1893         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1894         if (err < 0) {
1895                 mgmt_pending_remove(cmd);
1896                 goto failed;
1897         }
1898
1899 failed:
1900         hci_dev_unlock(hdev);
1901         return err;
1902 }
1903
1904 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1905 {
1906         struct cmd_lookup match = { NULL, hdev };
1907         struct mgmt_pending_cmd *cmd = data;
1908         struct mgmt_mode *cp = cmd->param;
1909         u8 enable = cp->val;
1910         bool changed;
1911
1912         /* Make sure cmd still outstanding. */
1913         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1914                 return;
1915
1916         if (err) {
1917                 u8 mgmt_err = mgmt_status(err);
1918
1919                 if (enable && hci_dev_test_and_clear_flag(hdev,
1920                                                           HCI_SSP_ENABLED)) {
1921                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1922                         new_settings(hdev, NULL);
1923                 }
1924
1925                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1926                                      &mgmt_err);
1927                 return;
1928         }
1929
1930         if (enable) {
1931                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1932         } else {
1933                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1934
1935                 if (!changed)
1936                         changed = hci_dev_test_and_clear_flag(hdev,
1937                                                               HCI_HS_ENABLED);
1938                 else
1939                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1940         }
1941
1942         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1943
1944         if (changed)
1945                 new_settings(hdev, match.sk);
1946
1947         if (match.sk)
1948                 sock_put(match.sk);
1949
1950         hci_update_eir_sync(hdev);
1951 }
1952
1953 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1954 {
1955         struct mgmt_pending_cmd *cmd = data;
1956         struct mgmt_mode *cp = cmd->param;
1957         bool changed = false;
1958         int err;
1959
1960         if (cp->val)
1961                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1962
1963         err = hci_write_ssp_mode_sync(hdev, cp->val);
1964
1965         if (!err && changed)
1966                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1967
1968         return err;
1969 }
1970
1971 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1972 {
1973         struct mgmt_mode *cp = data;
1974         struct mgmt_pending_cmd *cmd;
1975         u8 status;
1976         int err;
1977
1978         bt_dev_dbg(hdev, "sock %p", sk);
1979
1980         status = mgmt_bredr_support(hdev);
1981         if (status)
1982                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1983
1984         if (!lmp_ssp_capable(hdev))
1985                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1986                                        MGMT_STATUS_NOT_SUPPORTED);
1987
1988         if (cp->val != 0x00 && cp->val != 0x01)
1989                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1990                                        MGMT_STATUS_INVALID_PARAMS);
1991
1992         hci_dev_lock(hdev);
1993
1994         if (!hdev_is_powered(hdev)) {
1995                 bool changed;
1996
1997                 if (cp->val) {
1998                         changed = !hci_dev_test_and_set_flag(hdev,
1999                                                              HCI_SSP_ENABLED);
2000                 } else {
2001                         changed = hci_dev_test_and_clear_flag(hdev,
2002                                                               HCI_SSP_ENABLED);
2003                         if (!changed)
2004                                 changed = hci_dev_test_and_clear_flag(hdev,
2005                                                                       HCI_HS_ENABLED);
2006                         else
2007                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2008                 }
2009
2010                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2011                 if (err < 0)
2012                         goto failed;
2013
2014                 if (changed)
2015                         err = new_settings(hdev, sk);
2016
2017                 goto failed;
2018         }
2019
2020         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2021                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2022                                       MGMT_STATUS_BUSY);
2023                 goto failed;
2024         }
2025
2026         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2027                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2028                 goto failed;
2029         }
2030
2031         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2032         if (!cmd)
2033                 err = -ENOMEM;
2034         else
2035                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2036                                          set_ssp_complete);
2037
2038         if (err < 0) {
2039                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2040                                       MGMT_STATUS_FAILED);
2041
2042                 if (cmd)
2043                         mgmt_pending_remove(cmd);
2044         }
2045
2046 failed:
2047         hci_dev_unlock(hdev);
2048         return err;
2049 }
2050
2051 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2052 {
2053         struct mgmt_mode *cp = data;
2054         bool changed;
2055         u8 status;
2056         int err;
2057
2058         bt_dev_dbg(hdev, "sock %p", sk);
2059
2060         if (!IS_ENABLED(CONFIG_BT_HS))
2061                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2062                                        MGMT_STATUS_NOT_SUPPORTED);
2063
2064         status = mgmt_bredr_support(hdev);
2065         if (status)
2066                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2067
2068         if (!lmp_ssp_capable(hdev))
2069                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2070                                        MGMT_STATUS_NOT_SUPPORTED);
2071
2072         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2073                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2074                                        MGMT_STATUS_REJECTED);
2075
2076         if (cp->val != 0x00 && cp->val != 0x01)
2077                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2078                                        MGMT_STATUS_INVALID_PARAMS);
2079
2080         hci_dev_lock(hdev);
2081
2082         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2083                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2084                                       MGMT_STATUS_BUSY);
2085                 goto unlock;
2086         }
2087
2088         if (cp->val) {
2089                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2090         } else {
2091                 if (hdev_is_powered(hdev)) {
2092                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2093                                               MGMT_STATUS_REJECTED);
2094                         goto unlock;
2095                 }
2096
2097                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2098         }
2099
2100         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2101         if (err < 0)
2102                 goto unlock;
2103
2104         if (changed)
2105                 err = new_settings(hdev, sk);
2106
2107 unlock:
2108         hci_dev_unlock(hdev);
2109         return err;
2110 }
2111
2112 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2113 {
2114         struct cmd_lookup match = { NULL, hdev };
2115         u8 status = mgmt_status(err);
2116
2117         bt_dev_dbg(hdev, "err %d", err);
2118
2119         if (status) {
2120                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2121                                                         &status);
2122                 return;
2123         }
2124
2125         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2126
2127         new_settings(hdev, match.sk);
2128
2129         if (match.sk)
2130                 sock_put(match.sk);
2131 }
2132
2133 static int set_le_sync(struct hci_dev *hdev, void *data)
2134 {
2135         struct mgmt_pending_cmd *cmd = data;
2136         struct mgmt_mode *cp = cmd->param;
2137         u8 val = !!cp->val;
2138         int err;
2139
2140         if (!val) {
2141                 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2142
2143                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2144                         hci_disable_advertising_sync(hdev);
2145
2146                 if (ext_adv_capable(hdev))
2147                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2148         } else {
2149                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2150         }
2151
2152         err = hci_write_le_host_supported_sync(hdev, val, 0);
2153
2154         /* Make sure the controller has a good default for
2155          * advertising data. Restrict the update to when LE
2156          * has actually been enabled. During power on, the
2157          * update in powered_update_hci will take care of it.
2158          */
2159         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2160                 if (ext_adv_capable(hdev)) {
2161                         int status;
2162
2163                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2164                         if (!status)
2165                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2166                 } else {
2167                         hci_update_adv_data_sync(hdev, 0x00);
2168                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2169                 }
2170
2171                 hci_update_passive_scan(hdev);
2172         }
2173
2174         return err;
2175 }
2176
2177 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2178 {
2179         struct mgmt_pending_cmd *cmd = data;
2180         u8 status = mgmt_status(err);
2181         struct sock *sk = cmd->sk;
2182
2183         if (status) {
2184                 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2185                                      cmd_status_rsp, &status);
2186                 return;
2187         }
2188
2189         mgmt_pending_remove(cmd);
2190         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2191 }
2192
2193 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2194 {
2195         struct mgmt_pending_cmd *cmd = data;
2196         struct mgmt_cp_set_mesh *cp = cmd->param;
2197         size_t len = cmd->param_len;
2198
2199         memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2200
2201         if (cp->enable)
2202                 hci_dev_set_flag(hdev, HCI_MESH);
2203         else
2204                 hci_dev_clear_flag(hdev, HCI_MESH);
2205
2206         len -= sizeof(*cp);
2207
2208         /* If filters don't fit, forward all adv pkts */
2209         if (len <= sizeof(hdev->mesh_ad_types))
2210                 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2211
2212         hci_update_passive_scan_sync(hdev);
2213         return 0;
2214 }
2215
2216 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2217 {
2218         struct mgmt_cp_set_mesh *cp = data;
2219         struct mgmt_pending_cmd *cmd;
2220         int err = 0;
2221
2222         bt_dev_dbg(hdev, "sock %p", sk);
2223
2224         if (!lmp_le_capable(hdev) ||
2225             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2226                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2227                                        MGMT_STATUS_NOT_SUPPORTED);
2228
2229         if (cp->enable != 0x00 && cp->enable != 0x01)
2230                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2231                                        MGMT_STATUS_INVALID_PARAMS);
2232
2233         hci_dev_lock(hdev);
2234
2235         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2236         if (!cmd)
2237                 err = -ENOMEM;
2238         else
2239                 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2240                                          set_mesh_complete);
2241
2242         if (err < 0) {
2243                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2244                                       MGMT_STATUS_FAILED);
2245
2246                 if (cmd)
2247                         mgmt_pending_remove(cmd);
2248         }
2249
2250         hci_dev_unlock(hdev);
2251         return err;
2252 }
2253
2254 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2255 {
2256         struct mgmt_mesh_tx *mesh_tx = data;
2257         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2258         unsigned long mesh_send_interval;
2259         u8 mgmt_err = mgmt_status(err);
2260
2261         /* Report any errors here, but don't report completion */
2262
2263         if (mgmt_err) {
2264                 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2265                 /* Send Complete Error Code for handle */
2266                 mesh_send_complete(hdev, mesh_tx, false);
2267                 return;
2268         }
2269
2270         mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2271         queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2272                            mesh_send_interval);
2273 }
2274
2275 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2276 {
2277         struct mgmt_mesh_tx *mesh_tx = data;
2278         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2279         struct adv_info *adv, *next_instance;
2280         u8 instance = hdev->le_num_of_adv_sets + 1;
2281         u16 timeout, duration;
2282         int err = 0;
2283
2284         if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2285                 return MGMT_STATUS_BUSY;
2286
2287         timeout = 1000;
2288         duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2289         adv = hci_add_adv_instance(hdev, instance, 0,
2290                                    send->adv_data_len, send->adv_data,
2291                                    0, NULL,
2292                                    timeout, duration,
2293                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
2294                                    hdev->le_adv_min_interval,
2295                                    hdev->le_adv_max_interval,
2296                                    mesh_tx->handle);
2297
2298         if (!IS_ERR(adv))
2299                 mesh_tx->instance = instance;
2300         else
2301                 err = PTR_ERR(adv);
2302
2303         if (hdev->cur_adv_instance == instance) {
2304                 /* If the currently advertised instance is being changed then
2305                  * cancel the current advertising and schedule the next
2306                  * instance. If there is only one instance then the overridden
2307                  * advertising data will be visible right away.
2308                  */
2309                 cancel_adv_timeout(hdev);
2310
2311                 next_instance = hci_get_next_instance(hdev, instance);
2312                 if (next_instance)
2313                         instance = next_instance->instance;
2314                 else
2315                         instance = 0;
2316         } else if (hdev->adv_instance_timeout) {
2317                 /* Immediately advertise the new instance if no other, or
2318                  * let it go naturally from queue if ADV is already happening
2319                  */
2320                 instance = 0;
2321         }
2322
2323         if (instance)
2324                 return hci_schedule_adv_instance_sync(hdev, instance, true);
2325
2326         return err;
2327 }
2328
2329 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2330 {
2331         struct mgmt_rp_mesh_read_features *rp = data;
2332
2333         if (rp->used_handles >= rp->max_handles)
2334                 return;
2335
2336         rp->handles[rp->used_handles++] = mesh_tx->handle;
2337 }
2338
2339 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2340                          void *data, u16 len)
2341 {
2342         struct mgmt_rp_mesh_read_features rp;
2343
2344         if (!lmp_le_capable(hdev) ||
2345             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2346                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2347                                        MGMT_STATUS_NOT_SUPPORTED);
2348
2349         memset(&rp, 0, sizeof(rp));
2350         rp.index = cpu_to_le16(hdev->id);
2351         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2352                 rp.max_handles = MESH_HANDLES_MAX;
2353
2354         hci_dev_lock(hdev);
2355
2356         if (rp.max_handles)
2357                 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2358
2359         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2360                           rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2361
2362         hci_dev_unlock(hdev);
2363         return 0;
2364 }
2365
2366 static int send_cancel(struct hci_dev *hdev, void *data)
2367 {
2368         struct mgmt_pending_cmd *cmd = data;
2369         struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2370         struct mgmt_mesh_tx *mesh_tx;
2371
2372         if (!cancel->handle) {
2373                 do {
2374                         mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2375
2376                         if (mesh_tx)
2377                                 mesh_send_complete(hdev, mesh_tx, false);
2378                 } while (mesh_tx);
2379         } else {
2380                 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2381
2382                 if (mesh_tx && mesh_tx->sk == cmd->sk)
2383                         mesh_send_complete(hdev, mesh_tx, false);
2384         }
2385
2386         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2387                           0, NULL, 0);
2388         mgmt_pending_free(cmd);
2389
2390         return 0;
2391 }
2392
2393 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2394                             void *data, u16 len)
2395 {
2396         struct mgmt_pending_cmd *cmd;
2397         int err;
2398
2399         if (!lmp_le_capable(hdev) ||
2400             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2401                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2402                                        MGMT_STATUS_NOT_SUPPORTED);
2403
2404         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2405                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2406                                        MGMT_STATUS_REJECTED);
2407
2408         hci_dev_lock(hdev);
2409         cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2410         if (!cmd)
2411                 err = -ENOMEM;
2412         else
2413                 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2414
2415         if (err < 0) {
2416                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2417                                       MGMT_STATUS_FAILED);
2418
2419                 if (cmd)
2420                         mgmt_pending_free(cmd);
2421         }
2422
2423         hci_dev_unlock(hdev);
2424         return err;
2425 }
2426
2427 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2428 {
2429         struct mgmt_mesh_tx *mesh_tx;
2430         struct mgmt_cp_mesh_send *send = data;
2431         struct mgmt_rp_mesh_read_features rp;
2432         bool sending;
2433         int err = 0;
2434
2435         if (!lmp_le_capable(hdev) ||
2436             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2437                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2438                                        MGMT_STATUS_NOT_SUPPORTED);
2439         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2440             len <= MGMT_MESH_SEND_SIZE ||
2441             len > (MGMT_MESH_SEND_SIZE + 31))
2442                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2443                                        MGMT_STATUS_REJECTED);
2444
2445         hci_dev_lock(hdev);
2446
2447         memset(&rp, 0, sizeof(rp));
2448         rp.max_handles = MESH_HANDLES_MAX;
2449
2450         mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2451
2452         if (rp.max_handles <= rp.used_handles) {
2453                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2454                                       MGMT_STATUS_BUSY);
2455                 goto done;
2456         }
2457
2458         sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2459         mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2460
2461         if (!mesh_tx)
2462                 err = -ENOMEM;
2463         else if (!sending)
2464                 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2465                                          mesh_send_start_complete);
2466
2467         if (err < 0) {
2468                 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2469                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2470                                       MGMT_STATUS_FAILED);
2471
2472                 if (mesh_tx) {
2473                         if (sending)
2474                                 mgmt_mesh_remove(mesh_tx);
2475                 }
2476         } else {
2477                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2478
2479                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2480                                   &mesh_tx->handle, 1);
2481         }
2482
2483 done:
2484         hci_dev_unlock(hdev);
2485         return err;
2486 }
2487
2488 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2489 {
2490         struct mgmt_mode *cp = data;
2491         struct mgmt_pending_cmd *cmd;
2492         int err;
2493         u8 val, enabled;
2494
2495         bt_dev_dbg(hdev, "sock %p", sk);
2496
2497         if (!lmp_le_capable(hdev))
2498                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2499                                        MGMT_STATUS_NOT_SUPPORTED);
2500
2501         if (cp->val != 0x00 && cp->val != 0x01)
2502                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2503                                        MGMT_STATUS_INVALID_PARAMS);
2504
2505         /* Bluetooth single mode LE only controllers or dual-mode
2506          * controllers configured as LE only devices, do not allow
2507          * switching LE off. These have either LE enabled explicitly
2508          * or BR/EDR has been previously switched off.
2509          *
2510          * When trying to enable an already enabled LE, then gracefully
2511          * send a positive response. Trying to disable it however will
2512          * result into rejection.
2513          */
2514         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2515                 if (cp->val == 0x01)
2516                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2517
2518                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2519                                        MGMT_STATUS_REJECTED);
2520         }
2521
2522         hci_dev_lock(hdev);
2523
2524         val = !!cp->val;
2525         enabled = lmp_host_le_capable(hdev);
2526
2527         if (!hdev_is_powered(hdev) || val == enabled) {
2528                 bool changed = false;
2529
2530                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2531                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2532                         changed = true;
2533                 }
2534
2535                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2536                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2537                         changed = true;
2538                 }
2539
2540                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2541                 if (err < 0)
2542                         goto unlock;
2543
2544                 if (changed)
2545                         err = new_settings(hdev, sk);
2546
2547                 goto unlock;
2548         }
2549
2550         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2551             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2552                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2553                                       MGMT_STATUS_BUSY);
2554                 goto unlock;
2555         }
2556
2557         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2558         if (!cmd)
2559                 err = -ENOMEM;
2560         else
2561                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2562                                          set_le_complete);
2563
2564         if (err < 0) {
2565                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2566                                       MGMT_STATUS_FAILED);
2567
2568                 if (cmd)
2569                         mgmt_pending_remove(cmd);
2570         }
2571
2572 unlock:
2573         hci_dev_unlock(hdev);
2574         return err;
2575 }
2576
2577 /* This is a helper function to test for pending mgmt commands that can
2578  * cause CoD or EIR HCI commands. We can only allow one such pending
2579  * mgmt command at a time since otherwise we cannot easily track what
2580  * the current values are, will be, and based on that calculate if a new
2581  * HCI command needs to be sent and if yes with what value.
2582  */
2583 static bool pending_eir_or_class(struct hci_dev *hdev)
2584 {
2585         struct mgmt_pending_cmd *cmd;
2586
2587         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2588                 switch (cmd->opcode) {
2589                 case MGMT_OP_ADD_UUID:
2590                 case MGMT_OP_REMOVE_UUID:
2591                 case MGMT_OP_SET_DEV_CLASS:
2592                 case MGMT_OP_SET_POWERED:
2593                         return true;
2594                 }
2595         }
2596
2597         return false;
2598 }
2599
2600 static const u8 bluetooth_base_uuid[] = {
2601                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2602                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2603 };
2604
2605 static u8 get_uuid_size(const u8 *uuid)
2606 {
2607         u32 val;
2608
2609         if (memcmp(uuid, bluetooth_base_uuid, 12))
2610                 return 128;
2611
2612         val = get_unaligned_le32(&uuid[12]);
2613         if (val > 0xffff)
2614                 return 32;
2615
2616         return 16;
2617 }
2618
2619 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2620 {
2621         struct mgmt_pending_cmd *cmd = data;
2622
2623         bt_dev_dbg(hdev, "err %d", err);
2624
2625         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2626                           mgmt_status(err), hdev->dev_class, 3);
2627
2628         mgmt_pending_free(cmd);
2629 }
2630
2631 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2632 {
2633         int err;
2634
2635         err = hci_update_class_sync(hdev);
2636         if (err)
2637                 return err;
2638
2639         return hci_update_eir_sync(hdev);
2640 }
2641
2642 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2643 {
2644         struct mgmt_cp_add_uuid *cp = data;
2645         struct mgmt_pending_cmd *cmd;
2646         struct bt_uuid *uuid;
2647         int err;
2648
2649         bt_dev_dbg(hdev, "sock %p", sk);
2650
2651         hci_dev_lock(hdev);
2652
2653         if (pending_eir_or_class(hdev)) {
2654                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2655                                       MGMT_STATUS_BUSY);
2656                 goto failed;
2657         }
2658
2659         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2660         if (!uuid) {
2661                 err = -ENOMEM;
2662                 goto failed;
2663         }
2664
2665         memcpy(uuid->uuid, cp->uuid, 16);
2666         uuid->svc_hint = cp->svc_hint;
2667         uuid->size = get_uuid_size(cp->uuid);
2668
2669         list_add_tail(&uuid->list, &hdev->uuids);
2670
2671         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2672         if (!cmd) {
2673                 err = -ENOMEM;
2674                 goto failed;
2675         }
2676
2677         err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2678         if (err < 0) {
2679                 mgmt_pending_free(cmd);
2680                 goto failed;
2681         }
2682
2683 failed:
2684         hci_dev_unlock(hdev);
2685         return err;
2686 }
2687
2688 static bool enable_service_cache(struct hci_dev *hdev)
2689 {
2690         if (!hdev_is_powered(hdev))
2691                 return false;
2692
2693         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2694                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2695                                    CACHE_TIMEOUT);
2696                 return true;
2697         }
2698
2699         return false;
2700 }
2701
2702 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2703 {
2704         int err;
2705
2706         err = hci_update_class_sync(hdev);
2707         if (err)
2708                 return err;
2709
2710         return hci_update_eir_sync(hdev);
2711 }
2712
2713 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2714                        u16 len)
2715 {
2716         struct mgmt_cp_remove_uuid *cp = data;
2717         struct mgmt_pending_cmd *cmd;
2718         struct bt_uuid *match, *tmp;
2719         static const u8 bt_uuid_any[] = {
2720                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2721         };
2722         int err, found;
2723
2724         bt_dev_dbg(hdev, "sock %p", sk);
2725
2726         hci_dev_lock(hdev);
2727
2728         if (pending_eir_or_class(hdev)) {
2729                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2730                                       MGMT_STATUS_BUSY);
2731                 goto unlock;
2732         }
2733
2734         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2735                 hci_uuids_clear(hdev);
2736
2737                 if (enable_service_cache(hdev)) {
2738                         err = mgmt_cmd_complete(sk, hdev->id,
2739                                                 MGMT_OP_REMOVE_UUID,
2740                                                 0, hdev->dev_class, 3);
2741                         goto unlock;
2742                 }
2743
2744                 goto update_class;
2745         }
2746
2747         found = 0;
2748
2749         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2750                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2751                         continue;
2752
2753                 list_del(&match->list);
2754                 kfree(match);
2755                 found++;
2756         }
2757
2758         if (found == 0) {
2759                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2760                                       MGMT_STATUS_INVALID_PARAMS);
2761                 goto unlock;
2762         }
2763
2764 update_class:
2765         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2766         if (!cmd) {
2767                 err = -ENOMEM;
2768                 goto unlock;
2769         }
2770
2771         err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2772                                  mgmt_class_complete);
2773         if (err < 0)
2774                 mgmt_pending_free(cmd);
2775
2776 unlock:
2777         hci_dev_unlock(hdev);
2778         return err;
2779 }
2780
2781 static int set_class_sync(struct hci_dev *hdev, void *data)
2782 {
2783         int err = 0;
2784
2785         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2786                 cancel_delayed_work_sync(&hdev->service_cache);
2787                 err = hci_update_eir_sync(hdev);
2788         }
2789
2790         if (err)
2791                 return err;
2792
2793         return hci_update_class_sync(hdev);
2794 }
2795
2796 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2797                          u16 len)
2798 {
2799         struct mgmt_cp_set_dev_class *cp = data;
2800         struct mgmt_pending_cmd *cmd;
2801         int err;
2802
2803         bt_dev_dbg(hdev, "sock %p", sk);
2804
2805         if (!lmp_bredr_capable(hdev))
2806                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2807                                        MGMT_STATUS_NOT_SUPPORTED);
2808
2809         hci_dev_lock(hdev);
2810
2811         if (pending_eir_or_class(hdev)) {
2812                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2813                                       MGMT_STATUS_BUSY);
2814                 goto unlock;
2815         }
2816
2817         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2818                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2819                                       MGMT_STATUS_INVALID_PARAMS);
2820                 goto unlock;
2821         }
2822
2823         hdev->major_class = cp->major;
2824         hdev->minor_class = cp->minor;
2825
2826         if (!hdev_is_powered(hdev)) {
2827                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2828                                         hdev->dev_class, 3);
2829                 goto unlock;
2830         }
2831
2832         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2833         if (!cmd) {
2834                 err = -ENOMEM;
2835                 goto unlock;
2836         }
2837
2838         err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2839                                  mgmt_class_complete);
2840         if (err < 0)
2841                 mgmt_pending_free(cmd);
2842
2843 unlock:
2844         hci_dev_unlock(hdev);
2845         return err;
2846 }
2847
2848 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2849                           u16 len)
2850 {
2851         struct mgmt_cp_load_link_keys *cp = data;
2852         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2853                                    sizeof(struct mgmt_link_key_info));
2854         u16 key_count, expected_len;
2855         bool changed;
2856         int i;
2857
2858         bt_dev_dbg(hdev, "sock %p", sk);
2859
2860         if (!lmp_bredr_capable(hdev))
2861                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2862                                        MGMT_STATUS_NOT_SUPPORTED);
2863
2864         key_count = __le16_to_cpu(cp->key_count);
2865         if (key_count > max_key_count) {
2866                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2867                            key_count);
2868                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2869                                        MGMT_STATUS_INVALID_PARAMS);
2870         }
2871
2872         expected_len = struct_size(cp, keys, key_count);
2873         if (expected_len != len) {
2874                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2875                            expected_len, len);
2876                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2877                                        MGMT_STATUS_INVALID_PARAMS);
2878         }
2879
2880         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2881                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2882                                        MGMT_STATUS_INVALID_PARAMS);
2883
2884         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2885                    key_count);
2886
2887         for (i = 0; i < key_count; i++) {
2888                 struct mgmt_link_key_info *key = &cp->keys[i];
2889
2890                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2891                         return mgmt_cmd_status(sk, hdev->id,
2892                                                MGMT_OP_LOAD_LINK_KEYS,
2893                                                MGMT_STATUS_INVALID_PARAMS);
2894         }
2895
2896         hci_dev_lock(hdev);
2897
2898         hci_link_keys_clear(hdev);
2899
2900         if (cp->debug_keys)
2901                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2902         else
2903                 changed = hci_dev_test_and_clear_flag(hdev,
2904                                                       HCI_KEEP_DEBUG_KEYS);
2905
2906         if (changed)
2907                 new_settings(hdev, NULL);
2908
2909         for (i = 0; i < key_count; i++) {
2910                 struct mgmt_link_key_info *key = &cp->keys[i];
2911
2912                 if (hci_is_blocked_key(hdev,
2913                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2914                                        key->val)) {
2915                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2916                                     &key->addr.bdaddr);
2917                         continue;
2918                 }
2919
2920                 /* Always ignore debug keys and require a new pairing if
2921                  * the user wants to use them.
2922                  */
2923                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2924                         continue;
2925
2926                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2927                                  key->type, key->pin_len, NULL);
2928         }
2929
2930         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2931
2932         hci_dev_unlock(hdev);
2933
2934         return 0;
2935 }
2936
2937 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2938                            u8 addr_type, struct sock *skip_sk)
2939 {
2940         struct mgmt_ev_device_unpaired ev;
2941
2942         bacpy(&ev.addr.bdaddr, bdaddr);
2943         ev.addr.type = addr_type;
2944
2945         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2946                           skip_sk);
2947 }
2948
2949 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2950 {
2951         struct mgmt_pending_cmd *cmd = data;
2952         struct mgmt_cp_unpair_device *cp = cmd->param;
2953
2954         if (!err)
2955                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2956
2957         cmd->cmd_complete(cmd, err);
2958         mgmt_pending_free(cmd);
2959 }
2960
2961 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2962 {
2963         struct mgmt_pending_cmd *cmd = data;
2964         struct mgmt_cp_unpair_device *cp = cmd->param;
2965         struct hci_conn *conn;
2966
2967         if (cp->addr.type == BDADDR_BREDR)
2968                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2969                                                &cp->addr.bdaddr);
2970         else
2971                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2972                                                le_addr_type(cp->addr.type));
2973
2974         if (!conn)
2975                 return 0;
2976
2977         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2978 }
2979
2980 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2981                          u16 len)
2982 {
2983         struct mgmt_cp_unpair_device *cp = data;
2984         struct mgmt_rp_unpair_device rp;
2985         struct hci_conn_params *params;
2986         struct mgmt_pending_cmd *cmd;
2987         struct hci_conn *conn;
2988         u8 addr_type;
2989         int err;
2990
2991         memset(&rp, 0, sizeof(rp));
2992         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2993         rp.addr.type = cp->addr.type;
2994
2995         if (!bdaddr_type_is_valid(cp->addr.type))
2996                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2997                                          MGMT_STATUS_INVALID_PARAMS,
2998                                          &rp, sizeof(rp));
2999
3000         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
3001                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3002                                          MGMT_STATUS_INVALID_PARAMS,
3003                                          &rp, sizeof(rp));
3004
3005         hci_dev_lock(hdev);
3006
3007         if (!hdev_is_powered(hdev)) {
3008                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3009                                         MGMT_STATUS_NOT_POWERED, &rp,
3010                                         sizeof(rp));
3011                 goto unlock;
3012         }
3013
3014         if (cp->addr.type == BDADDR_BREDR) {
3015                 /* If disconnection is requested, then look up the
3016                  * connection. If the remote device is connected, it
3017                  * will be later used to terminate the link.
3018                  *
3019                  * Setting it to NULL explicitly will cause no
3020                  * termination of the link.
3021                  */
3022                 if (cp->disconnect)
3023                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3024                                                        &cp->addr.bdaddr);
3025                 else
3026                         conn = NULL;
3027
3028                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3029                 if (err < 0) {
3030                         err = mgmt_cmd_complete(sk, hdev->id,
3031                                                 MGMT_OP_UNPAIR_DEVICE,
3032                                                 MGMT_STATUS_NOT_PAIRED, &rp,
3033                                                 sizeof(rp));
3034                         goto unlock;
3035                 }
3036
3037                 goto done;
3038         }
3039
3040         /* LE address type */
3041         addr_type = le_addr_type(cp->addr.type);
3042
3043         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3044         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3045         if (err < 0) {
3046                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3047                                         MGMT_STATUS_NOT_PAIRED, &rp,
3048                                         sizeof(rp));
3049                 goto unlock;
3050         }
3051
3052         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3053         if (!conn) {
3054                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3055                 goto done;
3056         }
3057
3058
3059         /* Defer clearing up the connection parameters until closing to
3060          * give a chance of keeping them if a repairing happens.
3061          */
3062         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3063
3064         /* Disable auto-connection parameters if present */
3065         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3066         if (params) {
3067                 if (params->explicit_connect)
3068                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3069                 else
3070                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3071         }
3072
3073         /* If disconnection is not requested, then clear the connection
3074          * variable so that the link is not terminated.
3075          */
3076         if (!cp->disconnect)
3077                 conn = NULL;
3078
3079 done:
3080         /* If the connection variable is set, then termination of the
3081          * link is requested.
3082          */
3083         if (!conn) {
3084                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3085                                         &rp, sizeof(rp));
3086                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3087                 goto unlock;
3088         }
3089
3090         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3091                                sizeof(*cp));
3092         if (!cmd) {
3093                 err = -ENOMEM;
3094                 goto unlock;
3095         }
3096
3097         cmd->cmd_complete = addr_cmd_complete;
3098
3099         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3100                                  unpair_device_complete);
3101         if (err < 0)
3102                 mgmt_pending_free(cmd);
3103
3104 unlock:
3105         hci_dev_unlock(hdev);
3106         return err;
3107 }
3108
3109 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3110                       u16 len)
3111 {
3112         struct mgmt_cp_disconnect *cp = data;
3113         struct mgmt_rp_disconnect rp;
3114         struct mgmt_pending_cmd *cmd;
3115         struct hci_conn *conn;
3116         int err;
3117
3118         bt_dev_dbg(hdev, "sock %p", sk);
3119
3120         memset(&rp, 0, sizeof(rp));
3121         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3122         rp.addr.type = cp->addr.type;
3123
3124         if (!bdaddr_type_is_valid(cp->addr.type))
3125                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3126                                          MGMT_STATUS_INVALID_PARAMS,
3127                                          &rp, sizeof(rp));
3128
3129         hci_dev_lock(hdev);
3130
3131         if (!test_bit(HCI_UP, &hdev->flags)) {
3132                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3133                                         MGMT_STATUS_NOT_POWERED, &rp,
3134                                         sizeof(rp));
3135                 goto failed;
3136         }
3137
3138         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3139                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3140                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3141                 goto failed;
3142         }
3143
3144         if (cp->addr.type == BDADDR_BREDR)
3145                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3146                                                &cp->addr.bdaddr);
3147         else
3148                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3149                                                le_addr_type(cp->addr.type));
3150
3151         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3152                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3153                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3154                                         sizeof(rp));
3155                 goto failed;
3156         }
3157
3158         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3159         if (!cmd) {
3160                 err = -ENOMEM;
3161                 goto failed;
3162         }
3163
3164         cmd->cmd_complete = generic_cmd_complete;
3165
3166         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3167         if (err < 0)
3168                 mgmt_pending_remove(cmd);
3169
3170 failed:
3171         hci_dev_unlock(hdev);
3172         return err;
3173 }
3174
3175 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3176 {
3177         switch (link_type) {
3178         case LE_LINK:
3179                 switch (addr_type) {
3180                 case ADDR_LE_DEV_PUBLIC:
3181                         return BDADDR_LE_PUBLIC;
3182
3183                 default:
3184                         /* Fallback to LE Random address type */
3185                         return BDADDR_LE_RANDOM;
3186                 }
3187
3188         default:
3189                 /* Fallback to BR/EDR type */
3190                 return BDADDR_BREDR;
3191         }
3192 }
3193
3194 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3195                            u16 data_len)
3196 {
3197         struct mgmt_rp_get_connections *rp;
3198         struct hci_conn *c;
3199         int err;
3200         u16 i;
3201
3202         bt_dev_dbg(hdev, "sock %p", sk);
3203
3204         hci_dev_lock(hdev);
3205
3206         if (!hdev_is_powered(hdev)) {
3207                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3208                                       MGMT_STATUS_NOT_POWERED);
3209                 goto unlock;
3210         }
3211
3212         i = 0;
3213         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3214                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3215                         i++;
3216         }
3217
3218         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
3219         if (!rp) {
3220                 err = -ENOMEM;
3221                 goto unlock;
3222         }
3223
3224         i = 0;
3225         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3226                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3227                         continue;
3228                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3229                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3230                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3231                         continue;
3232                 i++;
3233         }
3234
3235         rp->conn_count = cpu_to_le16(i);
3236
3237         /* Recalculate length in case of filtered SCO connections, etc */
3238         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3239                                 struct_size(rp, addr, i));
3240
3241         kfree(rp);
3242
3243 unlock:
3244         hci_dev_unlock(hdev);
3245         return err;
3246 }
3247
3248 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3249                                    struct mgmt_cp_pin_code_neg_reply *cp)
3250 {
3251         struct mgmt_pending_cmd *cmd;
3252         int err;
3253
3254         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3255                                sizeof(*cp));
3256         if (!cmd)
3257                 return -ENOMEM;
3258
3259         cmd->cmd_complete = addr_cmd_complete;
3260
3261         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3262                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3263         if (err < 0)
3264                 mgmt_pending_remove(cmd);
3265
3266         return err;
3267 }
3268
3269 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3270                           u16 len)
3271 {
3272         struct hci_conn *conn;
3273         struct mgmt_cp_pin_code_reply *cp = data;
3274         struct hci_cp_pin_code_reply reply;
3275         struct mgmt_pending_cmd *cmd;
3276         int err;
3277
3278         bt_dev_dbg(hdev, "sock %p", sk);
3279
3280         hci_dev_lock(hdev);
3281
3282         if (!hdev_is_powered(hdev)) {
3283                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3284                                       MGMT_STATUS_NOT_POWERED);
3285                 goto failed;
3286         }
3287
3288         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3289         if (!conn) {
3290                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3291                                       MGMT_STATUS_NOT_CONNECTED);
3292                 goto failed;
3293         }
3294
3295         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3296                 struct mgmt_cp_pin_code_neg_reply ncp;
3297
3298                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3299
3300                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3301
3302                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3303                 if (err >= 0)
3304                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3305                                               MGMT_STATUS_INVALID_PARAMS);
3306
3307                 goto failed;
3308         }
3309
3310         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3311         if (!cmd) {
3312                 err = -ENOMEM;
3313                 goto failed;
3314         }
3315
3316         cmd->cmd_complete = addr_cmd_complete;
3317
3318         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3319         reply.pin_len = cp->pin_len;
3320         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3321
3322         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3323         if (err < 0)
3324                 mgmt_pending_remove(cmd);
3325
3326 failed:
3327         hci_dev_unlock(hdev);
3328         return err;
3329 }
3330
3331 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3332                              u16 len)
3333 {
3334         struct mgmt_cp_set_io_capability *cp = data;
3335
3336         bt_dev_dbg(hdev, "sock %p", sk);
3337
3338         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3339                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3340                                        MGMT_STATUS_INVALID_PARAMS);
3341
3342         hci_dev_lock(hdev);
3343
3344         hdev->io_capability = cp->io_capability;
3345
3346         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3347
3348         hci_dev_unlock(hdev);
3349
3350         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3351                                  NULL, 0);
3352 }
3353
3354 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3355 {
3356         struct hci_dev *hdev = conn->hdev;
3357         struct mgmt_pending_cmd *cmd;
3358
3359         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3360                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3361                         continue;
3362
3363                 if (cmd->user_data != conn)
3364                         continue;
3365
3366                 return cmd;
3367         }
3368
3369         return NULL;
3370 }
3371
3372 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3373 {
3374         struct mgmt_rp_pair_device rp;
3375         struct hci_conn *conn = cmd->user_data;
3376         int err;
3377
3378         bacpy(&rp.addr.bdaddr, &conn->dst);
3379         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3380
3381         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3382                                 status, &rp, sizeof(rp));
3383
3384         /* So we don't get further callbacks for this connection */
3385         conn->connect_cfm_cb = NULL;
3386         conn->security_cfm_cb = NULL;
3387         conn->disconn_cfm_cb = NULL;
3388
3389         hci_conn_drop(conn);
3390
3391         /* The device is paired so there is no need to remove
3392          * its connection parameters anymore.
3393          */
3394         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3395
3396         hci_conn_put(conn);
3397
3398         return err;
3399 }
3400
3401 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3402 {
3403         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3404         struct mgmt_pending_cmd *cmd;
3405
3406         cmd = find_pairing(conn);
3407         if (cmd) {
3408                 cmd->cmd_complete(cmd, status);
3409                 mgmt_pending_remove(cmd);
3410         }
3411 }
3412
3413 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3414 {
3415         struct mgmt_pending_cmd *cmd;
3416
3417         BT_DBG("status %u", status);
3418
3419         cmd = find_pairing(conn);
3420         if (!cmd) {
3421                 BT_DBG("Unable to find a pending command");
3422                 return;
3423         }
3424
3425         cmd->cmd_complete(cmd, mgmt_status(status));
3426         mgmt_pending_remove(cmd);
3427 }
3428
3429 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3430 {
3431         struct mgmt_pending_cmd *cmd;
3432
3433         BT_DBG("status %u", status);
3434
3435         if (!status)
3436                 return;
3437
3438         cmd = find_pairing(conn);
3439         if (!cmd) {
3440                 BT_DBG("Unable to find a pending command");
3441                 return;
3442         }
3443
3444         cmd->cmd_complete(cmd, mgmt_status(status));
3445         mgmt_pending_remove(cmd);
3446 }
3447
3448 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3449                        u16 len)
3450 {
3451         struct mgmt_cp_pair_device *cp = data;
3452         struct mgmt_rp_pair_device rp;
3453         struct mgmt_pending_cmd *cmd;
3454         u8 sec_level, auth_type;
3455         struct hci_conn *conn;
3456         int err;
3457
3458         bt_dev_dbg(hdev, "sock %p", sk);
3459
3460         memset(&rp, 0, sizeof(rp));
3461         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3462         rp.addr.type = cp->addr.type;
3463
3464         if (!bdaddr_type_is_valid(cp->addr.type))
3465                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3466                                          MGMT_STATUS_INVALID_PARAMS,
3467                                          &rp, sizeof(rp));
3468
3469         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3470                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3471                                          MGMT_STATUS_INVALID_PARAMS,
3472                                          &rp, sizeof(rp));
3473
3474         hci_dev_lock(hdev);
3475
3476         if (!hdev_is_powered(hdev)) {
3477                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3478                                         MGMT_STATUS_NOT_POWERED, &rp,
3479                                         sizeof(rp));
3480                 goto unlock;
3481         }
3482
3483         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3484                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3485                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3486                                         sizeof(rp));
3487                 goto unlock;
3488         }
3489
3490         sec_level = BT_SECURITY_MEDIUM;
3491         auth_type = HCI_AT_DEDICATED_BONDING;
3492
3493         if (cp->addr.type == BDADDR_BREDR) {
3494                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3495                                        auth_type, CONN_REASON_PAIR_DEVICE);
3496         } else {
3497                 u8 addr_type = le_addr_type(cp->addr.type);
3498                 struct hci_conn_params *p;
3499
3500                 /* When pairing a new device, it is expected to remember
3501                  * this device for future connections. Adding the connection
3502                  * parameter information ahead of time allows tracking
3503                  * of the peripheral preferred values and will speed up any
3504                  * further connection establishment.
3505                  *
3506                  * If connection parameters already exist, then they
3507                  * will be kept and this function does nothing.
3508                  */
3509                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3510
3511                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3512                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3513
3514                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3515                                            sec_level, HCI_LE_CONN_TIMEOUT,
3516                                            CONN_REASON_PAIR_DEVICE);
3517         }
3518
3519         if (IS_ERR(conn)) {
3520                 int status;
3521
3522                 if (PTR_ERR(conn) == -EBUSY)
3523                         status = MGMT_STATUS_BUSY;
3524                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3525                         status = MGMT_STATUS_NOT_SUPPORTED;
3526                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3527                         status = MGMT_STATUS_REJECTED;
3528                 else
3529                         status = MGMT_STATUS_CONNECT_FAILED;
3530
3531                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3532                                         status, &rp, sizeof(rp));
3533                 goto unlock;
3534         }
3535
3536         if (conn->connect_cfm_cb) {
3537                 hci_conn_drop(conn);
3538                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3539                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3540                 goto unlock;
3541         }
3542
3543         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3544         if (!cmd) {
3545                 err = -ENOMEM;
3546                 hci_conn_drop(conn);
3547                 goto unlock;
3548         }
3549
3550         cmd->cmd_complete = pairing_complete;
3551
3552         /* For LE, just connecting isn't a proof that the pairing finished */
3553         if (cp->addr.type == BDADDR_BREDR) {
3554                 conn->connect_cfm_cb = pairing_complete_cb;
3555                 conn->security_cfm_cb = pairing_complete_cb;
3556                 conn->disconn_cfm_cb = pairing_complete_cb;
3557         } else {
3558                 conn->connect_cfm_cb = le_pairing_complete_cb;
3559                 conn->security_cfm_cb = le_pairing_complete_cb;
3560                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3561         }
3562
3563         conn->io_capability = cp->io_cap;
3564         cmd->user_data = hci_conn_get(conn);
3565
3566         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3567             hci_conn_security(conn, sec_level, auth_type, true)) {
3568                 cmd->cmd_complete(cmd, 0);
3569                 mgmt_pending_remove(cmd);
3570         }
3571
3572         err = 0;
3573
3574 unlock:
3575         hci_dev_unlock(hdev);
3576         return err;
3577 }
3578
3579 static int abort_conn_sync(struct hci_dev *hdev, void *data)
3580 {
3581         struct hci_conn *conn;
3582         u16 handle = PTR_ERR(data);
3583
3584         conn = hci_conn_hash_lookup_handle(hdev, handle);
3585         if (!conn)
3586                 return 0;
3587
3588         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
3589 }
3590
3591 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3592                               u16 len)
3593 {
3594         struct mgmt_addr_info *addr = data;
3595         struct mgmt_pending_cmd *cmd;
3596         struct hci_conn *conn;
3597         int err;
3598
3599         bt_dev_dbg(hdev, "sock %p", sk);
3600
3601         hci_dev_lock(hdev);
3602
3603         if (!hdev_is_powered(hdev)) {
3604                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3605                                       MGMT_STATUS_NOT_POWERED);
3606                 goto unlock;
3607         }
3608
3609         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3610         if (!cmd) {
3611                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3612                                       MGMT_STATUS_INVALID_PARAMS);
3613                 goto unlock;
3614         }
3615
3616         conn = cmd->user_data;
3617
3618         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3619                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3620                                       MGMT_STATUS_INVALID_PARAMS);
3621                 goto unlock;
3622         }
3623
3624         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3625         mgmt_pending_remove(cmd);
3626
3627         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3628                                 addr, sizeof(*addr));
3629
3630         /* Since user doesn't want to proceed with the connection, abort any
3631          * ongoing pairing and then terminate the link if it was created
3632          * because of the pair device action.
3633          */
3634         if (addr->type == BDADDR_BREDR)
3635                 hci_remove_link_key(hdev, &addr->bdaddr);
3636         else
3637                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3638                                               le_addr_type(addr->type));
3639
3640         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3641                 hci_cmd_sync_queue(hdev, abort_conn_sync, ERR_PTR(conn->handle),
3642                                    NULL);
3643
3644 unlock:
3645         hci_dev_unlock(hdev);
3646         return err;
3647 }
3648
3649 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3650                              struct mgmt_addr_info *addr, u16 mgmt_op,
3651                              u16 hci_op, __le32 passkey)
3652 {
3653         struct mgmt_pending_cmd *cmd;
3654         struct hci_conn *conn;
3655         int err;
3656
3657         hci_dev_lock(hdev);
3658
3659         if (!hdev_is_powered(hdev)) {
3660                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3661                                         MGMT_STATUS_NOT_POWERED, addr,
3662                                         sizeof(*addr));
3663                 goto done;
3664         }
3665
3666         if (addr->type == BDADDR_BREDR)
3667                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3668         else
3669                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3670                                                le_addr_type(addr->type));
3671
3672         if (!conn) {
3673                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3674                                         MGMT_STATUS_NOT_CONNECTED, addr,
3675                                         sizeof(*addr));
3676                 goto done;
3677         }
3678
3679         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3680                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3681                 if (!err)
3682                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3683                                                 MGMT_STATUS_SUCCESS, addr,
3684                                                 sizeof(*addr));
3685                 else
3686                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3687                                                 MGMT_STATUS_FAILED, addr,
3688                                                 sizeof(*addr));
3689
3690                 goto done;
3691         }
3692
3693         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3694         if (!cmd) {
3695                 err = -ENOMEM;
3696                 goto done;
3697         }
3698
3699         cmd->cmd_complete = addr_cmd_complete;
3700
3701         /* Continue with pairing via HCI */
3702         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3703                 struct hci_cp_user_passkey_reply cp;
3704
3705                 bacpy(&cp.bdaddr, &addr->bdaddr);
3706                 cp.passkey = passkey;
3707                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3708         } else
3709                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3710                                    &addr->bdaddr);
3711
3712         if (err < 0)
3713                 mgmt_pending_remove(cmd);
3714
3715 done:
3716         hci_dev_unlock(hdev);
3717         return err;
3718 }
3719
3720 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3721                               void *data, u16 len)
3722 {
3723         struct mgmt_cp_pin_code_neg_reply *cp = data;
3724
3725         bt_dev_dbg(hdev, "sock %p", sk);
3726
3727         return user_pairing_resp(sk, hdev, &cp->addr,
3728                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3729                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3730 }
3731
3732 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3733                               u16 len)
3734 {
3735         struct mgmt_cp_user_confirm_reply *cp = data;
3736
3737         bt_dev_dbg(hdev, "sock %p", sk);
3738
3739         if (len != sizeof(*cp))
3740                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3741                                        MGMT_STATUS_INVALID_PARAMS);
3742
3743         return user_pairing_resp(sk, hdev, &cp->addr,
3744                                  MGMT_OP_USER_CONFIRM_REPLY,
3745                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3746 }
3747
3748 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3749                                   void *data, u16 len)
3750 {
3751         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3752
3753         bt_dev_dbg(hdev, "sock %p", sk);
3754
3755         return user_pairing_resp(sk, hdev, &cp->addr,
3756                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3757                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3758 }
3759
3760 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3761                               u16 len)
3762 {
3763         struct mgmt_cp_user_passkey_reply *cp = data;
3764
3765         bt_dev_dbg(hdev, "sock %p", sk);
3766
3767         return user_pairing_resp(sk, hdev, &cp->addr,
3768                                  MGMT_OP_USER_PASSKEY_REPLY,
3769                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3770 }
3771
3772 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3773                                   void *data, u16 len)
3774 {
3775         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3776
3777         bt_dev_dbg(hdev, "sock %p", sk);
3778
3779         return user_pairing_resp(sk, hdev, &cp->addr,
3780                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3781                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3782 }
3783
3784 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3785 {
3786         struct adv_info *adv_instance;
3787
3788         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3789         if (!adv_instance)
3790                 return 0;
3791
3792         /* stop if current instance doesn't need to be changed */
3793         if (!(adv_instance->flags & flags))
3794                 return 0;
3795
3796         cancel_adv_timeout(hdev);
3797
3798         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3799         if (!adv_instance)
3800                 return 0;
3801
3802         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3803
3804         return 0;
3805 }
3806
3807 static int name_changed_sync(struct hci_dev *hdev, void *data)
3808 {
3809         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3810 }
3811
3812 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3813 {
3814         struct mgmt_pending_cmd *cmd = data;
3815         struct mgmt_cp_set_local_name *cp = cmd->param;
3816         u8 status = mgmt_status(err);
3817
3818         bt_dev_dbg(hdev, "err %d", err);
3819
3820         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3821                 return;
3822
3823         if (status) {
3824                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3825                                 status);
3826         } else {
3827                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3828                                   cp, sizeof(*cp));
3829
3830                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3831                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3832         }
3833
3834         mgmt_pending_remove(cmd);
3835 }
3836
3837 static int set_name_sync(struct hci_dev *hdev, void *data)
3838 {
3839         if (lmp_bredr_capable(hdev)) {
3840                 hci_update_name_sync(hdev);
3841                 hci_update_eir_sync(hdev);
3842         }
3843
3844         /* The name is stored in the scan response data and so
3845          * no need to update the advertising data here.
3846          */
3847         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3848                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3849
3850         return 0;
3851 }
3852
3853 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3854                           u16 len)
3855 {
3856         struct mgmt_cp_set_local_name *cp = data;
3857         struct mgmt_pending_cmd *cmd;
3858         int err;
3859
3860         bt_dev_dbg(hdev, "sock %p", sk);
3861
3862         hci_dev_lock(hdev);
3863
3864         /* If the old values are the same as the new ones just return a
3865          * direct command complete event.
3866          */
3867         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3868             !memcmp(hdev->short_name, cp->short_name,
3869                     sizeof(hdev->short_name))) {
3870                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3871                                         data, len);
3872                 goto failed;
3873         }
3874
3875         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3876
3877         if (!hdev_is_powered(hdev)) {
3878                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3879
3880                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3881                                         data, len);
3882                 if (err < 0)
3883                         goto failed;
3884
3885                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3886                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3887                 ext_info_changed(hdev, sk);
3888
3889                 goto failed;
3890         }
3891
3892         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3893         if (!cmd)
3894                 err = -ENOMEM;
3895         else
3896                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3897                                          set_name_complete);
3898
3899         if (err < 0) {
3900                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3901                                       MGMT_STATUS_FAILED);
3902
3903                 if (cmd)
3904                         mgmt_pending_remove(cmd);
3905
3906                 goto failed;
3907         }
3908
3909         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3910
3911 failed:
3912         hci_dev_unlock(hdev);
3913         return err;
3914 }
3915
3916 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3917 {
3918         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3919 }
3920
3921 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3922                           u16 len)
3923 {
3924         struct mgmt_cp_set_appearance *cp = data;
3925         u16 appearance;
3926         int err;
3927
3928         bt_dev_dbg(hdev, "sock %p", sk);
3929
3930         if (!lmp_le_capable(hdev))
3931                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3932                                        MGMT_STATUS_NOT_SUPPORTED);
3933
3934         appearance = le16_to_cpu(cp->appearance);
3935
3936         hci_dev_lock(hdev);
3937
3938         if (hdev->appearance != appearance) {
3939                 hdev->appearance = appearance;
3940
3941                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3942                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3943                                            NULL);
3944
3945                 ext_info_changed(hdev, sk);
3946         }
3947
3948         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3949                                 0);
3950
3951         hci_dev_unlock(hdev);
3952
3953         return err;
3954 }
3955
3956 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3957                                  void *data, u16 len)
3958 {
3959         struct mgmt_rp_get_phy_configuration rp;
3960
3961         bt_dev_dbg(hdev, "sock %p", sk);
3962
3963         hci_dev_lock(hdev);
3964
3965         memset(&rp, 0, sizeof(rp));
3966
3967         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3968         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3969         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3970
3971         hci_dev_unlock(hdev);
3972
3973         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3974                                  &rp, sizeof(rp));
3975 }
3976
3977 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3978 {
3979         struct mgmt_ev_phy_configuration_changed ev;
3980
3981         memset(&ev, 0, sizeof(ev));
3982
3983         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3984
3985         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3986                           sizeof(ev), skip);
3987 }
3988
3989 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3990 {
3991         struct mgmt_pending_cmd *cmd = data;
3992         struct sk_buff *skb = cmd->skb;
3993         u8 status = mgmt_status(err);
3994
3995         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3996                 return;
3997
3998         if (!status) {
3999                 if (!skb)
4000                         status = MGMT_STATUS_FAILED;
4001                 else if (IS_ERR(skb))
4002                         status = mgmt_status(PTR_ERR(skb));
4003                 else
4004                         status = mgmt_status(skb->data[0]);
4005         }
4006
4007         bt_dev_dbg(hdev, "status %d", status);
4008
4009         if (status) {
4010                 mgmt_cmd_status(cmd->sk, hdev->id,
4011                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
4012         } else {
4013                 mgmt_cmd_complete(cmd->sk, hdev->id,
4014                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
4015                                   NULL, 0);
4016
4017                 mgmt_phy_configuration_changed(hdev, cmd->sk);
4018         }
4019
4020         if (skb && !IS_ERR(skb))
4021                 kfree_skb(skb);
4022
4023         mgmt_pending_remove(cmd);
4024 }
4025
4026 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4027 {
4028         struct mgmt_pending_cmd *cmd = data;
4029         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4030         struct hci_cp_le_set_default_phy cp_phy;
4031         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
4032
4033         memset(&cp_phy, 0, sizeof(cp_phy));
4034
4035         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4036                 cp_phy.all_phys |= 0x01;
4037
4038         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4039                 cp_phy.all_phys |= 0x02;
4040
4041         if (selected_phys & MGMT_PHY_LE_1M_TX)
4042                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4043
4044         if (selected_phys & MGMT_PHY_LE_2M_TX)
4045                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4046
4047         if (selected_phys & MGMT_PHY_LE_CODED_TX)
4048                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4049
4050         if (selected_phys & MGMT_PHY_LE_1M_RX)
4051                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4052
4053         if (selected_phys & MGMT_PHY_LE_2M_RX)
4054                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4055
4056         if (selected_phys & MGMT_PHY_LE_CODED_RX)
4057                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4058
4059         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4060                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4061
4062         return 0;
4063 }
4064
4065 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4066                                  void *data, u16 len)
4067 {
4068         struct mgmt_cp_set_phy_configuration *cp = data;
4069         struct mgmt_pending_cmd *cmd;
4070         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4071         u16 pkt_type = (HCI_DH1 | HCI_DM1);
4072         bool changed = false;
4073         int err;
4074
4075         bt_dev_dbg(hdev, "sock %p", sk);
4076
4077         configurable_phys = get_configurable_phys(hdev);
4078         supported_phys = get_supported_phys(hdev);
4079         selected_phys = __le32_to_cpu(cp->selected_phys);
4080
4081         if (selected_phys & ~supported_phys)
4082                 return mgmt_cmd_status(sk, hdev->id,
4083                                        MGMT_OP_SET_PHY_CONFIGURATION,
4084                                        MGMT_STATUS_INVALID_PARAMS);
4085
4086         unconfigure_phys = supported_phys & ~configurable_phys;
4087
4088         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4089                 return mgmt_cmd_status(sk, hdev->id,
4090                                        MGMT_OP_SET_PHY_CONFIGURATION,
4091                                        MGMT_STATUS_INVALID_PARAMS);
4092
4093         if (selected_phys == get_selected_phys(hdev))
4094                 return mgmt_cmd_complete(sk, hdev->id,
4095                                          MGMT_OP_SET_PHY_CONFIGURATION,
4096                                          0, NULL, 0);
4097
4098         hci_dev_lock(hdev);
4099
4100         if (!hdev_is_powered(hdev)) {
4101                 err = mgmt_cmd_status(sk, hdev->id,
4102                                       MGMT_OP_SET_PHY_CONFIGURATION,
4103                                       MGMT_STATUS_REJECTED);
4104                 goto unlock;
4105         }
4106
4107         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4108                 err = mgmt_cmd_status(sk, hdev->id,
4109                                       MGMT_OP_SET_PHY_CONFIGURATION,
4110                                       MGMT_STATUS_BUSY);
4111                 goto unlock;
4112         }
4113
4114         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4115                 pkt_type |= (HCI_DH3 | HCI_DM3);
4116         else
4117                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4118
4119         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4120                 pkt_type |= (HCI_DH5 | HCI_DM5);
4121         else
4122                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4123
4124         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4125                 pkt_type &= ~HCI_2DH1;
4126         else
4127                 pkt_type |= HCI_2DH1;
4128
4129         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4130                 pkt_type &= ~HCI_2DH3;
4131         else
4132                 pkt_type |= HCI_2DH3;
4133
4134         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4135                 pkt_type &= ~HCI_2DH5;
4136         else
4137                 pkt_type |= HCI_2DH5;
4138
4139         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4140                 pkt_type &= ~HCI_3DH1;
4141         else
4142                 pkt_type |= HCI_3DH1;
4143
4144         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4145                 pkt_type &= ~HCI_3DH3;
4146         else
4147                 pkt_type |= HCI_3DH3;
4148
4149         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4150                 pkt_type &= ~HCI_3DH5;
4151         else
4152                 pkt_type |= HCI_3DH5;
4153
4154         if (pkt_type != hdev->pkt_type) {
4155                 hdev->pkt_type = pkt_type;
4156                 changed = true;
4157         }
4158
4159         if ((selected_phys & MGMT_PHY_LE_MASK) ==
4160             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4161                 if (changed)
4162                         mgmt_phy_configuration_changed(hdev, sk);
4163
4164                 err = mgmt_cmd_complete(sk, hdev->id,
4165                                         MGMT_OP_SET_PHY_CONFIGURATION,
4166                                         0, NULL, 0);
4167
4168                 goto unlock;
4169         }
4170
4171         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4172                                len);
4173         if (!cmd)
4174                 err = -ENOMEM;
4175         else
4176                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4177                                          set_default_phy_complete);
4178
4179         if (err < 0) {
4180                 err = mgmt_cmd_status(sk, hdev->id,
4181                                       MGMT_OP_SET_PHY_CONFIGURATION,
4182                                       MGMT_STATUS_FAILED);
4183
4184                 if (cmd)
4185                         mgmt_pending_remove(cmd);
4186         }
4187
4188 unlock:
4189         hci_dev_unlock(hdev);
4190
4191         return err;
4192 }
4193
4194 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4195                             u16 len)
4196 {
4197         int err = MGMT_STATUS_SUCCESS;
4198         struct mgmt_cp_set_blocked_keys *keys = data;
4199         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4200                                    sizeof(struct mgmt_blocked_key_info));
4201         u16 key_count, expected_len;
4202         int i;
4203
4204         bt_dev_dbg(hdev, "sock %p", sk);
4205
4206         key_count = __le16_to_cpu(keys->key_count);
4207         if (key_count > max_key_count) {
4208                 bt_dev_err(hdev, "too big key_count value %u", key_count);
4209                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4210                                        MGMT_STATUS_INVALID_PARAMS);
4211         }
4212
4213         expected_len = struct_size(keys, keys, key_count);
4214         if (expected_len != len) {
4215                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4216                            expected_len, len);
4217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4218                                        MGMT_STATUS_INVALID_PARAMS);
4219         }
4220
4221         hci_dev_lock(hdev);
4222
4223         hci_blocked_keys_clear(hdev);
4224
4225         for (i = 0; i < key_count; ++i) {
4226                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4227
4228                 if (!b) {
4229                         err = MGMT_STATUS_NO_RESOURCES;
4230                         break;
4231                 }
4232
4233                 b->type = keys->keys[i].type;
4234                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4235                 list_add_rcu(&b->list, &hdev->blocked_keys);
4236         }
4237         hci_dev_unlock(hdev);
4238
4239         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4240                                 err, NULL, 0);
4241 }
4242
4243 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4244                                void *data, u16 len)
4245 {
4246         struct mgmt_mode *cp = data;
4247         int err;
4248         bool changed = false;
4249
4250         bt_dev_dbg(hdev, "sock %p", sk);
4251
4252         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4253                 return mgmt_cmd_status(sk, hdev->id,
4254                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4255                                        MGMT_STATUS_NOT_SUPPORTED);
4256
4257         if (cp->val != 0x00 && cp->val != 0x01)
4258                 return mgmt_cmd_status(sk, hdev->id,
4259                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4260                                        MGMT_STATUS_INVALID_PARAMS);
4261
4262         hci_dev_lock(hdev);
4263
4264         if (hdev_is_powered(hdev) &&
4265             !!cp->val != hci_dev_test_flag(hdev,
4266                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
4267                 err = mgmt_cmd_status(sk, hdev->id,
4268                                       MGMT_OP_SET_WIDEBAND_SPEECH,
4269                                       MGMT_STATUS_REJECTED);
4270                 goto unlock;
4271         }
4272
4273         if (cp->val)
4274                 changed = !hci_dev_test_and_set_flag(hdev,
4275                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4276         else
4277                 changed = hci_dev_test_and_clear_flag(hdev,
4278                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4279
4280         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4281         if (err < 0)
4282                 goto unlock;
4283
4284         if (changed)
4285                 err = new_settings(hdev, sk);
4286
4287 unlock:
4288         hci_dev_unlock(hdev);
4289         return err;
4290 }
4291
4292 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4293                                void *data, u16 data_len)
4294 {
4295         char buf[20];
4296         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4297         u16 cap_len = 0;
4298         u8 flags = 0;
4299         u8 tx_power_range[2];
4300
4301         bt_dev_dbg(hdev, "sock %p", sk);
4302
4303         memset(&buf, 0, sizeof(buf));
4304
4305         hci_dev_lock(hdev);
4306
4307         /* When the Read Simple Pairing Options command is supported, then
4308          * the remote public key validation is supported.
4309          *
4310          * Alternatively, when Microsoft extensions are available, they can
4311          * indicate support for public key validation as well.
4312          */
4313         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4314                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
4315
4316         flags |= 0x02;          /* Remote public key validation (LE) */
4317
4318         /* When the Read Encryption Key Size command is supported, then the
4319          * encryption key size is enforced.
4320          */
4321         if (hdev->commands[20] & 0x10)
4322                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
4323
4324         flags |= 0x08;          /* Encryption key size enforcement (LE) */
4325
4326         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4327                                   &flags, 1);
4328
4329         /* When the Read Simple Pairing Options command is supported, then
4330          * also max encryption key size information is provided.
4331          */
4332         if (hdev->commands[41] & 0x08)
4333                 cap_len = eir_append_le16(rp->cap, cap_len,
4334                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
4335                                           hdev->max_enc_key_size);
4336
4337         cap_len = eir_append_le16(rp->cap, cap_len,
4338                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4339                                   SMP_MAX_ENC_KEY_SIZE);
4340
4341         /* Append the min/max LE tx power parameters if we were able to fetch
4342          * it from the controller
4343          */
4344         if (hdev->commands[38] & 0x80) {
4345                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4346                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4347                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4348                                           tx_power_range, 2);
4349         }
4350
4351         rp->cap_len = cpu_to_le16(cap_len);
4352
4353         hci_dev_unlock(hdev);
4354
4355         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4356                                  rp, sizeof(*rp) + cap_len);
4357 }
4358
4359 #ifdef CONFIG_BT_FEATURE_DEBUG
4360 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4361 static const u8 debug_uuid[16] = {
4362         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4363         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4364 };
4365 #endif
4366
4367 /* 330859bc-7506-492d-9370-9a6f0614037f */
4368 static const u8 quality_report_uuid[16] = {
4369         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4370         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4371 };
4372
4373 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4374 static const u8 offload_codecs_uuid[16] = {
4375         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4376         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4377 };
4378
4379 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4380 static const u8 le_simultaneous_roles_uuid[16] = {
4381         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4382         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4383 };
4384
4385 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
4386 static const u8 rpa_resolution_uuid[16] = {
4387         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4388         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4389 };
4390
4391 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4392 static const u8 iso_socket_uuid[16] = {
4393         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4394         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4395 };
4396
4397 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4398 static const u8 mgmt_mesh_uuid[16] = {
4399         0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4400         0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4401 };
4402
4403 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4404                                   void *data, u16 data_len)
4405 {
4406         struct mgmt_rp_read_exp_features_info *rp;
4407         size_t len;
4408         u16 idx = 0;
4409         u32 flags;
4410         int status;
4411
4412         bt_dev_dbg(hdev, "sock %p", sk);
4413
4414         /* Enough space for 7 features */
4415         len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4416         rp = kzalloc(len, GFP_KERNEL);
4417         if (!rp)
4418                 return -ENOMEM;
4419
4420 #ifdef CONFIG_BT_FEATURE_DEBUG
4421         if (!hdev) {
4422                 flags = bt_dbg_get() ? BIT(0) : 0;
4423
4424                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4425                 rp->features[idx].flags = cpu_to_le32(flags);
4426                 idx++;
4427         }
4428 #endif
4429
4430         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4431                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4432                         flags = BIT(0);
4433                 else
4434                         flags = 0;
4435
4436                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4437                 rp->features[idx].flags = cpu_to_le32(flags);
4438                 idx++;
4439         }
4440
4441         if (hdev && ll_privacy_capable(hdev)) {
4442                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4443                         flags = BIT(0) | BIT(1);
4444                 else
4445                         flags = BIT(1);
4446
4447                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4448                 rp->features[idx].flags = cpu_to_le32(flags);
4449                 idx++;
4450         }
4451
4452         if (hdev && (aosp_has_quality_report(hdev) ||
4453                      hdev->set_quality_report)) {
4454                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4455                         flags = BIT(0);
4456                 else
4457                         flags = 0;
4458
4459                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4460                 rp->features[idx].flags = cpu_to_le32(flags);
4461                 idx++;
4462         }
4463
4464         if (hdev && hdev->get_data_path_id) {
4465                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4466                         flags = BIT(0);
4467                 else
4468                         flags = 0;
4469
4470                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4471                 rp->features[idx].flags = cpu_to_le32(flags);
4472                 idx++;
4473         }
4474
4475         if (IS_ENABLED(CONFIG_BT_LE)) {
4476                 flags = iso_enabled() ? BIT(0) : 0;
4477                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4478                 rp->features[idx].flags = cpu_to_le32(flags);
4479                 idx++;
4480         }
4481
4482         if (hdev && lmp_le_capable(hdev)) {
4483                 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4484                         flags = BIT(0);
4485                 else
4486                         flags = 0;
4487
4488                 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4489                 rp->features[idx].flags = cpu_to_le32(flags);
4490                 idx++;
4491         }
4492
4493         rp->feature_count = cpu_to_le16(idx);
4494
4495         /* After reading the experimental features information, enable
4496          * the events to update client on any future change.
4497          */
4498         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4499
4500         status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4501                                    MGMT_OP_READ_EXP_FEATURES_INFO,
4502                                    0, rp, sizeof(*rp) + (20 * idx));
4503
4504         kfree(rp);
4505         return status;
4506 }
4507
4508 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4509                                           struct sock *skip)
4510 {
4511         struct mgmt_ev_exp_feature_changed ev;
4512
4513         memset(&ev, 0, sizeof(ev));
4514         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4515         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4516
4517         // Do we need to be atomic with the conn_flags?
4518         if (enabled && privacy_mode_capable(hdev))
4519                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4520         else
4521                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4522
4523         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4524                                   &ev, sizeof(ev),
4525                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4526
4527 }
4528
4529 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4530                                bool enabled, struct sock *skip)
4531 {
4532         struct mgmt_ev_exp_feature_changed ev;
4533
4534         memset(&ev, 0, sizeof(ev));
4535         memcpy(ev.uuid, uuid, 16);
4536         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4537
4538         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4539                                   &ev, sizeof(ev),
4540                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4541 }
4542
4543 #define EXP_FEAT(_uuid, _set_func)      \
4544 {                                       \
4545         .uuid = _uuid,                  \
4546         .set_func = _set_func,          \
4547 }
4548
4549 /* The zero key uuid is special. Multiple exp features are set through it. */
4550 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4551                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4552 {
4553         struct mgmt_rp_set_exp_feature rp;
4554
4555         memset(rp.uuid, 0, 16);
4556         rp.flags = cpu_to_le32(0);
4557
4558 #ifdef CONFIG_BT_FEATURE_DEBUG
4559         if (!hdev) {
4560                 bool changed = bt_dbg_get();
4561
4562                 bt_dbg_set(false);
4563
4564                 if (changed)
4565                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4566         }
4567 #endif
4568
4569         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4570                 bool changed;
4571
4572                 changed = hci_dev_test_and_clear_flag(hdev,
4573                                                       HCI_ENABLE_LL_PRIVACY);
4574                 if (changed)
4575                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4576                                             sk);
4577         }
4578
4579         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4580
4581         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4582                                  MGMT_OP_SET_EXP_FEATURE, 0,
4583                                  &rp, sizeof(rp));
4584 }
4585
4586 #ifdef CONFIG_BT_FEATURE_DEBUG
4587 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4588                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4589 {
4590         struct mgmt_rp_set_exp_feature rp;
4591
4592         bool val, changed;
4593         int err;
4594
4595         /* Command requires to use the non-controller index */
4596         if (hdev)
4597                 return mgmt_cmd_status(sk, hdev->id,
4598                                        MGMT_OP_SET_EXP_FEATURE,
4599                                        MGMT_STATUS_INVALID_INDEX);
4600
4601         /* Parameters are limited to a single octet */
4602         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4603                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4604                                        MGMT_OP_SET_EXP_FEATURE,
4605                                        MGMT_STATUS_INVALID_PARAMS);
4606
4607         /* Only boolean on/off is supported */
4608         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4609                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4610                                        MGMT_OP_SET_EXP_FEATURE,
4611                                        MGMT_STATUS_INVALID_PARAMS);
4612
4613         val = !!cp->param[0];
4614         changed = val ? !bt_dbg_get() : bt_dbg_get();
4615         bt_dbg_set(val);
4616
4617         memcpy(rp.uuid, debug_uuid, 16);
4618         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4619
4620         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4621
4622         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4623                                 MGMT_OP_SET_EXP_FEATURE, 0,
4624                                 &rp, sizeof(rp));
4625
4626         if (changed)
4627                 exp_feature_changed(hdev, debug_uuid, val, sk);
4628
4629         return err;
4630 }
4631 #endif
4632
4633 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4634                               struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4635 {
4636         struct mgmt_rp_set_exp_feature rp;
4637         bool val, changed;
4638         int err;
4639
4640         /* Command requires to use the controller index */
4641         if (!hdev)
4642                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4643                                        MGMT_OP_SET_EXP_FEATURE,
4644                                        MGMT_STATUS_INVALID_INDEX);
4645
4646         /* Parameters are limited to a single octet */
4647         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4648                 return mgmt_cmd_status(sk, hdev->id,
4649                                        MGMT_OP_SET_EXP_FEATURE,
4650                                        MGMT_STATUS_INVALID_PARAMS);
4651
4652         /* Only boolean on/off is supported */
4653         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4654                 return mgmt_cmd_status(sk, hdev->id,
4655                                        MGMT_OP_SET_EXP_FEATURE,
4656                                        MGMT_STATUS_INVALID_PARAMS);
4657
4658         val = !!cp->param[0];
4659
4660         if (val) {
4661                 changed = !hci_dev_test_and_set_flag(hdev,
4662                                                      HCI_MESH_EXPERIMENTAL);
4663         } else {
4664                 hci_dev_clear_flag(hdev, HCI_MESH);
4665                 changed = hci_dev_test_and_clear_flag(hdev,
4666                                                       HCI_MESH_EXPERIMENTAL);
4667         }
4668
4669         memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4670         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4671
4672         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4673
4674         err = mgmt_cmd_complete(sk, hdev->id,
4675                                 MGMT_OP_SET_EXP_FEATURE, 0,
4676                                 &rp, sizeof(rp));
4677
4678         if (changed)
4679                 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4680
4681         return err;
4682 }
4683
4684 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4685                                    struct mgmt_cp_set_exp_feature *cp,
4686                                    u16 data_len)
4687 {
4688         struct mgmt_rp_set_exp_feature rp;
4689         bool val, changed;
4690         int err;
4691         u32 flags;
4692
4693         /* Command requires to use the controller index */
4694         if (!hdev)
4695                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4696                                        MGMT_OP_SET_EXP_FEATURE,
4697                                        MGMT_STATUS_INVALID_INDEX);
4698
4699         /* Changes can only be made when controller is powered down */
4700         if (hdev_is_powered(hdev))
4701                 return mgmt_cmd_status(sk, hdev->id,
4702                                        MGMT_OP_SET_EXP_FEATURE,
4703                                        MGMT_STATUS_REJECTED);
4704
4705         /* Parameters are limited to a single octet */
4706         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4707                 return mgmt_cmd_status(sk, hdev->id,
4708                                        MGMT_OP_SET_EXP_FEATURE,
4709                                        MGMT_STATUS_INVALID_PARAMS);
4710
4711         /* Only boolean on/off is supported */
4712         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4713                 return mgmt_cmd_status(sk, hdev->id,
4714                                        MGMT_OP_SET_EXP_FEATURE,
4715                                        MGMT_STATUS_INVALID_PARAMS);
4716
4717         val = !!cp->param[0];
4718
4719         if (val) {
4720                 changed = !hci_dev_test_and_set_flag(hdev,
4721                                                      HCI_ENABLE_LL_PRIVACY);
4722                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4723
4724                 /* Enable LL privacy + supported settings changed */
4725                 flags = BIT(0) | BIT(1);
4726         } else {
4727                 changed = hci_dev_test_and_clear_flag(hdev,
4728                                                       HCI_ENABLE_LL_PRIVACY);
4729
4730                 /* Disable LL privacy + supported settings changed */
4731                 flags = BIT(1);
4732         }
4733
4734         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4735         rp.flags = cpu_to_le32(flags);
4736
4737         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4738
4739         err = mgmt_cmd_complete(sk, hdev->id,
4740                                 MGMT_OP_SET_EXP_FEATURE, 0,
4741                                 &rp, sizeof(rp));
4742
4743         if (changed)
4744                 exp_ll_privacy_feature_changed(val, hdev, sk);
4745
4746         return err;
4747 }
4748
4749 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4750                                    struct mgmt_cp_set_exp_feature *cp,
4751                                    u16 data_len)
4752 {
4753         struct mgmt_rp_set_exp_feature rp;
4754         bool val, changed;
4755         int err;
4756
4757         /* Command requires to use a valid controller index */
4758         if (!hdev)
4759                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4760                                        MGMT_OP_SET_EXP_FEATURE,
4761                                        MGMT_STATUS_INVALID_INDEX);
4762
4763         /* Parameters are limited to a single octet */
4764         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4765                 return mgmt_cmd_status(sk, hdev->id,
4766                                        MGMT_OP_SET_EXP_FEATURE,
4767                                        MGMT_STATUS_INVALID_PARAMS);
4768
4769         /* Only boolean on/off is supported */
4770         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4771                 return mgmt_cmd_status(sk, hdev->id,
4772                                        MGMT_OP_SET_EXP_FEATURE,
4773                                        MGMT_STATUS_INVALID_PARAMS);
4774
4775         hci_req_sync_lock(hdev);
4776
4777         val = !!cp->param[0];
4778         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4779
4780         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4781                 err = mgmt_cmd_status(sk, hdev->id,
4782                                       MGMT_OP_SET_EXP_FEATURE,
4783                                       MGMT_STATUS_NOT_SUPPORTED);
4784                 goto unlock_quality_report;
4785         }
4786
4787         if (changed) {
4788                 if (hdev->set_quality_report)
4789                         err = hdev->set_quality_report(hdev, val);
4790                 else
4791                         err = aosp_set_quality_report(hdev, val);
4792
4793                 if (err) {
4794                         err = mgmt_cmd_status(sk, hdev->id,
4795                                               MGMT_OP_SET_EXP_FEATURE,
4796                                               MGMT_STATUS_FAILED);
4797                         goto unlock_quality_report;
4798                 }
4799
4800                 if (val)
4801                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4802                 else
4803                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4804         }
4805
4806         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4807
4808         memcpy(rp.uuid, quality_report_uuid, 16);
4809         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4810         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4811
4812         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4813                                 &rp, sizeof(rp));
4814
4815         if (changed)
4816                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4817
4818 unlock_quality_report:
4819         hci_req_sync_unlock(hdev);
4820         return err;
4821 }
4822
4823 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4824                                   struct mgmt_cp_set_exp_feature *cp,
4825                                   u16 data_len)
4826 {
4827         bool val, changed;
4828         int err;
4829         struct mgmt_rp_set_exp_feature rp;
4830
4831         /* Command requires to use a valid controller index */
4832         if (!hdev)
4833                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4834                                        MGMT_OP_SET_EXP_FEATURE,
4835                                        MGMT_STATUS_INVALID_INDEX);
4836
4837         /* Parameters are limited to a single octet */
4838         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4839                 return mgmt_cmd_status(sk, hdev->id,
4840                                        MGMT_OP_SET_EXP_FEATURE,
4841                                        MGMT_STATUS_INVALID_PARAMS);
4842
4843         /* Only boolean on/off is supported */
4844         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4845                 return mgmt_cmd_status(sk, hdev->id,
4846                                        MGMT_OP_SET_EXP_FEATURE,
4847                                        MGMT_STATUS_INVALID_PARAMS);
4848
4849         val = !!cp->param[0];
4850         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4851
4852         if (!hdev->get_data_path_id) {
4853                 return mgmt_cmd_status(sk, hdev->id,
4854                                        MGMT_OP_SET_EXP_FEATURE,
4855                                        MGMT_STATUS_NOT_SUPPORTED);
4856         }
4857
4858         if (changed) {
4859                 if (val)
4860                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4861                 else
4862                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4863         }
4864
4865         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4866                     val, changed);
4867
4868         memcpy(rp.uuid, offload_codecs_uuid, 16);
4869         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4870         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4871         err = mgmt_cmd_complete(sk, hdev->id,
4872                                 MGMT_OP_SET_EXP_FEATURE, 0,
4873                                 &rp, sizeof(rp));
4874
4875         if (changed)
4876                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4877
4878         return err;
4879 }
4880
4881 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4882                                           struct mgmt_cp_set_exp_feature *cp,
4883                                           u16 data_len)
4884 {
4885         bool val, changed;
4886         int err;
4887         struct mgmt_rp_set_exp_feature rp;
4888
4889         /* Command requires to use a valid controller index */
4890         if (!hdev)
4891                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4892                                        MGMT_OP_SET_EXP_FEATURE,
4893                                        MGMT_STATUS_INVALID_INDEX);
4894
4895         /* Parameters are limited to a single octet */
4896         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4897                 return mgmt_cmd_status(sk, hdev->id,
4898                                        MGMT_OP_SET_EXP_FEATURE,
4899                                        MGMT_STATUS_INVALID_PARAMS);
4900
4901         /* Only boolean on/off is supported */
4902         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4903                 return mgmt_cmd_status(sk, hdev->id,
4904                                        MGMT_OP_SET_EXP_FEATURE,
4905                                        MGMT_STATUS_INVALID_PARAMS);
4906
4907         val = !!cp->param[0];
4908         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4909
4910         if (!hci_dev_le_state_simultaneous(hdev)) {
4911                 return mgmt_cmd_status(sk, hdev->id,
4912                                        MGMT_OP_SET_EXP_FEATURE,
4913                                        MGMT_STATUS_NOT_SUPPORTED);
4914         }
4915
4916         if (changed) {
4917                 if (val)
4918                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4919                 else
4920                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4921         }
4922
4923         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4924                     val, changed);
4925
4926         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4927         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4928         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4929         err = mgmt_cmd_complete(sk, hdev->id,
4930                                 MGMT_OP_SET_EXP_FEATURE, 0,
4931                                 &rp, sizeof(rp));
4932
4933         if (changed)
4934                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4935
4936         return err;
4937 }
4938
4939 #ifdef CONFIG_BT_LE
4940 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4941                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4942 {
4943         struct mgmt_rp_set_exp_feature rp;
4944         bool val, changed = false;
4945         int err;
4946
4947         /* Command requires to use the non-controller index */
4948         if (hdev)
4949                 return mgmt_cmd_status(sk, hdev->id,
4950                                        MGMT_OP_SET_EXP_FEATURE,
4951                                        MGMT_STATUS_INVALID_INDEX);
4952
4953         /* Parameters are limited to a single octet */
4954         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4955                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4956                                        MGMT_OP_SET_EXP_FEATURE,
4957                                        MGMT_STATUS_INVALID_PARAMS);
4958
4959         /* Only boolean on/off is supported */
4960         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4961                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4962                                        MGMT_OP_SET_EXP_FEATURE,
4963                                        MGMT_STATUS_INVALID_PARAMS);
4964
4965         val = cp->param[0] ? true : false;
4966         if (val)
4967                 err = iso_init();
4968         else
4969                 err = iso_exit();
4970
4971         if (!err)
4972                 changed = true;
4973
4974         memcpy(rp.uuid, iso_socket_uuid, 16);
4975         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4976
4977         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4978
4979         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4980                                 MGMT_OP_SET_EXP_FEATURE, 0,
4981                                 &rp, sizeof(rp));
4982
4983         if (changed)
4984                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4985
4986         return err;
4987 }
4988 #endif
4989
4990 static const struct mgmt_exp_feature {
4991         const u8 *uuid;
4992         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4993                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4994 } exp_features[] = {
4995         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4996 #ifdef CONFIG_BT_FEATURE_DEBUG
4997         EXP_FEAT(debug_uuid, set_debug_func),
4998 #endif
4999         EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
5000         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
5001         EXP_FEAT(quality_report_uuid, set_quality_report_func),
5002         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
5003         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
5004 #ifdef CONFIG_BT_LE
5005         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
5006 #endif
5007
5008         /* end with a null feature */
5009         EXP_FEAT(NULL, NULL)
5010 };
5011
5012 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5013                            void *data, u16 data_len)
5014 {
5015         struct mgmt_cp_set_exp_feature *cp = data;
5016         size_t i = 0;
5017
5018         bt_dev_dbg(hdev, "sock %p", sk);
5019
5020         for (i = 0; exp_features[i].uuid; i++) {
5021                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5022                         return exp_features[i].set_func(sk, hdev, cp, data_len);
5023         }
5024
5025         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5026                                MGMT_OP_SET_EXP_FEATURE,
5027                                MGMT_STATUS_NOT_SUPPORTED);
5028 }
5029
5030 static u32 get_params_flags(struct hci_dev *hdev,
5031                             struct hci_conn_params *params)
5032 {
5033         u32 flags = hdev->conn_flags;
5034
5035         /* Devices using RPAs can only be programmed in the acceptlist if
5036          * LL Privacy has been enable otherwise they cannot mark
5037          * HCI_CONN_FLAG_REMOTE_WAKEUP.
5038          */
5039         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
5040             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
5041                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
5042
5043         return flags;
5044 }
5045
5046 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5047                             u16 data_len)
5048 {
5049         struct mgmt_cp_get_device_flags *cp = data;
5050         struct mgmt_rp_get_device_flags rp;
5051         struct bdaddr_list_with_flags *br_params;
5052         struct hci_conn_params *params;
5053         u32 supported_flags;
5054         u32 current_flags = 0;
5055         u8 status = MGMT_STATUS_INVALID_PARAMS;
5056
5057         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5058                    &cp->addr.bdaddr, cp->addr.type);
5059
5060         hci_dev_lock(hdev);
5061
5062         supported_flags = hdev->conn_flags;
5063
5064         memset(&rp, 0, sizeof(rp));
5065
5066         if (cp->addr.type == BDADDR_BREDR) {
5067                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5068                                                               &cp->addr.bdaddr,
5069                                                               cp->addr.type);
5070                 if (!br_params)
5071                         goto done;
5072
5073                 current_flags = br_params->flags;
5074         } else {
5075                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5076                                                 le_addr_type(cp->addr.type));
5077                 if (!params)
5078                         goto done;
5079
5080                 supported_flags = get_params_flags(hdev, params);
5081                 current_flags = params->flags;
5082         }
5083
5084         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5085         rp.addr.type = cp->addr.type;
5086         rp.supported_flags = cpu_to_le32(supported_flags);
5087         rp.current_flags = cpu_to_le32(current_flags);
5088
5089         status = MGMT_STATUS_SUCCESS;
5090
5091 done:
5092         hci_dev_unlock(hdev);
5093
5094         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5095                                 &rp, sizeof(rp));
5096 }
5097
5098 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5099                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5100                                  u32 supported_flags, u32 current_flags)
5101 {
5102         struct mgmt_ev_device_flags_changed ev;
5103
5104         bacpy(&ev.addr.bdaddr, bdaddr);
5105         ev.addr.type = bdaddr_type;
5106         ev.supported_flags = cpu_to_le32(supported_flags);
5107         ev.current_flags = cpu_to_le32(current_flags);
5108
5109         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5110 }
5111
5112 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5113                             u16 len)
5114 {
5115         struct mgmt_cp_set_device_flags *cp = data;
5116         struct bdaddr_list_with_flags *br_params;
5117         struct hci_conn_params *params;
5118         u8 status = MGMT_STATUS_INVALID_PARAMS;
5119         u32 supported_flags;
5120         u32 current_flags = __le32_to_cpu(cp->current_flags);
5121
5122         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5123                    &cp->addr.bdaddr, cp->addr.type, current_flags);
5124
5125         // We should take hci_dev_lock() early, I think.. conn_flags can change
5126         supported_flags = hdev->conn_flags;
5127
5128         if ((supported_flags | current_flags) != supported_flags) {
5129                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5130                             current_flags, supported_flags);
5131                 goto done;
5132         }
5133
5134         hci_dev_lock(hdev);
5135
5136         if (cp->addr.type == BDADDR_BREDR) {
5137                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5138                                                               &cp->addr.bdaddr,
5139                                                               cp->addr.type);
5140
5141                 if (br_params) {
5142                         br_params->flags = current_flags;
5143                         status = MGMT_STATUS_SUCCESS;
5144                 } else {
5145                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5146                                     &cp->addr.bdaddr, cp->addr.type);
5147                 }
5148
5149                 goto unlock;
5150         }
5151
5152         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5153                                         le_addr_type(cp->addr.type));
5154         if (!params) {
5155                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5156                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5157                 goto unlock;
5158         }
5159
5160         supported_flags = get_params_flags(hdev, params);
5161
5162         if ((supported_flags | current_flags) != supported_flags) {
5163                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5164                             current_flags, supported_flags);
5165                 goto unlock;
5166         }
5167
5168         params->flags = current_flags;
5169         status = MGMT_STATUS_SUCCESS;
5170
5171         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5172          * has been set.
5173          */
5174         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5175                 hci_update_passive_scan(hdev);
5176
5177 unlock:
5178         hci_dev_unlock(hdev);
5179
5180 done:
5181         if (status == MGMT_STATUS_SUCCESS)
5182                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5183                                      supported_flags, current_flags);
5184
5185         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5186                                  &cp->addr, sizeof(cp->addr));
5187 }
5188
5189 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5190                                    u16 handle)
5191 {
5192         struct mgmt_ev_adv_monitor_added ev;
5193
5194         ev.monitor_handle = cpu_to_le16(handle);
5195
5196         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5197 }
5198
5199 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
5200 {
5201         struct mgmt_ev_adv_monitor_removed ev;
5202         struct mgmt_pending_cmd *cmd;
5203         struct sock *sk_skip = NULL;
5204         struct mgmt_cp_remove_adv_monitor *cp;
5205
5206         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5207         if (cmd) {
5208                 cp = cmd->param;
5209
5210                 if (cp->monitor_handle)
5211                         sk_skip = cmd->sk;
5212         }
5213
5214         ev.monitor_handle = cpu_to_le16(handle);
5215
5216         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
5217 }
5218
5219 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5220                                  void *data, u16 len)
5221 {
5222         struct adv_monitor *monitor = NULL;
5223         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5224         int handle, err;
5225         size_t rp_size = 0;
5226         __u32 supported = 0;
5227         __u32 enabled = 0;
5228         __u16 num_handles = 0;
5229         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5230
5231         BT_DBG("request for %s", hdev->name);
5232
5233         hci_dev_lock(hdev);
5234
5235         if (msft_monitor_supported(hdev))
5236                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5237
5238         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5239                 handles[num_handles++] = monitor->handle;
5240
5241         hci_dev_unlock(hdev);
5242
5243         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5244         rp = kmalloc(rp_size, GFP_KERNEL);
5245         if (!rp)
5246                 return -ENOMEM;
5247
5248         /* All supported features are currently enabled */
5249         enabled = supported;
5250
5251         rp->supported_features = cpu_to_le32(supported);
5252         rp->enabled_features = cpu_to_le32(enabled);
5253         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5254         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5255         rp->num_handles = cpu_to_le16(num_handles);
5256         if (num_handles)
5257                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5258
5259         err = mgmt_cmd_complete(sk, hdev->id,
5260                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5261                                 MGMT_STATUS_SUCCESS, rp, rp_size);
5262
5263         kfree(rp);
5264
5265         return err;
5266 }
5267
5268 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5269                                                    void *data, int status)
5270 {
5271         struct mgmt_rp_add_adv_patterns_monitor rp;
5272         struct mgmt_pending_cmd *cmd = data;
5273         struct adv_monitor *monitor = cmd->user_data;
5274
5275         hci_dev_lock(hdev);
5276
5277         rp.monitor_handle = cpu_to_le16(monitor->handle);
5278
5279         if (!status) {
5280                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5281                 hdev->adv_monitors_cnt++;
5282                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5283                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
5284                 hci_update_passive_scan(hdev);
5285         }
5286
5287         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5288                           mgmt_status(status), &rp, sizeof(rp));
5289         mgmt_pending_remove(cmd);
5290
5291         hci_dev_unlock(hdev);
5292         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5293                    rp.monitor_handle, status);
5294 }
5295
5296 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5297 {
5298         struct mgmt_pending_cmd *cmd = data;
5299         struct adv_monitor *monitor = cmd->user_data;
5300
5301         return hci_add_adv_monitor(hdev, monitor);
5302 }
5303
5304 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5305                                       struct adv_monitor *m, u8 status,
5306                                       void *data, u16 len, u16 op)
5307 {
5308         struct mgmt_pending_cmd *cmd;
5309         int err;
5310
5311         hci_dev_lock(hdev);
5312
5313         if (status)
5314                 goto unlock;
5315
5316         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5317             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5318             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5319             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5320                 status = MGMT_STATUS_BUSY;
5321                 goto unlock;
5322         }
5323
5324         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5325         if (!cmd) {
5326                 status = MGMT_STATUS_NO_RESOURCES;
5327                 goto unlock;
5328         }
5329
5330         cmd->user_data = m;
5331         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5332                                  mgmt_add_adv_patterns_monitor_complete);
5333         if (err) {
5334                 if (err == -ENOMEM)
5335                         status = MGMT_STATUS_NO_RESOURCES;
5336                 else
5337                         status = MGMT_STATUS_FAILED;
5338
5339                 goto unlock;
5340         }
5341
5342         hci_dev_unlock(hdev);
5343
5344         return 0;
5345
5346 unlock:
5347         hci_free_adv_monitor(hdev, m);
5348         hci_dev_unlock(hdev);
5349         return mgmt_cmd_status(sk, hdev->id, op, status);
5350 }
5351
5352 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5353                                    struct mgmt_adv_rssi_thresholds *rssi)
5354 {
5355         if (rssi) {
5356                 m->rssi.low_threshold = rssi->low_threshold;
5357                 m->rssi.low_threshold_timeout =
5358                     __le16_to_cpu(rssi->low_threshold_timeout);
5359                 m->rssi.high_threshold = rssi->high_threshold;
5360                 m->rssi.high_threshold_timeout =
5361                     __le16_to_cpu(rssi->high_threshold_timeout);
5362                 m->rssi.sampling_period = rssi->sampling_period;
5363         } else {
5364                 /* Default values. These numbers are the least constricting
5365                  * parameters for MSFT API to work, so it behaves as if there
5366                  * are no rssi parameter to consider. May need to be changed
5367                  * if other API are to be supported.
5368                  */
5369                 m->rssi.low_threshold = -127;
5370                 m->rssi.low_threshold_timeout = 60;
5371                 m->rssi.high_threshold = -127;
5372                 m->rssi.high_threshold_timeout = 0;
5373                 m->rssi.sampling_period = 0;
5374         }
5375 }
5376
5377 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5378                                     struct mgmt_adv_pattern *patterns)
5379 {
5380         u8 offset = 0, length = 0;
5381         struct adv_pattern *p = NULL;
5382         int i;
5383
5384         for (i = 0; i < pattern_count; i++) {
5385                 offset = patterns[i].offset;
5386                 length = patterns[i].length;
5387                 if (offset >= HCI_MAX_AD_LENGTH ||
5388                     length > HCI_MAX_AD_LENGTH ||
5389                     (offset + length) > HCI_MAX_AD_LENGTH)
5390                         return MGMT_STATUS_INVALID_PARAMS;
5391
5392                 p = kmalloc(sizeof(*p), GFP_KERNEL);
5393                 if (!p)
5394                         return MGMT_STATUS_NO_RESOURCES;
5395
5396                 p->ad_type = patterns[i].ad_type;
5397                 p->offset = patterns[i].offset;
5398                 p->length = patterns[i].length;
5399                 memcpy(p->value, patterns[i].value, p->length);
5400
5401                 INIT_LIST_HEAD(&p->list);
5402                 list_add(&p->list, &m->patterns);
5403         }
5404
5405         return MGMT_STATUS_SUCCESS;
5406 }
5407
5408 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5409                                     void *data, u16 len)
5410 {
5411         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5412         struct adv_monitor *m = NULL;
5413         u8 status = MGMT_STATUS_SUCCESS;
5414         size_t expected_size = sizeof(*cp);
5415
5416         BT_DBG("request for %s", hdev->name);
5417
5418         if (len <= sizeof(*cp)) {
5419                 status = MGMT_STATUS_INVALID_PARAMS;
5420                 goto done;
5421         }
5422
5423         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5424         if (len != expected_size) {
5425                 status = MGMT_STATUS_INVALID_PARAMS;
5426                 goto done;
5427         }
5428
5429         m = kzalloc(sizeof(*m), GFP_KERNEL);
5430         if (!m) {
5431                 status = MGMT_STATUS_NO_RESOURCES;
5432                 goto done;
5433         }
5434
5435         INIT_LIST_HEAD(&m->patterns);
5436
5437         parse_adv_monitor_rssi(m, NULL);
5438         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5439
5440 done:
5441         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5442                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5443 }
5444
5445 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5446                                          void *data, u16 len)
5447 {
5448         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5449         struct adv_monitor *m = NULL;
5450         u8 status = MGMT_STATUS_SUCCESS;
5451         size_t expected_size = sizeof(*cp);
5452
5453         BT_DBG("request for %s", hdev->name);
5454
5455         if (len <= sizeof(*cp)) {
5456                 status = MGMT_STATUS_INVALID_PARAMS;
5457                 goto done;
5458         }
5459
5460         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5461         if (len != expected_size) {
5462                 status = MGMT_STATUS_INVALID_PARAMS;
5463                 goto done;
5464         }
5465
5466         m = kzalloc(sizeof(*m), GFP_KERNEL);
5467         if (!m) {
5468                 status = MGMT_STATUS_NO_RESOURCES;
5469                 goto done;
5470         }
5471
5472         INIT_LIST_HEAD(&m->patterns);
5473
5474         parse_adv_monitor_rssi(m, &cp->rssi);
5475         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5476
5477 done:
5478         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5479                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5480 }
5481
5482 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5483                                              void *data, int status)
5484 {
5485         struct mgmt_rp_remove_adv_monitor rp;
5486         struct mgmt_pending_cmd *cmd = data;
5487         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5488
5489         hci_dev_lock(hdev);
5490
5491         rp.monitor_handle = cp->monitor_handle;
5492
5493         if (!status)
5494                 hci_update_passive_scan(hdev);
5495
5496         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5497                           mgmt_status(status), &rp, sizeof(rp));
5498         mgmt_pending_remove(cmd);
5499
5500         hci_dev_unlock(hdev);
5501         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5502                    rp.monitor_handle, status);
5503 }
5504
5505 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5506 {
5507         struct mgmt_pending_cmd *cmd = data;
5508         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5509         u16 handle = __le16_to_cpu(cp->monitor_handle);
5510
5511         if (!handle)
5512                 return hci_remove_all_adv_monitor(hdev);
5513
5514         return hci_remove_single_adv_monitor(hdev, handle);
5515 }
5516
5517 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5518                               void *data, u16 len)
5519 {
5520         struct mgmt_pending_cmd *cmd;
5521         int err, status;
5522
5523         hci_dev_lock(hdev);
5524
5525         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5526             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5527             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5528             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5529                 status = MGMT_STATUS_BUSY;
5530                 goto unlock;
5531         }
5532
5533         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5534         if (!cmd) {
5535                 status = MGMT_STATUS_NO_RESOURCES;
5536                 goto unlock;
5537         }
5538
5539         err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
5540                                  mgmt_remove_adv_monitor_complete);
5541
5542         if (err) {
5543                 mgmt_pending_remove(cmd);
5544
5545                 if (err == -ENOMEM)
5546                         status = MGMT_STATUS_NO_RESOURCES;
5547                 else
5548                         status = MGMT_STATUS_FAILED;
5549
5550                 goto unlock;
5551         }
5552
5553         hci_dev_unlock(hdev);
5554
5555         return 0;
5556
5557 unlock:
5558         hci_dev_unlock(hdev);
5559         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5560                                status);
5561 }
5562
5563 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5564 {
5565         struct mgmt_rp_read_local_oob_data mgmt_rp;
5566         size_t rp_size = sizeof(mgmt_rp);
5567         struct mgmt_pending_cmd *cmd = data;
5568         struct sk_buff *skb = cmd->skb;
5569         u8 status = mgmt_status(err);
5570
5571         if (!status) {
5572                 if (!skb)
5573                         status = MGMT_STATUS_FAILED;
5574                 else if (IS_ERR(skb))
5575                         status = mgmt_status(PTR_ERR(skb));
5576                 else
5577                         status = mgmt_status(skb->data[0]);
5578         }
5579
5580         bt_dev_dbg(hdev, "status %d", status);
5581
5582         if (status) {
5583                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5584                 goto remove;
5585         }
5586
5587         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5588
5589         if (!bredr_sc_enabled(hdev)) {
5590                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5591
5592                 if (skb->len < sizeof(*rp)) {
5593                         mgmt_cmd_status(cmd->sk, hdev->id,
5594                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5595                                         MGMT_STATUS_FAILED);
5596                         goto remove;
5597                 }
5598
5599                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5600                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5601
5602                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5603         } else {
5604                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5605
5606                 if (skb->len < sizeof(*rp)) {
5607                         mgmt_cmd_status(cmd->sk, hdev->id,
5608                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5609                                         MGMT_STATUS_FAILED);
5610                         goto remove;
5611                 }
5612
5613                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5614                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5615
5616                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5617                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5618         }
5619
5620         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5621                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5622
5623 remove:
5624         if (skb && !IS_ERR(skb))
5625                 kfree_skb(skb);
5626
5627         mgmt_pending_free(cmd);
5628 }
5629
5630 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5631 {
5632         struct mgmt_pending_cmd *cmd = data;
5633
5634         if (bredr_sc_enabled(hdev))
5635                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5636         else
5637                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5638
5639         if (IS_ERR(cmd->skb))
5640                 return PTR_ERR(cmd->skb);
5641         else
5642                 return 0;
5643 }
5644
5645 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5646                                void *data, u16 data_len)
5647 {
5648         struct mgmt_pending_cmd *cmd;
5649         int err;
5650
5651         bt_dev_dbg(hdev, "sock %p", sk);
5652
5653         hci_dev_lock(hdev);
5654
5655         if (!hdev_is_powered(hdev)) {
5656                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5657                                       MGMT_STATUS_NOT_POWERED);
5658                 goto unlock;
5659         }
5660
5661         if (!lmp_ssp_capable(hdev)) {
5662                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5663                                       MGMT_STATUS_NOT_SUPPORTED);
5664                 goto unlock;
5665         }
5666
5667         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5668         if (!cmd)
5669                 err = -ENOMEM;
5670         else
5671                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5672                                          read_local_oob_data_complete);
5673
5674         if (err < 0) {
5675                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5676                                       MGMT_STATUS_FAILED);
5677
5678                 if (cmd)
5679                         mgmt_pending_free(cmd);
5680         }
5681
5682 unlock:
5683         hci_dev_unlock(hdev);
5684         return err;
5685 }
5686
5687 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5688                                void *data, u16 len)
5689 {
5690         struct mgmt_addr_info *addr = data;
5691         int err;
5692
5693         bt_dev_dbg(hdev, "sock %p", sk);
5694
5695         if (!bdaddr_type_is_valid(addr->type))
5696                 return mgmt_cmd_complete(sk, hdev->id,
5697                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5698                                          MGMT_STATUS_INVALID_PARAMS,
5699                                          addr, sizeof(*addr));
5700
5701         hci_dev_lock(hdev);
5702
5703         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5704                 struct mgmt_cp_add_remote_oob_data *cp = data;
5705                 u8 status;
5706
5707                 if (cp->addr.type != BDADDR_BREDR) {
5708                         err = mgmt_cmd_complete(sk, hdev->id,
5709                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5710                                                 MGMT_STATUS_INVALID_PARAMS,
5711                                                 &cp->addr, sizeof(cp->addr));
5712                         goto unlock;
5713                 }
5714
5715                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5716                                               cp->addr.type, cp->hash,
5717                                               cp->rand, NULL, NULL);
5718                 if (err < 0)
5719                         status = MGMT_STATUS_FAILED;
5720                 else
5721                         status = MGMT_STATUS_SUCCESS;
5722
5723                 err = mgmt_cmd_complete(sk, hdev->id,
5724                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5725                                         &cp->addr, sizeof(cp->addr));
5726         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5727                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5728                 u8 *rand192, *hash192, *rand256, *hash256;
5729                 u8 status;
5730
5731                 if (bdaddr_type_is_le(cp->addr.type)) {
5732                         /* Enforce zero-valued 192-bit parameters as
5733                          * long as legacy SMP OOB isn't implemented.
5734                          */
5735                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5736                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5737                                 err = mgmt_cmd_complete(sk, hdev->id,
5738                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5739                                                         MGMT_STATUS_INVALID_PARAMS,
5740                                                         addr, sizeof(*addr));
5741                                 goto unlock;
5742                         }
5743
5744                         rand192 = NULL;
5745                         hash192 = NULL;
5746                 } else {
5747                         /* In case one of the P-192 values is set to zero,
5748                          * then just disable OOB data for P-192.
5749                          */
5750                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5751                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5752                                 rand192 = NULL;
5753                                 hash192 = NULL;
5754                         } else {
5755                                 rand192 = cp->rand192;
5756                                 hash192 = cp->hash192;
5757                         }
5758                 }
5759
5760                 /* In case one of the P-256 values is set to zero, then just
5761                  * disable OOB data for P-256.
5762                  */
5763                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5764                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5765                         rand256 = NULL;
5766                         hash256 = NULL;
5767                 } else {
5768                         rand256 = cp->rand256;
5769                         hash256 = cp->hash256;
5770                 }
5771
5772                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5773                                               cp->addr.type, hash192, rand192,
5774                                               hash256, rand256);
5775                 if (err < 0)
5776                         status = MGMT_STATUS_FAILED;
5777                 else
5778                         status = MGMT_STATUS_SUCCESS;
5779
5780                 err = mgmt_cmd_complete(sk, hdev->id,
5781                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5782                                         status, &cp->addr, sizeof(cp->addr));
5783         } else {
5784                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5785                            len);
5786                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5787                                       MGMT_STATUS_INVALID_PARAMS);
5788         }
5789
5790 unlock:
5791         hci_dev_unlock(hdev);
5792         return err;
5793 }
5794
5795 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5796                                   void *data, u16 len)
5797 {
5798         struct mgmt_cp_remove_remote_oob_data *cp = data;
5799         u8 status;
5800         int err;
5801
5802         bt_dev_dbg(hdev, "sock %p", sk);
5803
5804         if (cp->addr.type != BDADDR_BREDR)
5805                 return mgmt_cmd_complete(sk, hdev->id,
5806                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5807                                          MGMT_STATUS_INVALID_PARAMS,
5808                                          &cp->addr, sizeof(cp->addr));
5809
5810         hci_dev_lock(hdev);
5811
5812         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5813                 hci_remote_oob_data_clear(hdev);
5814                 status = MGMT_STATUS_SUCCESS;
5815                 goto done;
5816         }
5817
5818         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5819         if (err < 0)
5820                 status = MGMT_STATUS_INVALID_PARAMS;
5821         else
5822                 status = MGMT_STATUS_SUCCESS;
5823
5824 done:
5825         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5826                                 status, &cp->addr, sizeof(cp->addr));
5827
5828         hci_dev_unlock(hdev);
5829         return err;
5830 }
5831
5832 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5833 {
5834         struct mgmt_pending_cmd *cmd;
5835
5836         bt_dev_dbg(hdev, "status %u", status);
5837
5838         hci_dev_lock(hdev);
5839
5840         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5841         if (!cmd)
5842                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5843
5844         if (!cmd)
5845                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5846
5847         if (cmd) {
5848                 cmd->cmd_complete(cmd, mgmt_status(status));
5849                 mgmt_pending_remove(cmd);
5850         }
5851
5852         hci_dev_unlock(hdev);
5853 }
5854
5855 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5856                                     uint8_t *mgmt_status)
5857 {
5858         switch (type) {
5859         case DISCOV_TYPE_LE:
5860                 *mgmt_status = mgmt_le_support(hdev);
5861                 if (*mgmt_status)
5862                         return false;
5863                 break;
5864         case DISCOV_TYPE_INTERLEAVED:
5865                 *mgmt_status = mgmt_le_support(hdev);
5866                 if (*mgmt_status)
5867                         return false;
5868                 fallthrough;
5869         case DISCOV_TYPE_BREDR:
5870                 *mgmt_status = mgmt_bredr_support(hdev);
5871                 if (*mgmt_status)
5872                         return false;
5873                 break;
5874         default:
5875                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5876                 return false;
5877         }
5878
5879         return true;
5880 }
5881
5882 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5883 {
5884         struct mgmt_pending_cmd *cmd = data;
5885
5886         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5887             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5888             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5889                 return;
5890
5891         bt_dev_dbg(hdev, "err %d", err);
5892
5893         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5894                           cmd->param, 1);
5895         mgmt_pending_remove(cmd);
5896
5897         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5898                                 DISCOVERY_FINDING);
5899 }
5900
5901 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5902 {
5903         return hci_start_discovery_sync(hdev);
5904 }
5905
5906 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5907                                     u16 op, void *data, u16 len)
5908 {
5909         struct mgmt_cp_start_discovery *cp = data;
5910         struct mgmt_pending_cmd *cmd;
5911         u8 status;
5912         int err;
5913
5914         bt_dev_dbg(hdev, "sock %p", sk);
5915
5916         hci_dev_lock(hdev);
5917
5918         if (!hdev_is_powered(hdev)) {
5919                 err = mgmt_cmd_complete(sk, hdev->id, op,
5920                                         MGMT_STATUS_NOT_POWERED,
5921                                         &cp->type, sizeof(cp->type));
5922                 goto failed;
5923         }
5924
5925         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5926             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5927                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5928                                         &cp->type, sizeof(cp->type));
5929                 goto failed;
5930         }
5931
5932         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5933                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5934                                         &cp->type, sizeof(cp->type));
5935                 goto failed;
5936         }
5937
5938         /* Can't start discovery when it is paused */
5939         if (hdev->discovery_paused) {
5940                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5941                                         &cp->type, sizeof(cp->type));
5942                 goto failed;
5943         }
5944
5945         /* Clear the discovery filter first to free any previously
5946          * allocated memory for the UUID list.
5947          */
5948         hci_discovery_filter_clear(hdev);
5949
5950         hdev->discovery.type = cp->type;
5951         hdev->discovery.report_invalid_rssi = false;
5952         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5953                 hdev->discovery.limited = true;
5954         else
5955                 hdev->discovery.limited = false;
5956
5957         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5958         if (!cmd) {
5959                 err = -ENOMEM;
5960                 goto failed;
5961         }
5962
5963         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5964                                  start_discovery_complete);
5965         if (err < 0) {
5966                 mgmt_pending_remove(cmd);
5967                 goto failed;
5968         }
5969
5970         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5971
5972 failed:
5973         hci_dev_unlock(hdev);
5974         return err;
5975 }
5976
5977 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5978                            void *data, u16 len)
5979 {
5980         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5981                                         data, len);
5982 }
5983
5984 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5985                                    void *data, u16 len)
5986 {
5987         return start_discovery_internal(sk, hdev,
5988                                         MGMT_OP_START_LIMITED_DISCOVERY,
5989                                         data, len);
5990 }
5991
5992 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5993                                    void *data, u16 len)
5994 {
5995         struct mgmt_cp_start_service_discovery *cp = data;
5996         struct mgmt_pending_cmd *cmd;
5997         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5998         u16 uuid_count, expected_len;
5999         u8 status;
6000         int err;
6001
6002         bt_dev_dbg(hdev, "sock %p", sk);
6003
6004         hci_dev_lock(hdev);
6005
6006         if (!hdev_is_powered(hdev)) {
6007                 err = mgmt_cmd_complete(sk, hdev->id,
6008                                         MGMT_OP_START_SERVICE_DISCOVERY,
6009                                         MGMT_STATUS_NOT_POWERED,
6010                                         &cp->type, sizeof(cp->type));
6011                 goto failed;
6012         }
6013
6014         if (hdev->discovery.state != DISCOVERY_STOPPED ||
6015             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6016                 err = mgmt_cmd_complete(sk, hdev->id,
6017                                         MGMT_OP_START_SERVICE_DISCOVERY,
6018                                         MGMT_STATUS_BUSY, &cp->type,
6019                                         sizeof(cp->type));
6020                 goto failed;
6021         }
6022
6023         if (hdev->discovery_paused) {
6024                 err = mgmt_cmd_complete(sk, hdev->id,
6025                                         MGMT_OP_START_SERVICE_DISCOVERY,
6026                                         MGMT_STATUS_BUSY, &cp->type,
6027                                         sizeof(cp->type));
6028                 goto failed;
6029         }
6030
6031         uuid_count = __le16_to_cpu(cp->uuid_count);
6032         if (uuid_count > max_uuid_count) {
6033                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6034                            uuid_count);
6035                 err = mgmt_cmd_complete(sk, hdev->id,
6036                                         MGMT_OP_START_SERVICE_DISCOVERY,
6037                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6038                                         sizeof(cp->type));
6039                 goto failed;
6040         }
6041
6042         expected_len = sizeof(*cp) + uuid_count * 16;
6043         if (expected_len != len) {
6044                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6045                            expected_len, len);
6046                 err = mgmt_cmd_complete(sk, hdev->id,
6047                                         MGMT_OP_START_SERVICE_DISCOVERY,
6048                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6049                                         sizeof(cp->type));
6050                 goto failed;
6051         }
6052
6053         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6054                 err = mgmt_cmd_complete(sk, hdev->id,
6055                                         MGMT_OP_START_SERVICE_DISCOVERY,
6056                                         status, &cp->type, sizeof(cp->type));
6057                 goto failed;
6058         }
6059
6060         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6061                                hdev, data, len);
6062         if (!cmd) {
6063                 err = -ENOMEM;
6064                 goto failed;
6065         }
6066
6067         /* Clear the discovery filter first to free any previously
6068          * allocated memory for the UUID list.
6069          */
6070         hci_discovery_filter_clear(hdev);
6071
6072         hdev->discovery.result_filtering = true;
6073         hdev->discovery.type = cp->type;
6074         hdev->discovery.rssi = cp->rssi;
6075         hdev->discovery.uuid_count = uuid_count;
6076
6077         if (uuid_count > 0) {
6078                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6079                                                 GFP_KERNEL);
6080                 if (!hdev->discovery.uuids) {
6081                         err = mgmt_cmd_complete(sk, hdev->id,
6082                                                 MGMT_OP_START_SERVICE_DISCOVERY,
6083                                                 MGMT_STATUS_FAILED,
6084                                                 &cp->type, sizeof(cp->type));
6085                         mgmt_pending_remove(cmd);
6086                         goto failed;
6087                 }
6088         }
6089
6090         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6091                                  start_discovery_complete);
6092         if (err < 0) {
6093                 mgmt_pending_remove(cmd);
6094                 goto failed;
6095         }
6096
6097         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6098
6099 failed:
6100         hci_dev_unlock(hdev);
6101         return err;
6102 }
6103
6104 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
6105 {
6106         struct mgmt_pending_cmd *cmd;
6107
6108         bt_dev_dbg(hdev, "status %u", status);
6109
6110         hci_dev_lock(hdev);
6111
6112         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6113         if (cmd) {
6114                 cmd->cmd_complete(cmd, mgmt_status(status));
6115                 mgmt_pending_remove(cmd);
6116         }
6117
6118         hci_dev_unlock(hdev);
6119 }
6120
6121 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6122 {
6123         struct mgmt_pending_cmd *cmd = data;
6124
6125         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6126                 return;
6127
6128         bt_dev_dbg(hdev, "err %d", err);
6129
6130         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6131                           cmd->param, 1);
6132         mgmt_pending_remove(cmd);
6133
6134         if (!err)
6135                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6136 }
6137
6138 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6139 {
6140         return hci_stop_discovery_sync(hdev);
6141 }
6142
6143 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6144                           u16 len)
6145 {
6146         struct mgmt_cp_stop_discovery *mgmt_cp = data;
6147         struct mgmt_pending_cmd *cmd;
6148         int err;
6149
6150         bt_dev_dbg(hdev, "sock %p", sk);
6151
6152         hci_dev_lock(hdev);
6153
6154         if (!hci_discovery_active(hdev)) {
6155                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6156                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6157                                         sizeof(mgmt_cp->type));
6158                 goto unlock;
6159         }
6160
6161         if (hdev->discovery.type != mgmt_cp->type) {
6162                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6163                                         MGMT_STATUS_INVALID_PARAMS,
6164                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6165                 goto unlock;
6166         }
6167
6168         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6169         if (!cmd) {
6170                 err = -ENOMEM;
6171                 goto unlock;
6172         }
6173
6174         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6175                                  stop_discovery_complete);
6176         if (err < 0) {
6177                 mgmt_pending_remove(cmd);
6178                 goto unlock;
6179         }
6180
6181         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6182
6183 unlock:
6184         hci_dev_unlock(hdev);
6185         return err;
6186 }
6187
6188 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6189                         u16 len)
6190 {
6191         struct mgmt_cp_confirm_name *cp = data;
6192         struct inquiry_entry *e;
6193         int err;
6194
6195         bt_dev_dbg(hdev, "sock %p", sk);
6196
6197         hci_dev_lock(hdev);
6198
6199         if (!hci_discovery_active(hdev)) {
6200                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6201                                         MGMT_STATUS_FAILED, &cp->addr,
6202                                         sizeof(cp->addr));
6203                 goto failed;
6204         }
6205
6206         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6207         if (!e) {
6208                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6209                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6210                                         sizeof(cp->addr));
6211                 goto failed;
6212         }
6213
6214         if (cp->name_known) {
6215                 e->name_state = NAME_KNOWN;
6216                 list_del(&e->list);
6217         } else {
6218                 e->name_state = NAME_NEEDED;
6219                 hci_inquiry_cache_update_resolve(hdev, e);
6220         }
6221
6222         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6223                                 &cp->addr, sizeof(cp->addr));
6224
6225 failed:
6226         hci_dev_unlock(hdev);
6227         return err;
6228 }
6229
6230 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6231                         u16 len)
6232 {
6233         struct mgmt_cp_block_device *cp = data;
6234         u8 status;
6235         int err;
6236
6237         bt_dev_dbg(hdev, "sock %p", sk);
6238
6239         if (!bdaddr_type_is_valid(cp->addr.type))
6240                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6241                                          MGMT_STATUS_INVALID_PARAMS,
6242                                          &cp->addr, sizeof(cp->addr));
6243
6244         hci_dev_lock(hdev);
6245
6246         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6247                                   cp->addr.type);
6248         if (err < 0) {
6249                 status = MGMT_STATUS_FAILED;
6250                 goto done;
6251         }
6252
6253         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6254                    sk);
6255         status = MGMT_STATUS_SUCCESS;
6256
6257 done:
6258         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6259                                 &cp->addr, sizeof(cp->addr));
6260
6261         hci_dev_unlock(hdev);
6262
6263         return err;
6264 }
6265
6266 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6267                           u16 len)
6268 {
6269         struct mgmt_cp_unblock_device *cp = data;
6270         u8 status;
6271         int err;
6272
6273         bt_dev_dbg(hdev, "sock %p", sk);
6274
6275         if (!bdaddr_type_is_valid(cp->addr.type))
6276                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6277                                          MGMT_STATUS_INVALID_PARAMS,
6278                                          &cp->addr, sizeof(cp->addr));
6279
6280         hci_dev_lock(hdev);
6281
6282         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6283                                   cp->addr.type);
6284         if (err < 0) {
6285                 status = MGMT_STATUS_INVALID_PARAMS;
6286                 goto done;
6287         }
6288
6289         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6290                    sk);
6291         status = MGMT_STATUS_SUCCESS;
6292
6293 done:
6294         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6295                                 &cp->addr, sizeof(cp->addr));
6296
6297         hci_dev_unlock(hdev);
6298
6299         return err;
6300 }
6301
6302 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6303 {
6304         return hci_update_eir_sync(hdev);
6305 }
6306
6307 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6308                          u16 len)
6309 {
6310         struct mgmt_cp_set_device_id *cp = data;
6311         int err;
6312         __u16 source;
6313
6314         bt_dev_dbg(hdev, "sock %p", sk);
6315
6316         source = __le16_to_cpu(cp->source);
6317
6318         if (source > 0x0002)
6319                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6320                                        MGMT_STATUS_INVALID_PARAMS);
6321
6322         hci_dev_lock(hdev);
6323
6324         hdev->devid_source = source;
6325         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6326         hdev->devid_product = __le16_to_cpu(cp->product);
6327         hdev->devid_version = __le16_to_cpu(cp->version);
6328
6329         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6330                                 NULL, 0);
6331
6332         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6333
6334         hci_dev_unlock(hdev);
6335
6336         return err;
6337 }
6338
6339 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6340 {
6341         if (err)
6342                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6343         else
6344                 bt_dev_dbg(hdev, "status %d", err);
6345 }
6346
6347 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6348 {
6349         struct cmd_lookup match = { NULL, hdev };
6350         u8 instance;
6351         struct adv_info *adv_instance;
6352         u8 status = mgmt_status(err);
6353
6354         if (status) {
6355                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
6356                                      cmd_status_rsp, &status);
6357                 return;
6358         }
6359
6360         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6361                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6362         else
6363                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6364
6365         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6366                              &match);
6367
6368         new_settings(hdev, match.sk);
6369
6370         if (match.sk)
6371                 sock_put(match.sk);
6372
6373         /* If "Set Advertising" was just disabled and instance advertising was
6374          * set up earlier, then re-enable multi-instance advertising.
6375          */
6376         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6377             list_empty(&hdev->adv_instances))
6378                 return;
6379
6380         instance = hdev->cur_adv_instance;
6381         if (!instance) {
6382                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6383                                                         struct adv_info, list);
6384                 if (!adv_instance)
6385                         return;
6386
6387                 instance = adv_instance->instance;
6388         }
6389
6390         err = hci_schedule_adv_instance_sync(hdev, instance, true);
6391
6392         enable_advertising_instance(hdev, err);
6393 }
6394
6395 static int set_adv_sync(struct hci_dev *hdev, void *data)
6396 {
6397         struct mgmt_pending_cmd *cmd = data;
6398         struct mgmt_mode *cp = cmd->param;
6399         u8 val = !!cp->val;
6400
6401         if (cp->val == 0x02)
6402                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6403         else
6404                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6405
6406         cancel_adv_timeout(hdev);
6407
6408         if (val) {
6409                 /* Switch to instance "0" for the Set Advertising setting.
6410                  * We cannot use update_[adv|scan_rsp]_data() here as the
6411                  * HCI_ADVERTISING flag is not yet set.
6412                  */
6413                 hdev->cur_adv_instance = 0x00;
6414
6415                 if (ext_adv_capable(hdev)) {
6416                         hci_start_ext_adv_sync(hdev, 0x00);
6417                 } else {
6418                         hci_update_adv_data_sync(hdev, 0x00);
6419                         hci_update_scan_rsp_data_sync(hdev, 0x00);
6420                         hci_enable_advertising_sync(hdev);
6421                 }
6422         } else {
6423                 hci_disable_advertising_sync(hdev);
6424         }
6425
6426         return 0;
6427 }
6428
6429 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6430                            u16 len)
6431 {
6432         struct mgmt_mode *cp = data;
6433         struct mgmt_pending_cmd *cmd;
6434         u8 val, status;
6435         int err;
6436
6437         bt_dev_dbg(hdev, "sock %p", sk);
6438
6439         status = mgmt_le_support(hdev);
6440         if (status)
6441                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6442                                        status);
6443
6444         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6445                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6446                                        MGMT_STATUS_INVALID_PARAMS);
6447
6448         if (hdev->advertising_paused)
6449                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6450                                        MGMT_STATUS_BUSY);
6451
6452         hci_dev_lock(hdev);
6453
6454         val = !!cp->val;
6455
6456         /* The following conditions are ones which mean that we should
6457          * not do any HCI communication but directly send a mgmt
6458          * response to user space (after toggling the flag if
6459          * necessary).
6460          */
6461         if (!hdev_is_powered(hdev) ||
6462             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6463              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6464             hci_dev_test_flag(hdev, HCI_MESH) ||
6465             hci_conn_num(hdev, LE_LINK) > 0 ||
6466             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6467              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6468                 bool changed;
6469
6470                 if (cp->val) {
6471                         hdev->cur_adv_instance = 0x00;
6472                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6473                         if (cp->val == 0x02)
6474                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6475                         else
6476                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6477                 } else {
6478                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6479                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6480                 }
6481
6482                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6483                 if (err < 0)
6484                         goto unlock;
6485
6486                 if (changed)
6487                         err = new_settings(hdev, sk);
6488
6489                 goto unlock;
6490         }
6491
6492         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6493             pending_find(MGMT_OP_SET_LE, hdev)) {
6494                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6495                                       MGMT_STATUS_BUSY);
6496                 goto unlock;
6497         }
6498
6499         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6500         if (!cmd)
6501                 err = -ENOMEM;
6502         else
6503                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6504                                          set_advertising_complete);
6505
6506         if (err < 0 && cmd)
6507                 mgmt_pending_remove(cmd);
6508
6509 unlock:
6510         hci_dev_unlock(hdev);
6511         return err;
6512 }
6513
6514 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6515                               void *data, u16 len)
6516 {
6517         struct mgmt_cp_set_static_address *cp = data;
6518         int err;
6519
6520         bt_dev_dbg(hdev, "sock %p", sk);
6521
6522         if (!lmp_le_capable(hdev))
6523                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6524                                        MGMT_STATUS_NOT_SUPPORTED);
6525
6526         if (hdev_is_powered(hdev))
6527                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6528                                        MGMT_STATUS_REJECTED);
6529
6530         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6531                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6532                         return mgmt_cmd_status(sk, hdev->id,
6533                                                MGMT_OP_SET_STATIC_ADDRESS,
6534                                                MGMT_STATUS_INVALID_PARAMS);
6535
6536                 /* Two most significant bits shall be set */
6537                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6538                         return mgmt_cmd_status(sk, hdev->id,
6539                                                MGMT_OP_SET_STATIC_ADDRESS,
6540                                                MGMT_STATUS_INVALID_PARAMS);
6541         }
6542
6543         hci_dev_lock(hdev);
6544
6545         bacpy(&hdev->static_addr, &cp->bdaddr);
6546
6547         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6548         if (err < 0)
6549                 goto unlock;
6550
6551         err = new_settings(hdev, sk);
6552
6553 unlock:
6554         hci_dev_unlock(hdev);
6555         return err;
6556 }
6557
6558 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6559                            void *data, u16 len)
6560 {
6561         struct mgmt_cp_set_scan_params *cp = data;
6562         __u16 interval, window;
6563         int err;
6564
6565         bt_dev_dbg(hdev, "sock %p", sk);
6566
6567         if (!lmp_le_capable(hdev))
6568                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6569                                        MGMT_STATUS_NOT_SUPPORTED);
6570
6571         interval = __le16_to_cpu(cp->interval);
6572
6573         if (interval < 0x0004 || interval > 0x4000)
6574                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6575                                        MGMT_STATUS_INVALID_PARAMS);
6576
6577         window = __le16_to_cpu(cp->window);
6578
6579         if (window < 0x0004 || window > 0x4000)
6580                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6581                                        MGMT_STATUS_INVALID_PARAMS);
6582
6583         if (window > interval)
6584                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6585                                        MGMT_STATUS_INVALID_PARAMS);
6586
6587         hci_dev_lock(hdev);
6588
6589         hdev->le_scan_interval = interval;
6590         hdev->le_scan_window = window;
6591
6592         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6593                                 NULL, 0);
6594
6595         /* If background scan is running, restart it so new parameters are
6596          * loaded.
6597          */
6598         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6599             hdev->discovery.state == DISCOVERY_STOPPED)
6600                 hci_update_passive_scan(hdev);
6601
6602         hci_dev_unlock(hdev);
6603
6604         return err;
6605 }
6606
6607 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6608 {
6609         struct mgmt_pending_cmd *cmd = data;
6610
6611         bt_dev_dbg(hdev, "err %d", err);
6612
6613         if (err) {
6614                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6615                                 mgmt_status(err));
6616         } else {
6617                 struct mgmt_mode *cp = cmd->param;
6618
6619                 if (cp->val)
6620                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6621                 else
6622                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6623
6624                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6625                 new_settings(hdev, cmd->sk);
6626         }
6627
6628         mgmt_pending_free(cmd);
6629 }
6630
6631 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6632 {
6633         struct mgmt_pending_cmd *cmd = data;
6634         struct mgmt_mode *cp = cmd->param;
6635
6636         return hci_write_fast_connectable_sync(hdev, cp->val);
6637 }
6638
6639 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6640                                 void *data, u16 len)
6641 {
6642         struct mgmt_mode *cp = data;
6643         struct mgmt_pending_cmd *cmd;
6644         int err;
6645
6646         bt_dev_dbg(hdev, "sock %p", sk);
6647
6648         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6649             hdev->hci_ver < BLUETOOTH_VER_1_2)
6650                 return mgmt_cmd_status(sk, hdev->id,
6651                                        MGMT_OP_SET_FAST_CONNECTABLE,
6652                                        MGMT_STATUS_NOT_SUPPORTED);
6653
6654         if (cp->val != 0x00 && cp->val != 0x01)
6655                 return mgmt_cmd_status(sk, hdev->id,
6656                                        MGMT_OP_SET_FAST_CONNECTABLE,
6657                                        MGMT_STATUS_INVALID_PARAMS);
6658
6659         hci_dev_lock(hdev);
6660
6661         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6662                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6663                 goto unlock;
6664         }
6665
6666         if (!hdev_is_powered(hdev)) {
6667                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6668                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6669                 new_settings(hdev, sk);
6670                 goto unlock;
6671         }
6672
6673         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6674                                len);
6675         if (!cmd)
6676                 err = -ENOMEM;
6677         else
6678                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6679                                          fast_connectable_complete);
6680
6681         if (err < 0) {
6682                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6683                                 MGMT_STATUS_FAILED);
6684
6685                 if (cmd)
6686                         mgmt_pending_free(cmd);
6687         }
6688
6689 unlock:
6690         hci_dev_unlock(hdev);
6691
6692         return err;
6693 }
6694
6695 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6696 {
6697         struct mgmt_pending_cmd *cmd = data;
6698
6699         bt_dev_dbg(hdev, "err %d", err);
6700
6701         if (err) {
6702                 u8 mgmt_err = mgmt_status(err);
6703
6704                 /* We need to restore the flag if related HCI commands
6705                  * failed.
6706                  */
6707                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6708
6709                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6710         } else {
6711                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6712                 new_settings(hdev, cmd->sk);
6713         }
6714
6715         mgmt_pending_free(cmd);
6716 }
6717
6718 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6719 {
6720         int status;
6721
6722         status = hci_write_fast_connectable_sync(hdev, false);
6723
6724         if (!status)
6725                 status = hci_update_scan_sync(hdev);
6726
6727         /* Since only the advertising data flags will change, there
6728          * is no need to update the scan response data.
6729          */
6730         if (!status)
6731                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6732
6733         return status;
6734 }
6735
6736 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6737 {
6738         struct mgmt_mode *cp = data;
6739         struct mgmt_pending_cmd *cmd;
6740         int err;
6741
6742         bt_dev_dbg(hdev, "sock %p", sk);
6743
6744         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6745                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6746                                        MGMT_STATUS_NOT_SUPPORTED);
6747
6748         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6749                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6750                                        MGMT_STATUS_REJECTED);
6751
6752         if (cp->val != 0x00 && cp->val != 0x01)
6753                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6754                                        MGMT_STATUS_INVALID_PARAMS);
6755
6756         hci_dev_lock(hdev);
6757
6758         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6759                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6760                 goto unlock;
6761         }
6762
6763         if (!hdev_is_powered(hdev)) {
6764                 if (!cp->val) {
6765                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6766                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6767                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6768                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6769                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
6770                 }
6771
6772                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6773
6774                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6775                 if (err < 0)
6776                         goto unlock;
6777
6778                 err = new_settings(hdev, sk);
6779                 goto unlock;
6780         }
6781
6782         /* Reject disabling when powered on */
6783         if (!cp->val) {
6784                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6785                                       MGMT_STATUS_REJECTED);
6786                 goto unlock;
6787         } else {
6788                 /* When configuring a dual-mode controller to operate
6789                  * with LE only and using a static address, then switching
6790                  * BR/EDR back on is not allowed.
6791                  *
6792                  * Dual-mode controllers shall operate with the public
6793                  * address as its identity address for BR/EDR and LE. So
6794                  * reject the attempt to create an invalid configuration.
6795                  *
6796                  * The same restrictions applies when secure connections
6797                  * has been enabled. For BR/EDR this is a controller feature
6798                  * while for LE it is a host stack feature. This means that
6799                  * switching BR/EDR back on when secure connections has been
6800                  * enabled is not a supported transaction.
6801                  */
6802                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6803                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6804                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6805                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6806                                               MGMT_STATUS_REJECTED);
6807                         goto unlock;
6808                 }
6809         }
6810
6811         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6812         if (!cmd)
6813                 err = -ENOMEM;
6814         else
6815                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6816                                          set_bredr_complete);
6817
6818         if (err < 0) {
6819                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6820                                 MGMT_STATUS_FAILED);
6821                 if (cmd)
6822                         mgmt_pending_free(cmd);
6823
6824                 goto unlock;
6825         }
6826
6827         /* We need to flip the bit already here so that
6828          * hci_req_update_adv_data generates the correct flags.
6829          */
6830         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6831
6832 unlock:
6833         hci_dev_unlock(hdev);
6834         return err;
6835 }
6836
6837 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6838 {
6839         struct mgmt_pending_cmd *cmd = data;
6840         struct mgmt_mode *cp;
6841
6842         bt_dev_dbg(hdev, "err %d", err);
6843
6844         if (err) {
6845                 u8 mgmt_err = mgmt_status(err);
6846
6847                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6848                 goto done;
6849         }
6850
6851         cp = cmd->param;
6852
6853         switch (cp->val) {
6854         case 0x00:
6855                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6856                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6857                 break;
6858         case 0x01:
6859                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6860                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6861                 break;
6862         case 0x02:
6863                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6864                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6865                 break;
6866         }
6867
6868         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6869         new_settings(hdev, cmd->sk);
6870
6871 done:
6872         mgmt_pending_free(cmd);
6873 }
6874
6875 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6876 {
6877         struct mgmt_pending_cmd *cmd = data;
6878         struct mgmt_mode *cp = cmd->param;
6879         u8 val = !!cp->val;
6880
6881         /* Force write of val */
6882         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6883
6884         return hci_write_sc_support_sync(hdev, val);
6885 }
6886
6887 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6888                            void *data, u16 len)
6889 {
6890         struct mgmt_mode *cp = data;
6891         struct mgmt_pending_cmd *cmd;
6892         u8 val;
6893         int err;
6894
6895         bt_dev_dbg(hdev, "sock %p", sk);
6896
6897         if (!lmp_sc_capable(hdev) &&
6898             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6899                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6900                                        MGMT_STATUS_NOT_SUPPORTED);
6901
6902         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6903             lmp_sc_capable(hdev) &&
6904             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6905                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6906                                        MGMT_STATUS_REJECTED);
6907
6908         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6909                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6910                                        MGMT_STATUS_INVALID_PARAMS);
6911
6912         hci_dev_lock(hdev);
6913
6914         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6915             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6916                 bool changed;
6917
6918                 if (cp->val) {
6919                         changed = !hci_dev_test_and_set_flag(hdev,
6920                                                              HCI_SC_ENABLED);
6921                         if (cp->val == 0x02)
6922                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6923                         else
6924                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6925                 } else {
6926                         changed = hci_dev_test_and_clear_flag(hdev,
6927                                                               HCI_SC_ENABLED);
6928                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6929                 }
6930
6931                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6932                 if (err < 0)
6933                         goto failed;
6934
6935                 if (changed)
6936                         err = new_settings(hdev, sk);
6937
6938                 goto failed;
6939         }
6940
6941         val = !!cp->val;
6942
6943         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6944             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6945                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6946                 goto failed;
6947         }
6948
6949         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6950         if (!cmd)
6951                 err = -ENOMEM;
6952         else
6953                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6954                                          set_secure_conn_complete);
6955
6956         if (err < 0) {
6957                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6958                                 MGMT_STATUS_FAILED);
6959                 if (cmd)
6960                         mgmt_pending_free(cmd);
6961         }
6962
6963 failed:
6964         hci_dev_unlock(hdev);
6965         return err;
6966 }
6967
6968 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6969                           void *data, u16 len)
6970 {
6971         struct mgmt_mode *cp = data;
6972         bool changed, use_changed;
6973         int err;
6974
6975         bt_dev_dbg(hdev, "sock %p", sk);
6976
6977         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6978                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6979                                        MGMT_STATUS_INVALID_PARAMS);
6980
6981         hci_dev_lock(hdev);
6982
6983         if (cp->val)
6984                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6985         else
6986                 changed = hci_dev_test_and_clear_flag(hdev,
6987                                                       HCI_KEEP_DEBUG_KEYS);
6988
6989         if (cp->val == 0x02)
6990                 use_changed = !hci_dev_test_and_set_flag(hdev,
6991                                                          HCI_USE_DEBUG_KEYS);
6992         else
6993                 use_changed = hci_dev_test_and_clear_flag(hdev,
6994                                                           HCI_USE_DEBUG_KEYS);
6995
6996         if (hdev_is_powered(hdev) && use_changed &&
6997             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6998                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6999                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
7000                              sizeof(mode), &mode);
7001         }
7002
7003         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
7004         if (err < 0)
7005                 goto unlock;
7006
7007         if (changed)
7008                 err = new_settings(hdev, sk);
7009
7010 unlock:
7011         hci_dev_unlock(hdev);
7012         return err;
7013 }
7014
7015 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7016                        u16 len)
7017 {
7018         struct mgmt_cp_set_privacy *cp = cp_data;
7019         bool changed;
7020         int err;
7021
7022         bt_dev_dbg(hdev, "sock %p", sk);
7023
7024         if (!lmp_le_capable(hdev))
7025                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7026                                        MGMT_STATUS_NOT_SUPPORTED);
7027
7028         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7029                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7030                                        MGMT_STATUS_INVALID_PARAMS);
7031
7032 #ifndef TIZEN_BT
7033         /* commenting out since set privacy command is always rejected
7034          * if this condition is enabled.
7035          */
7036         if (hdev_is_powered(hdev))
7037                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7038                                        MGMT_STATUS_REJECTED);
7039 #endif
7040
7041         hci_dev_lock(hdev);
7042
7043         /* If user space supports this command it is also expected to
7044          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7045          */
7046         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7047
7048         if (cp->privacy) {
7049                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7050                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7051                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7052                 hci_adv_instances_set_rpa_expired(hdev, true);
7053                 if (cp->privacy == 0x02)
7054                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7055                 else
7056                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7057         } else {
7058                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7059                 memset(hdev->irk, 0, sizeof(hdev->irk));
7060                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7061                 hci_adv_instances_set_rpa_expired(hdev, false);
7062                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7063         }
7064
7065         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7066         if (err < 0)
7067                 goto unlock;
7068
7069         if (changed)
7070                 err = new_settings(hdev, sk);
7071
7072 unlock:
7073         hci_dev_unlock(hdev);
7074         return err;
7075 }
7076
7077 static bool irk_is_valid(struct mgmt_irk_info *irk)
7078 {
7079         switch (irk->addr.type) {
7080         case BDADDR_LE_PUBLIC:
7081                 return true;
7082
7083         case BDADDR_LE_RANDOM:
7084                 /* Two most significant bits shall be set */
7085                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7086                         return false;
7087                 return true;
7088         }
7089
7090         return false;
7091 }
7092
7093 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7094                      u16 len)
7095 {
7096         struct mgmt_cp_load_irks *cp = cp_data;
7097         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7098                                    sizeof(struct mgmt_irk_info));
7099         u16 irk_count, expected_len;
7100         int i, err;
7101
7102         bt_dev_dbg(hdev, "sock %p", sk);
7103
7104         if (!lmp_le_capable(hdev))
7105                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7106                                        MGMT_STATUS_NOT_SUPPORTED);
7107
7108         irk_count = __le16_to_cpu(cp->irk_count);
7109         if (irk_count > max_irk_count) {
7110                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7111                            irk_count);
7112                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7113                                        MGMT_STATUS_INVALID_PARAMS);
7114         }
7115
7116         expected_len = struct_size(cp, irks, irk_count);
7117         if (expected_len != len) {
7118                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7119                            expected_len, len);
7120                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7121                                        MGMT_STATUS_INVALID_PARAMS);
7122         }
7123
7124         bt_dev_dbg(hdev, "irk_count %u", irk_count);
7125
7126         for (i = 0; i < irk_count; i++) {
7127                 struct mgmt_irk_info *key = &cp->irks[i];
7128
7129                 if (!irk_is_valid(key))
7130                         return mgmt_cmd_status(sk, hdev->id,
7131                                                MGMT_OP_LOAD_IRKS,
7132                                                MGMT_STATUS_INVALID_PARAMS);
7133         }
7134
7135         hci_dev_lock(hdev);
7136
7137         hci_smp_irks_clear(hdev);
7138
7139         for (i = 0; i < irk_count; i++) {
7140                 struct mgmt_irk_info *irk = &cp->irks[i];
7141
7142                 if (hci_is_blocked_key(hdev,
7143                                        HCI_BLOCKED_KEY_TYPE_IRK,
7144                                        irk->val)) {
7145                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7146                                     &irk->addr.bdaddr);
7147                         continue;
7148                 }
7149
7150                 hci_add_irk(hdev, &irk->addr.bdaddr,
7151                             le_addr_type(irk->addr.type), irk->val,
7152                             BDADDR_ANY);
7153         }
7154
7155         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7156
7157         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7158
7159         hci_dev_unlock(hdev);
7160
7161         return err;
7162 }
7163
7164 #ifdef TIZEN_BT
7165 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
7166                         void *data, u16 len)
7167 {
7168         struct mgmt_cp_set_advertising_params *cp = data;
7169         __u16 min_interval;
7170         __u16 max_interval;
7171         int err;
7172
7173         BT_DBG("%s", hdev->name);
7174
7175         if (!lmp_le_capable(hdev))
7176                 return mgmt_cmd_status(sk, hdev->id,
7177                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7178                                 MGMT_STATUS_NOT_SUPPORTED);
7179
7180         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7181                 return mgmt_cmd_status(sk, hdev->id,
7182                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7183                                 MGMT_STATUS_BUSY);
7184
7185         min_interval = __le16_to_cpu(cp->interval_min);
7186         max_interval = __le16_to_cpu(cp->interval_max);
7187
7188         if (min_interval > max_interval ||
7189             min_interval < 0x0020 || max_interval > 0x4000)
7190                 return mgmt_cmd_status(sk, hdev->id,
7191                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7192                                 MGMT_STATUS_INVALID_PARAMS);
7193
7194         hci_dev_lock(hdev);
7195
7196         hdev->le_adv_min_interval = min_interval;
7197         hdev->le_adv_max_interval = max_interval;
7198         hdev->adv_filter_policy = cp->filter_policy;
7199         hdev->adv_type = cp->type;
7200
7201         err = mgmt_cmd_complete(sk, hdev->id,
7202                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
7203
7204         hci_dev_unlock(hdev);
7205
7206         return err;
7207 }
7208
7209 static void set_advertising_data_complete(struct hci_dev *hdev,
7210                         u8 status, u16 opcode)
7211 {
7212         struct mgmt_cp_set_advertising_data *cp;
7213         struct mgmt_pending_cmd *cmd;
7214
7215         BT_DBG("status 0x%02x", status);
7216
7217         hci_dev_lock(hdev);
7218
7219         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
7220         if (!cmd)
7221                 goto unlock;
7222
7223         cp = cmd->param;
7224
7225         if (status)
7226                 mgmt_cmd_status(cmd->sk, hdev->id,
7227                                 MGMT_OP_SET_ADVERTISING_DATA,
7228                                 mgmt_status(status));
7229         else
7230                 mgmt_cmd_complete(cmd->sk, hdev->id,
7231                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
7232                                 cp, sizeof(*cp));
7233
7234         mgmt_pending_remove(cmd);
7235
7236 unlock:
7237         hci_dev_unlock(hdev);
7238 }
7239
7240 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
7241                         void *data, u16 len)
7242 {
7243         struct mgmt_pending_cmd *cmd;
7244         struct hci_request req;
7245         struct mgmt_cp_set_advertising_data *cp = data;
7246         struct hci_cp_le_set_adv_data adv;
7247         int err;
7248
7249         BT_DBG("%s", hdev->name);
7250
7251         if (!lmp_le_capable(hdev)) {
7252                 return mgmt_cmd_status(sk, hdev->id,
7253                                 MGMT_OP_SET_ADVERTISING_DATA,
7254                                 MGMT_STATUS_NOT_SUPPORTED);
7255         }
7256
7257         hci_dev_lock(hdev);
7258
7259         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
7260                 err = mgmt_cmd_status(sk, hdev->id,
7261                                 MGMT_OP_SET_ADVERTISING_DATA,
7262                                 MGMT_STATUS_BUSY);
7263                 goto unlocked;
7264         }
7265
7266         if (len > HCI_MAX_AD_LENGTH) {
7267                 err = mgmt_cmd_status(sk, hdev->id,
7268                                 MGMT_OP_SET_ADVERTISING_DATA,
7269                                 MGMT_STATUS_INVALID_PARAMS);
7270                 goto unlocked;
7271         }
7272
7273         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
7274                                hdev, data, len);
7275         if (!cmd) {
7276                 err = -ENOMEM;
7277                 goto unlocked;
7278         }
7279
7280         hci_req_init(&req, hdev);
7281
7282         memset(&adv, 0, sizeof(adv));
7283         memcpy(adv.data, cp->data, len);
7284         adv.length = len;
7285
7286         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
7287
7288         err = hci_req_run(&req, set_advertising_data_complete);
7289         if (err < 0)
7290                 mgmt_pending_remove(cmd);
7291
7292 unlocked:
7293         hci_dev_unlock(hdev);
7294
7295         return err;
7296 }
7297
7298 /* Adv White List feature */
7299 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7300 {
7301         struct mgmt_cp_add_dev_white_list *cp;
7302         struct mgmt_pending_cmd *cmd;
7303
7304         BT_DBG("status 0x%02x", status);
7305
7306         hci_dev_lock(hdev);
7307
7308         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
7309         if (!cmd)
7310                 goto unlock;
7311
7312         cp = cmd->param;
7313
7314         if (status)
7315                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7316                            mgmt_status(status));
7317         else
7318                 mgmt_cmd_complete(cmd->sk, hdev->id,
7319                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
7320
7321         mgmt_pending_remove(cmd);
7322
7323 unlock:
7324         hci_dev_unlock(hdev);
7325 }
7326
7327 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
7328                            void *data, u16 len)
7329 {
7330         struct mgmt_pending_cmd *cmd;
7331         struct mgmt_cp_add_dev_white_list *cp = data;
7332         struct hci_request req;
7333         int err;
7334
7335         BT_DBG("%s", hdev->name);
7336
7337         if (!lmp_le_capable(hdev))
7338                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7339                                   MGMT_STATUS_NOT_SUPPORTED);
7340
7341         if (!hdev_is_powered(hdev))
7342                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7343                                   MGMT_STATUS_REJECTED);
7344
7345         hci_dev_lock(hdev);
7346
7347         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
7348                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7349                                 MGMT_STATUS_BUSY);
7350                 goto unlocked;
7351         }
7352
7353         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
7354         if (!cmd) {
7355                 err = -ENOMEM;
7356                 goto unlocked;
7357         }
7358
7359         hci_req_init(&req, hdev);
7360
7361         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
7362
7363         err = hci_req_run(&req, add_white_list_complete);
7364         if (err < 0) {
7365                 mgmt_pending_remove(cmd);
7366                 goto unlocked;
7367         }
7368
7369 unlocked:
7370         hci_dev_unlock(hdev);
7371
7372         return err;
7373 }
7374
7375 static void remove_from_white_list_complete(struct hci_dev *hdev,
7376                         u8 status, u16 opcode)
7377 {
7378         struct mgmt_cp_remove_dev_from_white_list *cp;
7379         struct mgmt_pending_cmd *cmd;
7380
7381         BT_DBG("status 0x%02x", status);
7382
7383         hci_dev_lock(hdev);
7384
7385         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
7386         if (!cmd)
7387                 goto unlock;
7388
7389         cp = cmd->param;
7390
7391         if (status)
7392                 mgmt_cmd_status(cmd->sk, hdev->id,
7393                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7394                         mgmt_status(status));
7395         else
7396                 mgmt_cmd_complete(cmd->sk, hdev->id,
7397                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
7398                         cp, sizeof(*cp));
7399
7400         mgmt_pending_remove(cmd);
7401
7402 unlock:
7403         hci_dev_unlock(hdev);
7404 }
7405
7406 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
7407                            void *data, u16 len)
7408 {
7409         struct mgmt_pending_cmd *cmd;
7410         struct mgmt_cp_remove_dev_from_white_list *cp = data;
7411         struct hci_request req;
7412         int err;
7413
7414         BT_DBG("%s", hdev->name);
7415
7416         if (!lmp_le_capable(hdev))
7417                 return mgmt_cmd_status(sk, hdev->id,
7418                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7419                                 MGMT_STATUS_NOT_SUPPORTED);
7420
7421         if (!hdev_is_powered(hdev))
7422                 return mgmt_cmd_status(sk, hdev->id,
7423                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7424                                 MGMT_STATUS_REJECTED);
7425
7426         hci_dev_lock(hdev);
7427
7428         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
7429                 err = mgmt_cmd_status(sk, hdev->id,
7430                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7431                                 MGMT_STATUS_BUSY);
7432                 goto unlocked;
7433         }
7434
7435         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7436                                 hdev, data, len);
7437         if (!cmd) {
7438                 err = -ENOMEM;
7439                 goto unlocked;
7440         }
7441
7442         hci_req_init(&req, hdev);
7443
7444         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
7445
7446         err = hci_req_run(&req, remove_from_white_list_complete);
7447         if (err < 0) {
7448                 mgmt_pending_remove(cmd);
7449                 goto unlocked;
7450         }
7451
7452 unlocked:
7453         hci_dev_unlock(hdev);
7454
7455         return err;
7456 }
7457
7458 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
7459                         u16 opcode)
7460 {
7461         struct mgmt_pending_cmd *cmd;
7462
7463         BT_DBG("status 0x%02x", status);
7464
7465         hci_dev_lock(hdev);
7466
7467         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
7468         if (!cmd)
7469                 goto unlock;
7470
7471         if (status)
7472                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7473                            mgmt_status(status));
7474         else
7475                 mgmt_cmd_complete(cmd->sk, hdev->id,
7476                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7477                                 0, NULL, 0);
7478
7479         mgmt_pending_remove(cmd);
7480
7481 unlock:
7482         hci_dev_unlock(hdev);
7483 }
7484
7485 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
7486                            void *data, u16 len)
7487 {
7488         struct mgmt_pending_cmd *cmd;
7489         struct hci_request req;
7490         int err;
7491
7492         BT_DBG("%s", hdev->name);
7493
7494         if (!lmp_le_capable(hdev))
7495                 return mgmt_cmd_status(sk, hdev->id,
7496                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7497                                 MGMT_STATUS_NOT_SUPPORTED);
7498
7499         if (!hdev_is_powered(hdev))
7500                 return mgmt_cmd_status(sk, hdev->id,
7501                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7502                                 MGMT_STATUS_REJECTED);
7503
7504         hci_dev_lock(hdev);
7505
7506         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
7507                 err = mgmt_cmd_status(sk, hdev->id,
7508                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7509                                 MGMT_STATUS_BUSY);
7510                 goto unlocked;
7511         }
7512
7513         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7514                                 hdev, NULL, 0);
7515         if (!cmd) {
7516                 err = -ENOMEM;
7517                 goto unlocked;
7518         }
7519
7520         hci_req_init(&req, hdev);
7521
7522         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
7523
7524         err = hci_req_run(&req, clear_white_list_complete);
7525         if (err < 0) {
7526                 mgmt_pending_remove(cmd);
7527                 goto unlocked;
7528         }
7529
7530 unlocked:
7531         hci_dev_unlock(hdev);
7532
7533         return err;
7534 }
7535
7536 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
7537                         u16 opcode)
7538 {
7539         struct mgmt_cp_set_scan_rsp_data *cp;
7540         struct mgmt_pending_cmd *cmd;
7541
7542         BT_DBG("status 0x%02x", status);
7543
7544         hci_dev_lock(hdev);
7545
7546         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
7547         if (!cmd)
7548                 goto unlock;
7549
7550         cp = cmd->param;
7551
7552         if (status)
7553                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7554                                 mgmt_status(status));
7555         else
7556                 mgmt_cmd_complete(cmd->sk, hdev->id,
7557                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
7558                                 cp, sizeof(*cp));
7559
7560         mgmt_pending_remove(cmd);
7561
7562 unlock:
7563         hci_dev_unlock(hdev);
7564 }
7565
7566 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
7567                         u16 len)
7568 {
7569         struct mgmt_pending_cmd *cmd;
7570         struct hci_request req;
7571         struct mgmt_cp_set_scan_rsp_data *cp = data;
7572         struct hci_cp_le_set_scan_rsp_data rsp;
7573         int err;
7574
7575         BT_DBG("%s", hdev->name);
7576
7577         if (!lmp_le_capable(hdev))
7578                 return mgmt_cmd_status(sk, hdev->id,
7579                                 MGMT_OP_SET_SCAN_RSP_DATA,
7580                                 MGMT_STATUS_NOT_SUPPORTED);
7581
7582         hci_dev_lock(hdev);
7583
7584         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
7585                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7586                                 MGMT_STATUS_BUSY);
7587                 goto unlocked;
7588         }
7589
7590         if (len > HCI_MAX_AD_LENGTH) {
7591                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7592                                 MGMT_STATUS_INVALID_PARAMS);
7593                 goto unlocked;
7594         }
7595
7596         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
7597         if (!cmd) {
7598                 err = -ENOMEM;
7599                 goto unlocked;
7600         }
7601
7602         hci_req_init(&req, hdev);
7603
7604         memset(&rsp, 0, sizeof(rsp));
7605         memcpy(rsp.data, cp->data, len);
7606         rsp.length = len;
7607
7608         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
7609
7610         err = hci_req_run(&req, set_scan_rsp_data_complete);
7611         if (err < 0)
7612                 mgmt_pending_remove(cmd);
7613
7614 unlocked:
7615         hci_dev_unlock(hdev);
7616
7617         return err;
7618 }
7619
7620 static void set_rssi_threshold_complete(struct hci_dev *hdev,
7621                         u8 status, u16 opcode)
7622 {
7623         struct mgmt_pending_cmd *cmd;
7624
7625         BT_DBG("status 0x%02x", status);
7626
7627         hci_dev_lock(hdev);
7628
7629         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7630         if (!cmd)
7631                 goto unlock;
7632
7633         if (status)
7634                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7635                                 mgmt_status(status));
7636         else
7637                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7638                                 NULL, 0);
7639
7640         mgmt_pending_remove(cmd);
7641
7642 unlock:
7643         hci_dev_unlock(hdev);
7644 }
7645
7646 static void set_rssi_disable_complete(struct hci_dev *hdev,
7647                         u8 status, u16 opcode)
7648 {
7649         struct mgmt_pending_cmd *cmd;
7650
7651         BT_DBG("status 0x%02x", status);
7652
7653         hci_dev_lock(hdev);
7654
7655         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7656         if (!cmd)
7657                 goto unlock;
7658
7659         if (status)
7660                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7661                                 mgmt_status(status));
7662         else
7663                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7664                                 0, NULL, 0);
7665
7666         mgmt_pending_remove(cmd);
7667
7668 unlock:
7669         hci_dev_unlock(hdev);
7670 }
7671
7672 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
7673                 void *data, u16 len)
7674 {
7675         int err = 0;
7676         struct hci_cp_set_rssi_threshold th = { 0, };
7677         struct mgmt_cp_set_enable_rssi *cp = data;
7678         struct hci_conn *conn;
7679         struct mgmt_pending_cmd *cmd;
7680         struct hci_request req;
7681         __u8 dest_type;
7682
7683         hci_dev_lock(hdev);
7684
7685         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7686         if (!cmd) {
7687                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7688                                 MGMT_STATUS_FAILED);
7689                 goto unlocked;
7690         }
7691
7692         if (!lmp_le_capable(hdev)) {
7693                 mgmt_pending_remove(cmd);
7694                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7695                                 MGMT_STATUS_NOT_SUPPORTED);
7696                 goto unlocked;
7697         }
7698
7699         if (!hdev_is_powered(hdev)) {
7700                 BT_DBG("%s", hdev->name);
7701                 mgmt_pending_remove(cmd);
7702                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7703                                 MGMT_STATUS_NOT_POWERED);
7704                 goto unlocked;
7705         }
7706
7707         if (cp->link_type == 0x01)
7708                 dest_type = LE_LINK;
7709         else
7710                 dest_type = ACL_LINK;
7711
7712         /* Get LE/ACL link handle info */
7713         conn = hci_conn_hash_lookup_ba(hdev,
7714                         dest_type, &cp->bdaddr);
7715
7716         if (!conn) {
7717                 err = mgmt_cmd_complete(sk, hdev->id,
7718                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
7719                 mgmt_pending_remove(cmd);
7720                 goto unlocked;
7721         }
7722
7723         hci_req_init(&req, hdev);
7724
7725         th.hci_le_ext_opcode = 0x0B;
7726         th.mode = 0x01;
7727         th.conn_handle = conn->handle;
7728         th.alert_mask = 0x07;
7729         th.low_th = cp->low_th;
7730         th.in_range_th = cp->in_range_th;
7731         th.high_th = cp->high_th;
7732
7733         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7734         err = hci_req_run(&req, set_rssi_threshold_complete);
7735
7736         if (err < 0) {
7737                 mgmt_pending_remove(cmd);
7738                 BT_ERR("Error in requesting hci_req_run");
7739                 goto unlocked;
7740         }
7741
7742 unlocked:
7743         hci_dev_unlock(hdev);
7744         return err;
7745 }
7746
7747 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
7748                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7749 {
7750         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
7751         struct mgmt_cp_set_enable_rssi *cp = data;
7752         struct mgmt_pending_cmd *cmd;
7753
7754         if (!cp || !rp)
7755                 goto remove_cmd;
7756
7757         mgmt_rp.status = rp->status;
7758         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7759         mgmt_rp.bt_address = cp->bdaddr;
7760         mgmt_rp.link_type = cp->link_type;
7761
7762         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7763                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7764                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7765
7766         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
7767                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7768
7769         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
7770         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7771                         &mgmt_rp.bt_address, true);
7772
7773 remove_cmd:
7774         hci_dev_lock(hdev);
7775         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7776         if (cmd)
7777                 mgmt_pending_remove(cmd);
7778
7779         hci_dev_unlock(hdev);
7780 }
7781
7782 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
7783                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7784 {
7785         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
7786         struct mgmt_cp_disable_rssi *cp = data;
7787         struct mgmt_pending_cmd *cmd;
7788
7789         if (!cp || !rp)
7790                 goto remove_cmd;
7791
7792         mgmt_rp.status = rp->status;
7793         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7794         mgmt_rp.bt_address = cp->bdaddr;
7795         mgmt_rp.link_type = cp->link_type;
7796
7797         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7798                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7799                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7800
7801         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
7802                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7803
7804         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7805                         &mgmt_rp.bt_address, false);
7806
7807 remove_cmd:
7808         hci_dev_lock(hdev);
7809         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7810         if (cmd)
7811                 mgmt_pending_remove(cmd);
7812
7813         hci_dev_unlock(hdev);
7814 }
7815
7816 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
7817                 void *data, u16 len)
7818 {
7819         struct mgmt_pending_cmd *cmd;
7820         struct hci_request req;
7821         struct hci_cp_set_enable_rssi cp_en = { 0, };
7822         int err;
7823
7824         BT_DBG("Set Disable RSSI.");
7825
7826         cp_en.hci_le_ext_opcode = 0x01;
7827         cp_en.le_enable_cs_Features = 0x00;
7828         cp_en.data[0] = 0x00;
7829         cp_en.data[1] = 0x00;
7830         cp_en.data[2] = 0x00;
7831
7832         hci_dev_lock(hdev);
7833
7834         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7835         if (!cmd) {
7836                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7837                                 MGMT_STATUS_FAILED);
7838                 goto unlocked;
7839         }
7840
7841         if (!lmp_le_capable(hdev)) {
7842                 mgmt_pending_remove(cmd);
7843                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7844                                 MGMT_STATUS_NOT_SUPPORTED);
7845                 goto unlocked;
7846         }
7847
7848         if (!hdev_is_powered(hdev)) {
7849                 BT_DBG("%s", hdev->name);
7850                 mgmt_pending_remove(cmd);
7851                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7852                                 MGMT_STATUS_NOT_POWERED);
7853                 goto unlocked;
7854         }
7855
7856         hci_req_init(&req, hdev);
7857
7858         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7859                         sizeof(struct hci_cp_set_enable_rssi),
7860                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7861                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7862
7863         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7864         err = hci_req_run(&req, set_rssi_disable_complete);
7865
7866         if (err < 0) {
7867                 mgmt_pending_remove(cmd);
7868                 BT_ERR("Error in requesting hci_req_run");
7869                 goto unlocked;
7870         }
7871
7872 unlocked:
7873         hci_dev_unlock(hdev);
7874         return err;
7875 }
7876
7877 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
7878 {
7879         struct hci_cc_rsp_enable_rssi *rp = response;
7880         struct mgmt_pending_cmd *cmd_enable = NULL;
7881         struct mgmt_pending_cmd *cmd_disable = NULL;
7882         struct mgmt_cp_set_enable_rssi *cp_en;
7883         struct mgmt_cp_disable_rssi *cp_dis;
7884
7885         hci_dev_lock(hdev);
7886         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7887         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7888         hci_dev_unlock(hdev);
7889
7890         if (cmd_enable)
7891                 BT_DBG("Enable Request");
7892
7893         if (cmd_disable)
7894                 BT_DBG("Disable Request");
7895
7896         if (cmd_enable) {
7897                 cp_en = cmd_enable->param;
7898
7899                 if (status != 0x00)
7900                         return;
7901
7902                 switch (rp->le_ext_opcode) {
7903                 case 0x01:
7904                         BT_DBG("RSSI enabled.. Setting Threshold...");
7905                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
7906                                         cp_en, sizeof(*cp_en));
7907                         break;
7908
7909                 case 0x0B:
7910                         BT_DBG("Sending RSSI enable success");
7911                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
7912                                         cp_en, rp, rp->status);
7913                         break;
7914                 }
7915
7916         } else if (cmd_disable) {
7917                 cp_dis = cmd_disable->param;
7918
7919                 if (status != 0x00)
7920                         return;
7921
7922                 switch (rp->le_ext_opcode) {
7923                 case 0x01:
7924                         BT_DBG("Sending RSSI disable success");
7925                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7926                                         cp_dis, rp, rp->status);
7927                         break;
7928
7929                 case 0x0B:
7930                         /*
7931                          * Only unset RSSI Threshold values for the Link if
7932                          * RSSI is monitored for other BREDR or LE Links
7933                          */
7934                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
7935                                 BT_DBG("Unset Threshold. Other links being monitored");
7936                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7937                                                 cp_dis, rp, rp->status);
7938                         } else {
7939                                 BT_DBG("Unset Threshold. Disabling...");
7940                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
7941                                                 cp_dis, sizeof(*cp_dis));
7942                         }
7943                         break;
7944                 }
7945         }
7946 }
7947
7948 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
7949                 u16 opcode)
7950 {
7951         struct mgmt_pending_cmd *cmd;
7952
7953         BT_DBG("status 0x%02x", status);
7954
7955         hci_dev_lock(hdev);
7956
7957         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7958         if (!cmd)
7959                 goto unlock;
7960
7961         if (status)
7962                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7963                                 mgmt_status(status));
7964         else
7965                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7966                                 NULL, 0);
7967
7968         mgmt_pending_remove(cmd);
7969
7970 unlock:
7971         hci_dev_unlock(hdev);
7972 }
7973
7974 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7975                 void *data, u16 len)
7976 {
7977         struct mgmt_pending_cmd *cmd;
7978         struct hci_request req;
7979         struct mgmt_cp_set_enable_rssi *cp = data;
7980         struct hci_cp_set_enable_rssi cp_en = { 0, };
7981         int err;
7982
7983         BT_DBG("Set Enable RSSI.");
7984
7985         cp_en.hci_le_ext_opcode = 0x01;
7986         cp_en.le_enable_cs_Features = 0x04;
7987         cp_en.data[0] = 0x00;
7988         cp_en.data[1] = 0x00;
7989         cp_en.data[2] = 0x00;
7990
7991         hci_dev_lock(hdev);
7992
7993         if (!lmp_le_capable(hdev)) {
7994                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7995                                 MGMT_STATUS_NOT_SUPPORTED);
7996                 goto unlocked;
7997         }
7998
7999         if (!hdev_is_powered(hdev)) {
8000                 BT_DBG("%s", hdev->name);
8001                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
8002                                 MGMT_STATUS_NOT_POWERED);
8003                 goto unlocked;
8004         }
8005
8006         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
8007                 BT_DBG("%s", hdev->name);
8008                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
8009                                 MGMT_STATUS_BUSY);
8010                 goto unlocked;
8011         }
8012
8013         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
8014                         sizeof(*cp));
8015         if (!cmd) {
8016                 BT_DBG("%s", hdev->name);
8017                 err = -ENOMEM;
8018                 goto unlocked;
8019         }
8020
8021         /* If RSSI is already enabled directly set Threshold values */
8022         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
8023                 hci_dev_unlock(hdev);
8024                 BT_DBG("RSSI Enabled. Directly set Threshold");
8025                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
8026                 return err;
8027         }
8028
8029         hci_req_init(&req, hdev);
8030
8031         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
8032                         sizeof(struct hci_cp_set_enable_rssi),
8033                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
8034                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
8035
8036         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
8037         err = hci_req_run(&req, set_rssi_enable_complete);
8038
8039         if (err < 0) {
8040                 mgmt_pending_remove(cmd);
8041                 BT_ERR("Error in requesting hci_req_run");
8042                 goto unlocked;
8043         }
8044
8045 unlocked:
8046         hci_dev_unlock(hdev);
8047
8048         return err;
8049 }
8050
8051 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8052 {
8053         struct mgmt_pending_cmd *cmd;
8054
8055         BT_DBG("status 0x%02x", status);
8056
8057         hci_dev_lock(hdev);
8058
8059         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
8060         if (!cmd)
8061                 goto unlock;
8062
8063         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8064                         MGMT_STATUS_SUCCESS, &status, 1);
8065
8066         mgmt_pending_remove(cmd);
8067
8068 unlock:
8069         hci_dev_unlock(hdev);
8070 }
8071
8072 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
8073                         u16 len)
8074 {
8075         struct mgmt_pending_cmd *cmd;
8076         struct hci_request req;
8077         struct mgmt_cp_get_raw_rssi *cp = data;
8078         struct hci_cp_get_raw_rssi hci_cp;
8079
8080         struct hci_conn *conn;
8081         int err;
8082         __u8 dest_type;
8083
8084         BT_DBG("Get Raw RSSI.");
8085
8086         hci_dev_lock(hdev);
8087
8088         if (!lmp_le_capable(hdev)) {
8089                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8090                                 MGMT_STATUS_NOT_SUPPORTED);
8091                 goto unlocked;
8092         }
8093
8094         if (cp->link_type == 0x01)
8095                 dest_type = LE_LINK;
8096         else
8097                 dest_type = ACL_LINK;
8098
8099         /* Get LE/BREDR link handle info */
8100         conn = hci_conn_hash_lookup_ba(hdev,
8101                         dest_type, &cp->bt_address);
8102         if (!conn) {
8103                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8104                                                    MGMT_STATUS_NOT_CONNECTED);
8105                 goto unlocked;
8106         }
8107         hci_cp.conn_handle = conn->handle;
8108
8109         if (!hdev_is_powered(hdev)) {
8110                 BT_DBG("%s", hdev->name);
8111                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8112                                 MGMT_STATUS_NOT_POWERED);
8113                 goto unlocked;
8114         }
8115
8116         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
8117                 BT_DBG("%s", hdev->name);
8118                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8119                                 MGMT_STATUS_BUSY);
8120                 goto unlocked;
8121         }
8122
8123         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
8124         if (!cmd) {
8125                 BT_DBG("%s", hdev->name);
8126                 err = -ENOMEM;
8127                 goto unlocked;
8128         }
8129
8130         hci_req_init(&req, hdev);
8131
8132         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
8133         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
8134         err = hci_req_run(&req, get_raw_rssi_complete);
8135
8136         if (err < 0) {
8137                 mgmt_pending_remove(cmd);
8138                 BT_ERR("Error in requesting hci_req_run");
8139         }
8140
8141 unlocked:
8142         hci_dev_unlock(hdev);
8143
8144         return err;
8145 }
8146
8147 void mgmt_raw_rssi_response(struct hci_dev *hdev,
8148                 struct hci_cc_rp_get_raw_rssi *rp, int success)
8149 {
8150         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
8151         struct hci_conn *conn;
8152
8153         mgmt_rp.status = rp->status;
8154         mgmt_rp.rssi_dbm = rp->rssi_dbm;
8155
8156         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
8157         if (!conn)
8158                 return;
8159
8160         bacpy(&mgmt_rp.bt_address, &conn->dst);
8161         if (conn->type == LE_LINK)
8162                 mgmt_rp.link_type = 0x01;
8163         else
8164                 mgmt_rp.link_type = 0x00;
8165
8166         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
8167                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
8168 }
8169
8170 static void set_disable_threshold_complete(struct hci_dev *hdev,
8171                         u8 status, u16 opcode)
8172 {
8173         struct mgmt_pending_cmd *cmd;
8174
8175         BT_DBG("status 0x%02x", status);
8176
8177         hci_dev_lock(hdev);
8178
8179         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
8180         if (!cmd)
8181                 goto unlock;
8182
8183         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8184                         MGMT_STATUS_SUCCESS, &status, 1);
8185
8186         mgmt_pending_remove(cmd);
8187
8188 unlock:
8189         hci_dev_unlock(hdev);
8190 }
8191
8192 /** Removes monitoring for a link*/
8193 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
8194                 void *data, u16 len)
8195 {
8196         int err = 0;
8197         struct hci_cp_set_rssi_threshold th = { 0, };
8198         struct mgmt_cp_disable_rssi *cp = data;
8199         struct hci_conn *conn;
8200         struct mgmt_pending_cmd *cmd;
8201         struct hci_request req;
8202         __u8 dest_type;
8203
8204         BT_DBG("Set Disable RSSI.");
8205
8206         hci_dev_lock(hdev);
8207
8208         if (!lmp_le_capable(hdev)) {
8209                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8210                                 MGMT_STATUS_NOT_SUPPORTED);
8211                 goto unlocked;
8212         }
8213
8214         /* Get LE/ACL link handle info*/
8215         if (cp->link_type == 0x01)
8216                 dest_type = LE_LINK;
8217         else
8218                 dest_type = ACL_LINK;
8219
8220         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
8221         if (!conn) {
8222                 err = mgmt_cmd_complete(sk, hdev->id,
8223                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
8224                 goto unlocked;
8225         }
8226
8227         th.hci_le_ext_opcode = 0x0B;
8228         th.mode = 0x01;
8229         th.conn_handle = conn->handle;
8230         th.alert_mask = 0x00;
8231         th.low_th = 0x00;
8232         th.in_range_th = 0x00;
8233         th.high_th = 0x00;
8234
8235         if (!hdev_is_powered(hdev)) {
8236                 BT_DBG("%s", hdev->name);
8237                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8238                                 0, data, len);
8239                 goto unlocked;
8240         }
8241
8242         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
8243                 BT_DBG("%s", hdev->name);
8244                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8245                                 MGMT_STATUS_BUSY);
8246                 goto unlocked;
8247         }
8248
8249         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
8250                         sizeof(*cp));
8251         if (!cmd) {
8252                 BT_DBG("%s", hdev->name);
8253                 err = -ENOMEM;
8254                 goto unlocked;
8255         }
8256
8257         hci_req_init(&req, hdev);
8258
8259         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
8260         err = hci_req_run(&req, set_disable_threshold_complete);
8261         if (err < 0) {
8262                 mgmt_pending_remove(cmd);
8263                 BT_ERR("Error in requesting hci_req_run");
8264                 goto unlocked;
8265         }
8266
8267 unlocked:
8268         hci_dev_unlock(hdev);
8269
8270         return err;
8271 }
8272
8273 void mgmt_rssi_alert_evt(struct hci_dev *hdev, u16 conn_handle,
8274                 s8 alert_type, s8 rssi_dbm)
8275 {
8276         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
8277         struct hci_conn *conn;
8278
8279         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
8280                         conn_handle, alert_type, rssi_dbm);
8281
8282         conn = hci_conn_hash_lookup_handle(hdev, conn_handle);
8283
8284         if (!conn) {
8285                 BT_ERR("RSSI alert Error: Device not found for handle");
8286                 return;
8287         }
8288         bacpy(&mgmt_ev.bdaddr, &conn->dst);
8289
8290         if (conn->type == LE_LINK)
8291                 mgmt_ev.link_type = 0x01;
8292         else
8293                 mgmt_ev.link_type = 0x00;
8294
8295         mgmt_ev.alert_type = alert_type;
8296         mgmt_ev.rssi_dbm = rssi_dbm;
8297
8298         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
8299                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
8300                         NULL);
8301 }
8302
8303 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
8304 {
8305         struct mgmt_pending_cmd *cmd;
8306         u8 type;
8307         int err;
8308
8309         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
8310
8311         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
8312         if (!cmd)
8313                 return -ENOENT;
8314
8315         type = hdev->le_discovery.type;
8316
8317         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
8318                                 mgmt_status(status), &type, sizeof(type));
8319         mgmt_pending_remove(cmd);
8320
8321         return err;
8322 }
8323
8324 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
8325                 u16 opcode)
8326 {
8327         unsigned long timeout = 0;
8328
8329         BT_DBG("status %d", status);
8330
8331         if (status) {
8332                 hci_dev_lock(hdev);
8333                 mgmt_start_le_discovery_failed(hdev, status);
8334                 hci_dev_unlock(hdev);
8335                 return;
8336         }
8337
8338         hci_dev_lock(hdev);
8339         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
8340         hci_dev_unlock(hdev);
8341
8342         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
8343                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
8344
8345         if (!timeout)
8346                 return;
8347
8348         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
8349 }
8350
8351 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
8352                 void *data, u16 len)
8353 {
8354         struct mgmt_cp_start_le_discovery *cp = data;
8355         struct mgmt_pending_cmd *cmd;
8356         struct hci_cp_le_set_scan_param param_cp;
8357         struct hci_cp_le_set_scan_enable enable_cp;
8358         struct hci_request req;
8359         u8 status, own_addr_type;
8360         int err;
8361
8362         BT_DBG("%s", hdev->name);
8363
8364         if (!hdev_is_powered(hdev)) {
8365                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8366                                 MGMT_STATUS_NOT_POWERED);
8367                 goto unlock;
8368         }
8369
8370         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
8371                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8372                                 MGMT_STATUS_BUSY);
8373                 goto unlock;
8374         }
8375
8376         if (cp->type != DISCOV_TYPE_LE) {
8377                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8378                                 MGMT_STATUS_INVALID_PARAMS);
8379                 goto unlock;
8380         }
8381
8382         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
8383         if (!cmd) {
8384                 err = -ENOMEM;
8385                 goto unlock;
8386         }
8387
8388         hdev->le_discovery.type = cp->type;
8389
8390         hci_req_init(&req, hdev);
8391
8392         status = mgmt_le_support(hdev);
8393         if (status) {
8394                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8395                                 status);
8396                 mgmt_pending_remove(cmd);
8397                 goto unlock;
8398         }
8399
8400         /* If controller is scanning, it means the background scanning
8401          * is running. Thus, we should temporarily stop it in order to
8402          * set the discovery scanning parameters.
8403          */
8404         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
8405                 hci_req_add_le_scan_disable(&req, false);
8406
8407         memset(&param_cp, 0, sizeof(param_cp));
8408
8409         /* All active scans will be done with either a resolvable
8410          * private address (when privacy feature has been enabled)
8411          * or unresolvable private address.
8412          */
8413         err = hci_update_random_address_sync(hdev, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
8414         if (err < 0) {
8415                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8416                                 MGMT_STATUS_FAILED);
8417                 mgmt_pending_remove(cmd);
8418                 goto unlock;
8419         }
8420
8421         param_cp.type = hdev->le_scan_type;
8422         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
8423         param_cp.window = cpu_to_le16(hdev->le_scan_window);
8424         param_cp.own_address_type = own_addr_type;
8425         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
8426                     &param_cp);
8427
8428         memset(&enable_cp, 0, sizeof(enable_cp));
8429         enable_cp.enable = LE_SCAN_ENABLE;
8430         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
8431
8432         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
8433                     &enable_cp);
8434
8435         err = hci_req_run(&req, start_le_discovery_complete);
8436         if (err < 0)
8437                 mgmt_pending_remove(cmd);
8438         else
8439                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
8440
8441 unlock:
8442         return err;
8443 }
8444
8445 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
8446 {
8447         struct mgmt_pending_cmd *cmd;
8448         int err;
8449
8450         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
8451         if (!cmd)
8452                 return -ENOENT;
8453
8454         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
8455                                 mgmt_status(status), &hdev->le_discovery.type,
8456                                 sizeof(hdev->le_discovery.type));
8457         mgmt_pending_remove(cmd);
8458
8459         return err;
8460 }
8461
8462 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
8463                 u16 opcode)
8464 {
8465         BT_DBG("status %d", status);
8466
8467         hci_dev_lock(hdev);
8468
8469         if (status) {
8470                 mgmt_stop_le_discovery_failed(hdev, status);
8471                 goto unlock;
8472         }
8473
8474         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
8475
8476 unlock:
8477         hci_dev_unlock(hdev);
8478 }
8479
8480 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
8481                 void *data, u16 len)
8482 {
8483         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
8484         struct mgmt_pending_cmd *cmd;
8485         struct hci_request req;
8486         int err;
8487
8488         BT_DBG("%s", hdev->name);
8489
8490         hci_dev_lock(hdev);
8491
8492         if (!hci_le_discovery_active(hdev)) {
8493                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8494                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
8495                                         sizeof(mgmt_cp->type));
8496                 goto unlock;
8497         }
8498
8499         if (hdev->le_discovery.type != mgmt_cp->type) {
8500                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8501                                         MGMT_STATUS_INVALID_PARAMS,
8502                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
8503                 goto unlock;
8504         }
8505
8506         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
8507         if (!cmd) {
8508                 err = -ENOMEM;
8509                 goto unlock;
8510         }
8511
8512         hci_req_init(&req, hdev);
8513
8514         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
8515                 BT_DBG("unknown le discovery state %u",
8516                                         hdev->le_discovery.state);
8517
8518                 mgmt_pending_remove(cmd);
8519                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8520                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
8521                                         sizeof(mgmt_cp->type));
8522                 goto unlock;
8523         }
8524
8525         cancel_delayed_work(&hdev->le_scan_disable);
8526         hci_req_add_le_scan_disable(&req, false);
8527
8528         err = hci_req_run(&req, stop_le_discovery_complete);
8529         if (err < 0)
8530                 mgmt_pending_remove(cmd);
8531         else
8532                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
8533
8534 unlock:
8535         hci_dev_unlock(hdev);
8536         return err;
8537 }
8538
8539 /* Separate LE discovery */
8540 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
8541 {
8542         struct mgmt_ev_discovering ev;
8543         struct mgmt_pending_cmd *cmd;
8544
8545         BT_DBG("%s le discovering %u", hdev->name, discovering);
8546
8547         if (discovering)
8548                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
8549         else
8550                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
8551
8552         if (cmd) {
8553                 u8 type = hdev->le_discovery.type;
8554
8555                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
8556                                   sizeof(type));
8557                 mgmt_pending_remove(cmd);
8558         }
8559
8560         memset(&ev, 0, sizeof(ev));
8561         ev.type = hdev->le_discovery.type;
8562         ev.discovering = discovering;
8563
8564         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8565 }
8566
8567 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
8568                         void *data, u16 len)
8569 {
8570         int err;
8571
8572         BT_DBG("%s", hdev->name);
8573
8574         hci_dev_lock(hdev);
8575
8576         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
8577         if (err < 0)
8578                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
8579
8580         hci_dev_unlock(hdev);
8581
8582         return err;
8583 }
8584
8585 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
8586                 u16 to_multiplier)
8587 {
8588         u16 max_latency;
8589
8590         if (min > max || min < 6 || max > 3200)
8591                 return -EINVAL;
8592
8593         if (to_multiplier < 10 || to_multiplier > 3200)
8594                 return -EINVAL;
8595
8596         if (max >= to_multiplier * 8)
8597                 return -EINVAL;
8598
8599         max_latency = (to_multiplier * 8 / max) - 1;
8600
8601         if (latency > 499 || latency > max_latency)
8602                 return -EINVAL;
8603
8604         return 0;
8605 }
8606
8607 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
8608                 u16 len)
8609 {
8610         struct mgmt_cp_le_conn_update *cp = data;
8611
8612         struct hci_conn *conn;
8613         u16 min, max, latency, supervision_timeout;
8614         int err = -1;
8615
8616         if (!hdev_is_powered(hdev))
8617                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8618                                 MGMT_STATUS_NOT_POWERED);
8619
8620         min = __le16_to_cpu(cp->conn_interval_min);
8621         max = __le16_to_cpu(cp->conn_interval_max);
8622         latency = __le16_to_cpu(cp->conn_latency);
8623         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
8624
8625         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
8626                         min, max, latency, supervision_timeout);
8627
8628         err = check_le_conn_update_param(min, max, latency,
8629                         supervision_timeout);
8630
8631         if (err < 0)
8632                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8633                                 MGMT_STATUS_INVALID_PARAMS);
8634
8635         hci_dev_lock(hdev);
8636
8637         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
8638         if (!conn) {
8639                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8640                                 MGMT_STATUS_NOT_CONNECTED);
8641                 hci_dev_unlock(hdev);
8642                 return err;
8643         }
8644
8645         hci_dev_unlock(hdev);
8646
8647         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
8648
8649         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
8650                                  NULL, 0);
8651 }
8652
8653 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
8654                 u16 opcode)
8655 {
8656         struct mgmt_cp_set_manufacturer_data *cp;
8657         struct mgmt_pending_cmd *cmd;
8658
8659         BT_DBG("status 0x%02x", status);
8660
8661         hci_dev_lock(hdev);
8662
8663         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
8664         if (!cmd)
8665                 goto unlock;
8666
8667         cp = cmd->param;
8668
8669         if (status)
8670                 mgmt_cmd_status(cmd->sk, hdev->id,
8671                                 MGMT_OP_SET_MANUFACTURER_DATA,
8672                                 mgmt_status(status));
8673         else
8674                 mgmt_cmd_complete(cmd->sk, hdev->id,
8675                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
8676                                   cp, sizeof(*cp));
8677
8678         mgmt_pending_remove(cmd);
8679
8680 unlock:
8681         hci_dev_unlock(hdev);
8682 }
8683
8684 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
8685                 void *data, u16 len)
8686 {
8687         struct mgmt_pending_cmd *cmd;
8688         struct hci_request req;
8689         struct mgmt_cp_set_manufacturer_data *cp = data;
8690         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
8691         u8 old_len;
8692         int err;
8693
8694         BT_DBG("%s", hdev->name);
8695
8696         if (!lmp_bredr_capable(hdev))
8697                 return mgmt_cmd_status(sk, hdev->id,
8698                                 MGMT_OP_SET_MANUFACTURER_DATA,
8699                                 MGMT_STATUS_NOT_SUPPORTED);
8700
8701         if (cp->data[0] == 0 ||
8702                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
8703                 return mgmt_cmd_status(sk, hdev->id,
8704                                 MGMT_OP_SET_MANUFACTURER_DATA,
8705                                 MGMT_STATUS_INVALID_PARAMS);
8706
8707         if (cp->data[1] != 0xFF)
8708                 return mgmt_cmd_status(sk, hdev->id,
8709                                 MGMT_OP_SET_MANUFACTURER_DATA,
8710                                 MGMT_STATUS_NOT_SUPPORTED);
8711
8712         hci_dev_lock(hdev);
8713
8714         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
8715                 err = mgmt_cmd_status(sk, hdev->id,
8716                                 MGMT_OP_SET_MANUFACTURER_DATA,
8717                                 MGMT_STATUS_BUSY);
8718                 goto unlocked;
8719         }
8720
8721         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
8722                         len);
8723         if (!cmd) {
8724                 err = -ENOMEM;
8725                 goto unlocked;
8726         }
8727
8728         hci_req_init(&req, hdev);
8729
8730         /* if new data is same as previous data then return command
8731          * complete event
8732          */
8733         if (hdev->manufacturer_len == cp->data[0] - 1 &&
8734             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
8735                 mgmt_pending_remove(cmd);
8736                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
8737                                   0, cp, sizeof(*cp));
8738                 err = 0;
8739                 goto unlocked;
8740         }
8741
8742         old_len = hdev->manufacturer_len;
8743         if (old_len > 0)
8744                 memcpy(old_data, hdev->manufacturer_data, old_len);
8745
8746         hdev->manufacturer_len = cp->data[0] - 1;
8747         if (hdev->manufacturer_len > 0)
8748                 memcpy(hdev->manufacturer_data, cp->data + 2,
8749                                 hdev->manufacturer_len);
8750
8751         hci_update_eir_sync(hdev);
8752
8753         err = hci_req_run(&req, set_manufacturer_data_complete);
8754         if (err < 0) {
8755                 mgmt_pending_remove(cmd);
8756                 goto failed;
8757         }
8758
8759 unlocked:
8760         hci_dev_unlock(hdev);
8761
8762         return err;
8763
8764 failed:
8765         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
8766         hdev->manufacturer_len = old_len;
8767         if (hdev->manufacturer_len > 0)
8768                 memcpy(hdev->manufacturer_data, old_data,
8769                        hdev->manufacturer_len);
8770         hci_dev_unlock(hdev);
8771         return err;
8772 }
8773
8774 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
8775                 void *data, u16 len)
8776 {
8777         struct mgmt_cp_le_set_scan_params *cp = data;
8778         __u16 interval, window;
8779         int err;
8780
8781         BT_DBG("%s", hdev->name);
8782
8783         if (!lmp_le_capable(hdev))
8784                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8785                                 MGMT_STATUS_NOT_SUPPORTED);
8786
8787         interval = __le16_to_cpu(cp->interval);
8788
8789         if (interval < 0x0004 || interval > 0x4000)
8790                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8791                                 MGMT_STATUS_INVALID_PARAMS);
8792
8793         window = __le16_to_cpu(cp->window);
8794
8795         if (window < 0x0004 || window > 0x4000)
8796                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8797                                 MGMT_STATUS_INVALID_PARAMS);
8798
8799         if (window > interval)
8800                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8801                                 MGMT_STATUS_INVALID_PARAMS);
8802
8803         hci_dev_lock(hdev);
8804
8805         hdev->le_scan_type = cp->type;
8806         hdev->le_scan_interval = interval;
8807         hdev->le_scan_window = window;
8808
8809         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
8810                                 NULL, 0);
8811
8812         /* If background scan is running, restart it so new parameters are
8813          * loaded.
8814          */
8815         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
8816             hdev->discovery.state == DISCOVERY_STOPPED) {
8817                 struct hci_request req;
8818
8819                 hci_req_init(&req, hdev);
8820
8821                 hci_req_add_le_scan_disable(&req, false);
8822                 hci_req_add_le_passive_scan(&req);
8823
8824                 hci_req_run(&req, NULL);
8825         }
8826
8827         hci_dev_unlock(hdev);
8828
8829         return err;
8830 }
8831
8832 static int set_voice_setting(struct sock *sk, struct hci_dev *hdev,
8833                 void *data, u16 len)
8834 {
8835         struct mgmt_cp_set_voice_setting *cp = data;
8836         struct hci_conn *conn;
8837         struct hci_conn *sco_conn;
8838
8839         int err;
8840
8841         BT_DBG("%s", hdev->name);
8842
8843         if (!lmp_bredr_capable(hdev)) {
8844                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING,
8845                                 MGMT_STATUS_NOT_SUPPORTED);
8846         }
8847
8848         hci_dev_lock(hdev);
8849
8850         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
8851         if (!conn) {
8852                 err = mgmt_cmd_complete(sk, hdev->id,
8853                                 MGMT_OP_SET_VOICE_SETTING, 0, NULL, 0);
8854                 goto unlock;
8855         }
8856
8857         conn->voice_setting = cp->voice_setting;
8858         conn->sco_role = cp->sco_role;
8859
8860         sco_conn = hci_conn_hash_lookup_sco(hdev);
8861         if (sco_conn && bacmp(&sco_conn->dst, &cp->bdaddr) != 0) {
8862                 BT_ERR("There is other SCO connection.");
8863                 goto done;
8864         }
8865
8866         if (conn->sco_role == MGMT_SCO_ROLE_HANDSFREE) {
8867                 if (conn->voice_setting == 0x0063)
8868                         sco_connect_set_wbc(hdev);
8869                 else
8870                         sco_connect_set_nbc(hdev);
8871         } else {
8872                 if (conn->voice_setting == 0x0063)
8873                         sco_connect_set_gw_wbc(hdev);
8874                 else
8875                         sco_connect_set_gw_nbc(hdev);
8876         }
8877
8878 done:
8879         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
8880                         cp, sizeof(cp));
8881
8882 unlock:
8883         hci_dev_unlock(hdev);
8884         return err;
8885 }
8886
8887 static int get_adv_tx_power(struct sock *sk, struct hci_dev *hdev,
8888                 void *data, u16 len)
8889 {
8890         struct mgmt_rp_get_adv_tx_power *rp;
8891         size_t rp_len;
8892         int err;
8893
8894         BT_DBG("%s", hdev->name);
8895
8896         hci_dev_lock(hdev);
8897
8898         rp_len = sizeof(*rp);
8899         rp = kmalloc(rp_len, GFP_KERNEL);
8900         if (!rp) {
8901                 err = -ENOMEM;
8902                 goto unlock;
8903         }
8904
8905         rp->adv_tx_power = hdev->adv_tx_power;
8906
8907         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_TX_POWER, 0, rp,
8908                                 rp_len);
8909
8910         kfree(rp);
8911
8912 unlock:
8913         hci_dev_unlock(hdev);
8914
8915         return err;
8916 }
8917
8918 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
8919 {
8920         struct mgmt_ev_hardware_error ev;
8921
8922         ev.error_code = err_code;
8923         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
8924 }
8925
8926 void mgmt_tx_timeout_error(struct hci_dev *hdev)
8927 {
8928         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
8929 }
8930
8931 void mgmt_multi_adv_state_change_evt(struct hci_dev *hdev, u8 adv_instance,
8932                 u8 state_change_reason, u16 connection_handle)
8933 {
8934         struct mgmt_ev_vendor_specific_multi_adv_state_changed mgmt_ev;
8935
8936         BT_DBG("Multi adv state changed [%2.2X %2.2X %2.2X]",
8937                adv_instance, state_change_reason, connection_handle);
8938
8939         mgmt_ev.adv_instance = adv_instance;
8940         mgmt_ev.state_change_reason = state_change_reason;
8941         mgmt_ev.connection_handle = connection_handle;
8942
8943         mgmt_event(MGMT_EV_MULTI_ADV_STATE_CHANGED, hdev, &mgmt_ev,
8944                 sizeof(struct mgmt_ev_vendor_specific_multi_adv_state_changed),
8945                 NULL);
8946 }
8947
8948 static int enable_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8949                 void *data, u16 len)
8950 {
8951         int err;
8952         struct mgmt_cp_enable_6lowpan *cp = data;
8953
8954         BT_DBG("%s", hdev->name);
8955
8956         hci_dev_lock(hdev);
8957
8958         if (!hdev_is_powered(hdev)) {
8959                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8960                                       MGMT_STATUS_NOT_POWERED);
8961                 goto unlocked;
8962         }
8963
8964         if (!lmp_le_capable(hdev)) {
8965                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8966                                       MGMT_STATUS_NOT_SUPPORTED);
8967                 goto unlocked;
8968         }
8969
8970         if (cp->enable_6lowpan)
8971                 bt_6lowpan_enable();
8972         else
8973                 bt_6lowpan_disable();
8974
8975         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8976                                 MGMT_STATUS_SUCCESS, NULL, 0);
8977 unlocked:
8978         hci_dev_unlock(hdev);
8979         return err;
8980 }
8981
8982 static int connect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8983                 void *data, u16 len)
8984 {
8985         struct mgmt_cp_connect_6lowpan *cp = data;
8986         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
8987         int err;
8988
8989         BT_DBG("%s", hdev->name);
8990
8991         hci_dev_lock(hdev);
8992
8993         if (!lmp_le_capable(hdev)) {
8994                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
8995                                       MGMT_STATUS_NOT_SUPPORTED);
8996                 goto unlocked;
8997         }
8998
8999         if (!hdev_is_powered(hdev)) {
9000                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
9001                                       MGMT_STATUS_REJECTED);
9002                 goto unlocked;
9003         }
9004
9005         if (bdaddr_type_is_le(cp->addr.type)) {
9006                 if (cp->addr.type == BDADDR_LE_PUBLIC)
9007                         addr_type = ADDR_LE_DEV_PUBLIC;
9008                 else
9009                         addr_type = ADDR_LE_DEV_RANDOM;
9010         } else {
9011                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
9012                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
9013                 goto unlocked;
9014         }
9015
9016         hci_dev_unlock(hdev);
9017
9018         /* 6lowpan Connect */
9019         err = _bt_6lowpan_connect(&cp->addr.bdaddr, cp->addr.type);
9020
9021         hci_dev_lock(hdev);
9022
9023         if (err < 0) {
9024                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
9025                                         MGMT_STATUS_REJECTED, NULL, 0);
9026
9027                 goto unlocked;
9028         }
9029
9030         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
9031                                 NULL, 0);
9032 unlocked:
9033         hci_dev_unlock(hdev);
9034         return err;
9035 }
9036
9037 static int disconnect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
9038                 void *data, u16 len)
9039 {
9040         struct mgmt_cp_disconnect_6lowpan *cp = data;
9041         struct hci_conn *conn = NULL;
9042         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
9043         int err;
9044
9045         BT_DBG("%s", hdev->name);
9046
9047         hci_dev_lock(hdev);
9048
9049         if (!lmp_le_capable(hdev)) {
9050                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
9051                                       MGMT_STATUS_NOT_SUPPORTED);
9052                 goto unlocked;
9053         }
9054
9055         if (!hdev_is_powered(hdev)) {
9056                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
9057                                       MGMT_STATUS_REJECTED);
9058                 goto unlocked;
9059         }
9060
9061         if (bdaddr_type_is_le(cp->addr.type)) {
9062                 if (cp->addr.type == BDADDR_LE_PUBLIC)
9063                         addr_type = ADDR_LE_DEV_PUBLIC;
9064                 else
9065                         addr_type = ADDR_LE_DEV_RANDOM;
9066         } else {
9067                 err = mgmt_cmd_complete(sk, hdev->id,
9068                                         MGMT_OP_DISCONNECT_6LOWPAN,
9069                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
9070                 goto unlocked;
9071         }
9072
9073         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
9074         if (!conn) {
9075                 err = mgmt_cmd_complete(sk, hdev->id,
9076                                         MGMT_OP_DISCONNECT_6LOWPAN,
9077                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
9078                 goto unlocked;
9079         }
9080
9081         if (conn->dst_type != addr_type) {
9082                 err = mgmt_cmd_complete(sk, hdev->id,
9083                                         MGMT_OP_DISCONNECT_6LOWPAN,
9084                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
9085                 goto unlocked;
9086         }
9087
9088         if (conn->state != BT_CONNECTED) {
9089                 err = mgmt_cmd_complete(sk, hdev->id,
9090                                         MGMT_OP_DISCONNECT_6LOWPAN,
9091                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
9092                 goto unlocked;
9093         }
9094
9095         /* 6lowpan Disconnect */
9096         err = _bt_6lowpan_disconnect(conn->l2cap_data, cp->addr.type);
9097         if (err < 0) {
9098                 err = mgmt_cmd_complete(sk, hdev->id,
9099                                         MGMT_OP_DISCONNECT_6LOWPAN,
9100                                         MGMT_STATUS_REJECTED, NULL, 0);
9101                 goto unlocked;
9102         }
9103
9104         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
9105                                 NULL, 0);
9106
9107 unlocked:
9108         hci_dev_unlock(hdev);
9109         return err;
9110 }
9111
9112 void mgmt_6lowpan_conn_changed(struct hci_dev *hdev, char if_name[16],
9113                 bdaddr_t *bdaddr, u8 addr_type, bool connected)
9114 {
9115         char buf[512];
9116         struct mgmt_ev_6lowpan_conn_state_changed *ev = (void *)buf;
9117         size_t ev_size;
9118
9119         memset(buf, 0, sizeof(buf));
9120         bacpy(&ev->addr.bdaddr, bdaddr);
9121         ev->addr.type = addr_type;
9122         ev->connected = connected;
9123         memcpy(ev->ifname, (__u8 *)if_name, 16);
9124
9125         ev_size = sizeof(*ev);
9126
9127         mgmt_event(MGMT_EV_6LOWPAN_CONN_STATE_CHANGED, hdev, ev, ev_size, NULL);
9128 }
9129
9130 void mgmt_le_read_maximum_data_length_complete(struct hci_dev *hdev, u8 status)
9131 {
9132         struct mgmt_pending_cmd *cmd;
9133         struct mgmt_rp_le_read_maximum_data_length rp;
9134
9135         BT_DBG("%s status %u", hdev->name, status);
9136
9137         cmd = pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev);
9138         if (!cmd)
9139                 return;
9140
9141         if (status)
9142                 mgmt_cmd_status(cmd->sk, hdev->id,
9143                                 MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9144                                 mgmt_status(status));
9145
9146         memset(&rp, 0, sizeof(rp));
9147
9148         rp.max_tx_octets = cpu_to_le16(hdev->le_max_tx_len);
9149         rp.max_tx_time = cpu_to_le16(hdev->le_max_tx_time);
9150         rp.max_rx_octets = cpu_to_le16(hdev->le_max_rx_len);
9151         rp.max_rx_time = cpu_to_le16(hdev->le_max_rx_time);
9152
9153         mgmt_cmd_complete(cmd->sk, hdev->id,
9154                           MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, 0,
9155                           &rp, sizeof(rp));
9156
9157         mgmt_pending_remove(cmd);
9158 }
9159
9160 static int read_maximum_le_data_length(struct sock *sk,
9161                 struct hci_dev *hdev, void *data, u16 len)
9162 {
9163         struct mgmt_pending_cmd *cmd;
9164         int err;
9165
9166         BT_DBG("read_maximum_le_data_length  %s", hdev->name);
9167
9168         hci_dev_lock(hdev);
9169
9170         if (!hdev_is_powered(hdev)) {
9171                 err = mgmt_cmd_status(sk, hdev->id,
9172                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9173                                       MGMT_STATUS_NOT_POWERED);
9174                 goto unlock;
9175         }
9176
9177         if (!lmp_le_capable(hdev)) {
9178                 err = mgmt_cmd_status(sk, hdev->id,
9179                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9180                                       MGMT_STATUS_NOT_SUPPORTED);
9181                 goto unlock;
9182         }
9183
9184         if (pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev)) {
9185                 err = mgmt_cmd_status(sk, hdev->id,
9186                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9187                                       MGMT_STATUS_BUSY);
9188                 goto unlock;
9189         }
9190
9191         cmd = mgmt_pending_add(sk, MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9192                                hdev, data, len);
9193         if (!cmd) {
9194                 err = -ENOMEM;
9195                 goto unlock;
9196         }
9197
9198         err = hci_send_cmd(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
9199         if (err < 0)
9200                 mgmt_pending_remove(cmd);
9201
9202 unlock:
9203         hci_dev_unlock(hdev);
9204         return err;
9205 }
9206 #endif /* TIZEN_BT */
9207
9208 static bool ltk_is_valid(struct mgmt_ltk_info *key)
9209 {
9210         if (key->initiator != 0x00 && key->initiator != 0x01)
9211                 return false;
9212
9213         switch (key->addr.type) {
9214         case BDADDR_LE_PUBLIC:
9215                 return true;
9216
9217         case BDADDR_LE_RANDOM:
9218                 /* Two most significant bits shall be set */
9219                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
9220                         return false;
9221                 return true;
9222         }
9223
9224         return false;
9225 }
9226
9227 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
9228                                void *cp_data, u16 len)
9229 {
9230         struct mgmt_cp_load_long_term_keys *cp = cp_data;
9231         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
9232                                    sizeof(struct mgmt_ltk_info));
9233         u16 key_count, expected_len;
9234         int i, err;
9235
9236         bt_dev_dbg(hdev, "sock %p", sk);
9237
9238         if (!lmp_le_capable(hdev))
9239                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
9240                                        MGMT_STATUS_NOT_SUPPORTED);
9241
9242         key_count = __le16_to_cpu(cp->key_count);
9243         if (key_count > max_key_count) {
9244                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
9245                            key_count);
9246                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
9247                                        MGMT_STATUS_INVALID_PARAMS);
9248         }
9249
9250         expected_len = struct_size(cp, keys, key_count);
9251         if (expected_len != len) {
9252                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
9253                            expected_len, len);
9254                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
9255                                        MGMT_STATUS_INVALID_PARAMS);
9256         }
9257
9258         bt_dev_dbg(hdev, "key_count %u", key_count);
9259
9260         for (i = 0; i < key_count; i++) {
9261                 struct mgmt_ltk_info *key = &cp->keys[i];
9262
9263                 if (!ltk_is_valid(key))
9264                         return mgmt_cmd_status(sk, hdev->id,
9265                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
9266                                                MGMT_STATUS_INVALID_PARAMS);
9267         }
9268
9269         hci_dev_lock(hdev);
9270
9271         hci_smp_ltks_clear(hdev);
9272
9273         for (i = 0; i < key_count; i++) {
9274                 struct mgmt_ltk_info *key = &cp->keys[i];
9275                 u8 type, authenticated;
9276
9277                 if (hci_is_blocked_key(hdev,
9278                                        HCI_BLOCKED_KEY_TYPE_LTK,
9279                                        key->val)) {
9280                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
9281                                     &key->addr.bdaddr);
9282                         continue;
9283                 }
9284
9285                 switch (key->type) {
9286                 case MGMT_LTK_UNAUTHENTICATED:
9287                         authenticated = 0x00;
9288                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
9289                         break;
9290                 case MGMT_LTK_AUTHENTICATED:
9291                         authenticated = 0x01;
9292                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
9293                         break;
9294                 case MGMT_LTK_P256_UNAUTH:
9295                         authenticated = 0x00;
9296                         type = SMP_LTK_P256;
9297                         break;
9298                 case MGMT_LTK_P256_AUTH:
9299                         authenticated = 0x01;
9300                         type = SMP_LTK_P256;
9301                         break;
9302                 case MGMT_LTK_P256_DEBUG:
9303                         authenticated = 0x00;
9304                         type = SMP_LTK_P256_DEBUG;
9305                         fallthrough;
9306                 default:
9307                         continue;
9308                 }
9309
9310                 hci_add_ltk(hdev, &key->addr.bdaddr,
9311                             le_addr_type(key->addr.type), type, authenticated,
9312                             key->val, key->enc_size, key->ediv, key->rand);
9313         }
9314
9315         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
9316                            NULL, 0);
9317
9318         hci_dev_unlock(hdev);
9319
9320         return err;
9321 }
9322
9323 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
9324 {
9325         struct mgmt_pending_cmd *cmd = data;
9326         struct hci_conn *conn = cmd->user_data;
9327         struct mgmt_cp_get_conn_info *cp = cmd->param;
9328         struct mgmt_rp_get_conn_info rp;
9329         u8 status;
9330
9331         bt_dev_dbg(hdev, "err %d", err);
9332
9333         memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
9334
9335         status = mgmt_status(err);
9336         if (status == MGMT_STATUS_SUCCESS) {
9337                 rp.rssi = conn->rssi;
9338                 rp.tx_power = conn->tx_power;
9339                 rp.max_tx_power = conn->max_tx_power;
9340         } else {
9341                 rp.rssi = HCI_RSSI_INVALID;
9342                 rp.tx_power = HCI_TX_POWER_INVALID;
9343                 rp.max_tx_power = HCI_TX_POWER_INVALID;
9344         }
9345
9346         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
9347                           &rp, sizeof(rp));
9348
9349         mgmt_pending_free(cmd);
9350 }
9351
9352 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
9353 {
9354         struct mgmt_pending_cmd *cmd = data;
9355         struct mgmt_cp_get_conn_info *cp = cmd->param;
9356         struct hci_conn *conn;
9357         int err;
9358         __le16   handle;
9359
9360         /* Make sure we are still connected */
9361         if (cp->addr.type == BDADDR_BREDR)
9362                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
9363                                                &cp->addr.bdaddr);
9364         else
9365                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
9366
9367         if (!conn || conn->state != BT_CONNECTED)
9368                 return MGMT_STATUS_NOT_CONNECTED;
9369
9370         cmd->user_data = conn;
9371         handle = cpu_to_le16(conn->handle);
9372
9373         /* Refresh RSSI each time */
9374         err = hci_read_rssi_sync(hdev, handle);
9375
9376         /* For LE links TX power does not change thus we don't need to
9377          * query for it once value is known.
9378          */
9379         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
9380                      conn->tx_power == HCI_TX_POWER_INVALID))
9381                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
9382
9383         /* Max TX power needs to be read only once per connection */
9384         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
9385                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
9386
9387         return err;
9388 }
9389
9390 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
9391                          u16 len)
9392 {
9393         struct mgmt_cp_get_conn_info *cp = data;
9394         struct mgmt_rp_get_conn_info rp;
9395         struct hci_conn *conn;
9396         unsigned long conn_info_age;
9397         int err = 0;
9398
9399         bt_dev_dbg(hdev, "sock %p", sk);
9400
9401         memset(&rp, 0, sizeof(rp));
9402         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
9403         rp.addr.type = cp->addr.type;
9404
9405         if (!bdaddr_type_is_valid(cp->addr.type))
9406                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9407                                          MGMT_STATUS_INVALID_PARAMS,
9408                                          &rp, sizeof(rp));
9409
9410         hci_dev_lock(hdev);
9411
9412         if (!hdev_is_powered(hdev)) {
9413                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9414                                         MGMT_STATUS_NOT_POWERED, &rp,
9415                                         sizeof(rp));
9416                 goto unlock;
9417         }
9418
9419         if (cp->addr.type == BDADDR_BREDR)
9420                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
9421                                                &cp->addr.bdaddr);
9422         else
9423                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
9424
9425         if (!conn || conn->state != BT_CONNECTED) {
9426                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9427                                         MGMT_STATUS_NOT_CONNECTED, &rp,
9428                                         sizeof(rp));
9429                 goto unlock;
9430         }
9431
9432         /* To avoid client trying to guess when to poll again for information we
9433          * calculate conn info age as random value between min/max set in hdev.
9434          */
9435         conn_info_age = hdev->conn_info_min_age +
9436                         prandom_u32_max(hdev->conn_info_max_age -
9437                                         hdev->conn_info_min_age);
9438
9439         /* Query controller to refresh cached values if they are too old or were
9440          * never read.
9441          */
9442         if (time_after(jiffies, conn->conn_info_timestamp +
9443                        msecs_to_jiffies(conn_info_age)) ||
9444             !conn->conn_info_timestamp) {
9445                 struct mgmt_pending_cmd *cmd;
9446
9447                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
9448                                        len);
9449                 if (!cmd) {
9450                         err = -ENOMEM;
9451                 } else {
9452                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
9453                                                  cmd, get_conn_info_complete);
9454                 }
9455
9456                 if (err < 0) {
9457                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9458                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
9459
9460                         if (cmd)
9461                                 mgmt_pending_free(cmd);
9462
9463                         goto unlock;
9464                 }
9465
9466                 conn->conn_info_timestamp = jiffies;
9467         } else {
9468                 /* Cache is valid, just reply with values cached in hci_conn */
9469                 rp.rssi = conn->rssi;
9470                 rp.tx_power = conn->tx_power;
9471                 rp.max_tx_power = conn->max_tx_power;
9472
9473                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9474                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9475         }
9476
9477 unlock:
9478         hci_dev_unlock(hdev);
9479         return err;
9480 }
9481
9482 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
9483 {
9484         struct mgmt_pending_cmd *cmd = data;
9485         struct mgmt_cp_get_clock_info *cp = cmd->param;
9486         struct mgmt_rp_get_clock_info rp;
9487         struct hci_conn *conn = cmd->user_data;
9488         u8 status = mgmt_status(err);
9489
9490         bt_dev_dbg(hdev, "err %d", err);
9491
9492         memset(&rp, 0, sizeof(rp));
9493         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
9494         rp.addr.type = cp->addr.type;
9495
9496         if (err)
9497                 goto complete;
9498
9499         rp.local_clock = cpu_to_le32(hdev->clock);
9500
9501         if (conn) {
9502                 rp.piconet_clock = cpu_to_le32(conn->clock);
9503                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
9504         }
9505
9506 complete:
9507         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
9508                           sizeof(rp));
9509
9510         mgmt_pending_free(cmd);
9511 }
9512
9513 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
9514 {
9515         struct mgmt_pending_cmd *cmd = data;
9516         struct mgmt_cp_get_clock_info *cp = cmd->param;
9517         struct hci_cp_read_clock hci_cp;
9518         struct hci_conn *conn;
9519
9520         memset(&hci_cp, 0, sizeof(hci_cp));
9521         hci_read_clock_sync(hdev, &hci_cp);
9522
9523         /* Make sure connection still exists */
9524         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
9525         if (!conn || conn->state != BT_CONNECTED)
9526                 return MGMT_STATUS_NOT_CONNECTED;
9527
9528         cmd->user_data = conn;
9529         hci_cp.handle = cpu_to_le16(conn->handle);
9530         hci_cp.which = 0x01; /* Piconet clock */
9531
9532         return hci_read_clock_sync(hdev, &hci_cp);
9533 }
9534
9535 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
9536                                                                 u16 len)
9537 {
9538         struct mgmt_cp_get_clock_info *cp = data;
9539         struct mgmt_rp_get_clock_info rp;
9540         struct mgmt_pending_cmd *cmd;
9541         struct hci_conn *conn;
9542         int err;
9543
9544         bt_dev_dbg(hdev, "sock %p", sk);
9545
9546         memset(&rp, 0, sizeof(rp));
9547         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
9548         rp.addr.type = cp->addr.type;
9549
9550         if (cp->addr.type != BDADDR_BREDR)
9551                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
9552                                          MGMT_STATUS_INVALID_PARAMS,
9553                                          &rp, sizeof(rp));
9554
9555         hci_dev_lock(hdev);
9556
9557         if (!hdev_is_powered(hdev)) {
9558                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
9559                                         MGMT_STATUS_NOT_POWERED, &rp,
9560                                         sizeof(rp));
9561                 goto unlock;
9562         }
9563
9564         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
9565                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
9566                                                &cp->addr.bdaddr);
9567                 if (!conn || conn->state != BT_CONNECTED) {
9568                         err = mgmt_cmd_complete(sk, hdev->id,
9569                                                 MGMT_OP_GET_CLOCK_INFO,
9570                                                 MGMT_STATUS_NOT_CONNECTED,
9571                                                 &rp, sizeof(rp));
9572                         goto unlock;
9573                 }
9574         } else {
9575                 conn = NULL;
9576         }
9577
9578         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
9579         if (!cmd)
9580                 err = -ENOMEM;
9581         else
9582                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
9583                                          get_clock_info_complete);
9584
9585         if (err < 0) {
9586                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
9587                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
9588
9589                 if (cmd)
9590                         mgmt_pending_free(cmd);
9591         }
9592
9593
9594 unlock:
9595         hci_dev_unlock(hdev);
9596         return err;
9597 }
9598
9599 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
9600 {
9601         struct hci_conn *conn;
9602
9603         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
9604         if (!conn)
9605                 return false;
9606
9607         if (conn->dst_type != type)
9608                 return false;
9609
9610         if (conn->state != BT_CONNECTED)
9611                 return false;
9612
9613         return true;
9614 }
9615
9616 /* This function requires the caller holds hdev->lock */
9617 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
9618                                u8 addr_type, u8 auto_connect)
9619 {
9620         struct hci_conn_params *params;
9621
9622         params = hci_conn_params_add(hdev, addr, addr_type);
9623         if (!params)
9624                 return -EIO;
9625
9626         if (params->auto_connect == auto_connect)
9627                 return 0;
9628
9629         list_del_init(&params->action);
9630
9631         switch (auto_connect) {
9632         case HCI_AUTO_CONN_DISABLED:
9633         case HCI_AUTO_CONN_LINK_LOSS:
9634                 /* If auto connect is being disabled when we're trying to
9635                  * connect to device, keep connecting.
9636                  */
9637                 if (params->explicit_connect)
9638                         list_add(&params->action, &hdev->pend_le_conns);
9639                 break;
9640         case HCI_AUTO_CONN_REPORT:
9641                 if (params->explicit_connect)
9642                         list_add(&params->action, &hdev->pend_le_conns);
9643                 else
9644                         list_add(&params->action, &hdev->pend_le_reports);
9645                 break;
9646         case HCI_AUTO_CONN_DIRECT:
9647         case HCI_AUTO_CONN_ALWAYS:
9648                 if (!is_connected(hdev, addr, addr_type))
9649                         list_add(&params->action, &hdev->pend_le_conns);
9650                 break;
9651         }
9652
9653         params->auto_connect = auto_connect;
9654
9655         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
9656                    addr, addr_type, auto_connect);
9657
9658         return 0;
9659 }
9660
9661 static void device_added(struct sock *sk, struct hci_dev *hdev,
9662                          bdaddr_t *bdaddr, u8 type, u8 action)
9663 {
9664         struct mgmt_ev_device_added ev;
9665
9666         bacpy(&ev.addr.bdaddr, bdaddr);
9667         ev.addr.type = type;
9668         ev.action = action;
9669
9670         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
9671 }
9672
9673 static int add_device_sync(struct hci_dev *hdev, void *data)
9674 {
9675         return hci_update_passive_scan_sync(hdev);
9676 }
9677
9678 static int add_device(struct sock *sk, struct hci_dev *hdev,
9679                       void *data, u16 len)
9680 {
9681         struct mgmt_cp_add_device *cp = data;
9682         u8 auto_conn, addr_type;
9683         struct hci_conn_params *params;
9684         int err;
9685         u32 current_flags = 0;
9686         u32 supported_flags;
9687
9688         bt_dev_dbg(hdev, "sock %p", sk);
9689
9690         if (!bdaddr_type_is_valid(cp->addr.type) ||
9691             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
9692                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9693                                          MGMT_STATUS_INVALID_PARAMS,
9694                                          &cp->addr, sizeof(cp->addr));
9695
9696         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
9697                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9698                                          MGMT_STATUS_INVALID_PARAMS,
9699                                          &cp->addr, sizeof(cp->addr));
9700
9701         hci_dev_lock(hdev);
9702
9703         if (cp->addr.type == BDADDR_BREDR) {
9704                 /* Only incoming connections action is supported for now */
9705                 if (cp->action != 0x01) {
9706                         err = mgmt_cmd_complete(sk, hdev->id,
9707                                                 MGMT_OP_ADD_DEVICE,
9708                                                 MGMT_STATUS_INVALID_PARAMS,
9709                                                 &cp->addr, sizeof(cp->addr));
9710                         goto unlock;
9711                 }
9712
9713                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
9714                                                      &cp->addr.bdaddr,
9715                                                      cp->addr.type, 0);
9716                 if (err)
9717                         goto unlock;
9718
9719                 hci_update_scan(hdev);
9720
9721                 goto added;
9722         }
9723
9724         addr_type = le_addr_type(cp->addr.type);
9725
9726         if (cp->action == 0x02)
9727                 auto_conn = HCI_AUTO_CONN_ALWAYS;
9728         else if (cp->action == 0x01)
9729                 auto_conn = HCI_AUTO_CONN_DIRECT;
9730         else
9731                 auto_conn = HCI_AUTO_CONN_REPORT;
9732
9733         /* Kernel internally uses conn_params with resolvable private
9734          * address, but Add Device allows only identity addresses.
9735          * Make sure it is enforced before calling
9736          * hci_conn_params_lookup.
9737          */
9738         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9739                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9740                                         MGMT_STATUS_INVALID_PARAMS,
9741                                         &cp->addr, sizeof(cp->addr));
9742                 goto unlock;
9743         }
9744
9745         /* If the connection parameters don't exist for this device,
9746          * they will be created and configured with defaults.
9747          */
9748         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
9749                                 auto_conn) < 0) {
9750                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9751                                         MGMT_STATUS_FAILED, &cp->addr,
9752                                         sizeof(cp->addr));
9753                 goto unlock;
9754         } else {
9755                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9756                                                 addr_type);
9757                 if (params)
9758                         current_flags = params->flags;
9759         }
9760
9761         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
9762         if (err < 0)
9763                 goto unlock;
9764
9765 added:
9766         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
9767         supported_flags = hdev->conn_flags;
9768         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
9769                              supported_flags, current_flags);
9770
9771         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9772                                 MGMT_STATUS_SUCCESS, &cp->addr,
9773                                 sizeof(cp->addr));
9774
9775 unlock:
9776         hci_dev_unlock(hdev);
9777         return err;
9778 }
9779
9780 static void device_removed(struct sock *sk, struct hci_dev *hdev,
9781                            bdaddr_t *bdaddr, u8 type)
9782 {
9783         struct mgmt_ev_device_removed ev;
9784
9785         bacpy(&ev.addr.bdaddr, bdaddr);
9786         ev.addr.type = type;
9787
9788         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
9789 }
9790
9791 static int remove_device_sync(struct hci_dev *hdev, void *data)
9792 {
9793         return hci_update_passive_scan_sync(hdev);
9794 }
9795
9796 static int remove_device(struct sock *sk, struct hci_dev *hdev,
9797                          void *data, u16 len)
9798 {
9799         struct mgmt_cp_remove_device *cp = data;
9800         int err;
9801
9802         bt_dev_dbg(hdev, "sock %p", sk);
9803
9804         hci_dev_lock(hdev);
9805
9806         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
9807                 struct hci_conn_params *params;
9808                 u8 addr_type;
9809
9810                 if (!bdaddr_type_is_valid(cp->addr.type)) {
9811                         err = mgmt_cmd_complete(sk, hdev->id,
9812                                                 MGMT_OP_REMOVE_DEVICE,
9813                                                 MGMT_STATUS_INVALID_PARAMS,
9814                                                 &cp->addr, sizeof(cp->addr));
9815                         goto unlock;
9816                 }
9817
9818                 if (cp->addr.type == BDADDR_BREDR) {
9819                         err = hci_bdaddr_list_del(&hdev->accept_list,
9820                                                   &cp->addr.bdaddr,
9821                                                   cp->addr.type);
9822                         if (err) {
9823                                 err = mgmt_cmd_complete(sk, hdev->id,
9824                                                         MGMT_OP_REMOVE_DEVICE,
9825                                                         MGMT_STATUS_INVALID_PARAMS,
9826                                                         &cp->addr,
9827                                                         sizeof(cp->addr));
9828                                 goto unlock;
9829                         }
9830
9831                         hci_update_scan(hdev);
9832
9833                         device_removed(sk, hdev, &cp->addr.bdaddr,
9834                                        cp->addr.type);
9835                         goto complete;
9836                 }
9837
9838                 addr_type = le_addr_type(cp->addr.type);
9839
9840                 /* Kernel internally uses conn_params with resolvable private
9841                  * address, but Remove Device allows only identity addresses.
9842                  * Make sure it is enforced before calling
9843                  * hci_conn_params_lookup.
9844                  */
9845                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9846                         err = mgmt_cmd_complete(sk, hdev->id,
9847                                                 MGMT_OP_REMOVE_DEVICE,
9848                                                 MGMT_STATUS_INVALID_PARAMS,
9849                                                 &cp->addr, sizeof(cp->addr));
9850                         goto unlock;
9851                 }
9852
9853                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9854                                                 addr_type);
9855                 if (!params) {
9856                         err = mgmt_cmd_complete(sk, hdev->id,
9857                                                 MGMT_OP_REMOVE_DEVICE,
9858                                                 MGMT_STATUS_INVALID_PARAMS,
9859                                                 &cp->addr, sizeof(cp->addr));
9860                         goto unlock;
9861                 }
9862
9863                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
9864                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
9865                         err = mgmt_cmd_complete(sk, hdev->id,
9866                                                 MGMT_OP_REMOVE_DEVICE,
9867                                                 MGMT_STATUS_INVALID_PARAMS,
9868                                                 &cp->addr, sizeof(cp->addr));
9869                         goto unlock;
9870                 }
9871
9872                 list_del(&params->action);
9873                 list_del(&params->list);
9874                 kfree(params);
9875
9876                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
9877         } else {
9878                 struct hci_conn_params *p, *tmp;
9879                 struct bdaddr_list *b, *btmp;
9880
9881                 if (cp->addr.type) {
9882                         err = mgmt_cmd_complete(sk, hdev->id,
9883                                                 MGMT_OP_REMOVE_DEVICE,
9884                                                 MGMT_STATUS_INVALID_PARAMS,
9885                                                 &cp->addr, sizeof(cp->addr));
9886                         goto unlock;
9887                 }
9888
9889                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
9890                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
9891                         list_del(&b->list);
9892                         kfree(b);
9893                 }
9894
9895                 hci_update_scan(hdev);
9896
9897                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
9898                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
9899                                 continue;
9900                         device_removed(sk, hdev, &p->addr, p->addr_type);
9901                         if (p->explicit_connect) {
9902                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
9903                                 continue;
9904                         }
9905                         list_del(&p->action);
9906                         list_del(&p->list);
9907                         kfree(p);
9908                 }
9909
9910                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
9911         }
9912
9913         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
9914
9915 complete:
9916         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
9917                                 MGMT_STATUS_SUCCESS, &cp->addr,
9918                                 sizeof(cp->addr));
9919 unlock:
9920         hci_dev_unlock(hdev);
9921         return err;
9922 }
9923
9924 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
9925                            u16 len)
9926 {
9927         struct mgmt_cp_load_conn_param *cp = data;
9928         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
9929                                      sizeof(struct mgmt_conn_param));
9930         u16 param_count, expected_len;
9931         int i;
9932
9933         if (!lmp_le_capable(hdev))
9934                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9935                                        MGMT_STATUS_NOT_SUPPORTED);
9936
9937         param_count = __le16_to_cpu(cp->param_count);
9938         if (param_count > max_param_count) {
9939                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
9940                            param_count);
9941                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9942                                        MGMT_STATUS_INVALID_PARAMS);
9943         }
9944
9945         expected_len = struct_size(cp, params, param_count);
9946         if (expected_len != len) {
9947                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
9948                            expected_len, len);
9949                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9950                                        MGMT_STATUS_INVALID_PARAMS);
9951         }
9952
9953         bt_dev_dbg(hdev, "param_count %u", param_count);
9954
9955         hci_dev_lock(hdev);
9956
9957         hci_conn_params_clear_disabled(hdev);
9958
9959         for (i = 0; i < param_count; i++) {
9960                 struct mgmt_conn_param *param = &cp->params[i];
9961                 struct hci_conn_params *hci_param;
9962                 u16 min, max, latency, timeout;
9963                 u8 addr_type;
9964
9965                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
9966                            param->addr.type);
9967
9968                 if (param->addr.type == BDADDR_LE_PUBLIC) {
9969                         addr_type = ADDR_LE_DEV_PUBLIC;
9970                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
9971                         addr_type = ADDR_LE_DEV_RANDOM;
9972                 } else {
9973                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9974                         continue;
9975                 }
9976
9977                 min = le16_to_cpu(param->min_interval);
9978                 max = le16_to_cpu(param->max_interval);
9979                 latency = le16_to_cpu(param->latency);
9980                 timeout = le16_to_cpu(param->timeout);
9981
9982                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
9983                            min, max, latency, timeout);
9984
9985                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
9986                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9987                         continue;
9988                 }
9989
9990                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
9991                                                 addr_type);
9992                 if (!hci_param) {
9993                         bt_dev_err(hdev, "failed to add connection parameters");
9994                         continue;
9995                 }
9996
9997                 hci_param->conn_min_interval = min;
9998                 hci_param->conn_max_interval = max;
9999                 hci_param->conn_latency = latency;
10000                 hci_param->supervision_timeout = timeout;
10001         }
10002
10003         hci_dev_unlock(hdev);
10004
10005         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
10006                                  NULL, 0);
10007 }
10008
10009 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
10010                                void *data, u16 len)
10011 {
10012         struct mgmt_cp_set_external_config *cp = data;
10013         bool changed;
10014         int err;
10015
10016         bt_dev_dbg(hdev, "sock %p", sk);
10017
10018         if (hdev_is_powered(hdev))
10019                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
10020                                        MGMT_STATUS_REJECTED);
10021
10022         if (cp->config != 0x00 && cp->config != 0x01)
10023                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
10024                                          MGMT_STATUS_INVALID_PARAMS);
10025
10026         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
10027                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
10028                                        MGMT_STATUS_NOT_SUPPORTED);
10029
10030         hci_dev_lock(hdev);
10031
10032         if (cp->config)
10033                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
10034         else
10035                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
10036
10037         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
10038         if (err < 0)
10039                 goto unlock;
10040
10041         if (!changed)
10042                 goto unlock;
10043
10044         err = new_options(hdev, sk);
10045
10046         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
10047                 mgmt_index_removed(hdev);
10048
10049                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
10050                         hci_dev_set_flag(hdev, HCI_CONFIG);
10051                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
10052
10053                         queue_work(hdev->req_workqueue, &hdev->power_on);
10054                 } else {
10055                         set_bit(HCI_RAW, &hdev->flags);
10056                         mgmt_index_added(hdev);
10057                 }
10058         }
10059
10060 unlock:
10061         hci_dev_unlock(hdev);
10062         return err;
10063 }
10064
10065 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
10066                               void *data, u16 len)
10067 {
10068         struct mgmt_cp_set_public_address *cp = data;
10069         bool changed;
10070         int err;
10071
10072         bt_dev_dbg(hdev, "sock %p", sk);
10073
10074         if (hdev_is_powered(hdev))
10075                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
10076                                        MGMT_STATUS_REJECTED);
10077
10078         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
10079                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
10080                                        MGMT_STATUS_INVALID_PARAMS);
10081
10082         if (!hdev->set_bdaddr)
10083                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
10084                                        MGMT_STATUS_NOT_SUPPORTED);
10085
10086         hci_dev_lock(hdev);
10087
10088         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
10089         bacpy(&hdev->public_addr, &cp->bdaddr);
10090
10091         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
10092         if (err < 0)
10093                 goto unlock;
10094
10095         if (!changed)
10096                 goto unlock;
10097
10098         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
10099                 err = new_options(hdev, sk);
10100
10101         if (is_configured(hdev)) {
10102                 mgmt_index_removed(hdev);
10103
10104                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
10105
10106                 hci_dev_set_flag(hdev, HCI_CONFIG);
10107                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
10108
10109                 queue_work(hdev->req_workqueue, &hdev->power_on);
10110         }
10111
10112 unlock:
10113         hci_dev_unlock(hdev);
10114         return err;
10115 }
10116
10117 #ifdef TIZEN_BT
10118 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
10119                             u8 name_len)
10120 {
10121         char buf[512];
10122         struct mgmt_ev_device_name_update *ev = (void *)buf;
10123         u16 eir_len = 0;
10124
10125         if (name_len <= 0)
10126                 return -EINVAL;
10127
10128         bacpy(&ev->addr.bdaddr, bdaddr);
10129         ev->addr.type = BDADDR_BREDR;
10130
10131         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
10132                                   name_len);
10133
10134         ev->eir_len = cpu_to_le16(eir_len);
10135
10136         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
10137                           sizeof(*ev) + eir_len, NULL);
10138 }
10139
10140 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10141                                u8 link_type, u8 addr_type, u8 status)
10142 {
10143         struct mgmt_ev_conn_update_failed ev;
10144
10145         bacpy(&ev.addr.bdaddr, bdaddr);
10146         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10147         ev.status = status;
10148
10149         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
10150                                 &ev, sizeof(ev), NULL);
10151 }
10152
10153 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
10154                          u8 link_type, u8 addr_type, u16 conn_interval,
10155                          u16 conn_latency, u16 supervision_timeout)
10156 {
10157         struct mgmt_ev_conn_updated ev;
10158
10159         bacpy(&ev.addr.bdaddr, bdaddr);
10160         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10161         ev.conn_interval = cpu_to_le16(conn_interval);
10162         ev.conn_latency = cpu_to_le16(conn_latency);
10163         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
10164
10165         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
10166                                 &ev, sizeof(ev), NULL);
10167 }
10168
10169 /* le device found event - Pass adv type */
10170 void mgmt_le_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10171                 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, u8 *eir,
10172                 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, u8 adv_type)
10173 {
10174         char buf[512];
10175         struct mgmt_ev_le_device_found *ev = (void *)buf;
10176         size_t ev_size;
10177
10178         if (!hci_discovery_active(hdev) && !hci_le_discovery_active(hdev))
10179                 return;
10180
10181         /* Make sure that the buffer is big enough. The 5 extra bytes
10182          * are for the potential CoD field.
10183          */
10184         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
10185                 return;
10186
10187         memset(buf, 0, sizeof(buf));
10188
10189         bacpy(&ev->addr.bdaddr, bdaddr);
10190         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10191         ev->rssi = rssi;
10192         ev->flags = cpu_to_le32(flags);
10193         ev->adv_type = adv_type;
10194
10195         if (eir_len > 0)
10196                 memcpy(ev->eir, eir, eir_len);
10197
10198         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, NULL))
10199                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
10200                                           dev_class, 3);
10201
10202         if (scan_rsp_len > 0)
10203                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
10204
10205         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10206         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
10207
10208         mgmt_event(MGMT_EV_LE_DEVICE_FOUND, hdev, ev, ev_size, NULL);
10209 }
10210 #endif
10211
10212 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
10213                                              int err)
10214 {
10215         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
10216         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
10217         u8 *h192, *r192, *h256, *r256;
10218         struct mgmt_pending_cmd *cmd = data;
10219         struct sk_buff *skb = cmd->skb;
10220         u8 status = mgmt_status(err);
10221         u16 eir_len;
10222
10223         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
10224                 return;
10225
10226         if (!status) {
10227                 if (!skb)
10228                         status = MGMT_STATUS_FAILED;
10229                 else if (IS_ERR(skb))
10230                         status = mgmt_status(PTR_ERR(skb));
10231                 else
10232                         status = mgmt_status(skb->data[0]);
10233         }
10234
10235         bt_dev_dbg(hdev, "status %u", status);
10236
10237         mgmt_cp = cmd->param;
10238
10239         if (status) {
10240                 status = mgmt_status(status);
10241                 eir_len = 0;
10242
10243                 h192 = NULL;
10244                 r192 = NULL;
10245                 h256 = NULL;
10246                 r256 = NULL;
10247         } else if (!bredr_sc_enabled(hdev)) {
10248                 struct hci_rp_read_local_oob_data *rp;
10249
10250                 if (skb->len != sizeof(*rp)) {
10251                         status = MGMT_STATUS_FAILED;
10252                         eir_len = 0;
10253                 } else {
10254                         status = MGMT_STATUS_SUCCESS;
10255                         rp = (void *)skb->data;
10256
10257                         eir_len = 5 + 18 + 18;
10258                         h192 = rp->hash;
10259                         r192 = rp->rand;
10260                         h256 = NULL;
10261                         r256 = NULL;
10262                 }
10263         } else {
10264                 struct hci_rp_read_local_oob_ext_data *rp;
10265
10266                 if (skb->len != sizeof(*rp)) {
10267                         status = MGMT_STATUS_FAILED;
10268                         eir_len = 0;
10269                 } else {
10270                         status = MGMT_STATUS_SUCCESS;
10271                         rp = (void *)skb->data;
10272
10273                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
10274                                 eir_len = 5 + 18 + 18;
10275                                 h192 = NULL;
10276                                 r192 = NULL;
10277                         } else {
10278                                 eir_len = 5 + 18 + 18 + 18 + 18;
10279                                 h192 = rp->hash192;
10280                                 r192 = rp->rand192;
10281                         }
10282
10283                         h256 = rp->hash256;
10284                         r256 = rp->rand256;
10285                 }
10286         }
10287
10288         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
10289         if (!mgmt_rp)
10290                 goto done;
10291
10292         if (eir_len == 0)
10293                 goto send_rsp;
10294
10295         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
10296                                   hdev->dev_class, 3);
10297
10298         if (h192 && r192) {
10299                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10300                                           EIR_SSP_HASH_C192, h192, 16);
10301                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10302                                           EIR_SSP_RAND_R192, r192, 16);
10303         }
10304
10305         if (h256 && r256) {
10306                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10307                                           EIR_SSP_HASH_C256, h256, 16);
10308                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10309                                           EIR_SSP_RAND_R256, r256, 16);
10310         }
10311
10312 send_rsp:
10313         mgmt_rp->type = mgmt_cp->type;
10314         mgmt_rp->eir_len = cpu_to_le16(eir_len);
10315
10316         err = mgmt_cmd_complete(cmd->sk, hdev->id,
10317                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
10318                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
10319         if (err < 0 || status)
10320                 goto done;
10321
10322         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
10323
10324         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
10325                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
10326                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
10327 done:
10328         if (skb && !IS_ERR(skb))
10329                 kfree_skb(skb);
10330
10331         kfree(mgmt_rp);
10332         mgmt_pending_remove(cmd);
10333 }
10334
10335 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
10336                                   struct mgmt_cp_read_local_oob_ext_data *cp)
10337 {
10338         struct mgmt_pending_cmd *cmd;
10339         int err;
10340
10341         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
10342                                cp, sizeof(*cp));
10343         if (!cmd)
10344                 return -ENOMEM;
10345
10346         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
10347                                  read_local_oob_ext_data_complete);
10348
10349         if (err < 0) {
10350                 mgmt_pending_remove(cmd);
10351                 return err;
10352         }
10353
10354         return 0;
10355 }
10356
10357 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
10358                                    void *data, u16 data_len)
10359 {
10360         struct mgmt_cp_read_local_oob_ext_data *cp = data;
10361         struct mgmt_rp_read_local_oob_ext_data *rp;
10362         size_t rp_len;
10363         u16 eir_len;
10364         u8 status, flags, role, addr[7], hash[16], rand[16];
10365         int err;
10366
10367         bt_dev_dbg(hdev, "sock %p", sk);
10368
10369         if (hdev_is_powered(hdev)) {
10370                 switch (cp->type) {
10371                 case BIT(BDADDR_BREDR):
10372                         status = mgmt_bredr_support(hdev);
10373                         if (status)
10374                                 eir_len = 0;
10375                         else
10376                                 eir_len = 5;
10377                         break;
10378                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
10379                         status = mgmt_le_support(hdev);
10380                         if (status)
10381                                 eir_len = 0;
10382                         else
10383                                 eir_len = 9 + 3 + 18 + 18 + 3;
10384                         break;
10385                 default:
10386                         status = MGMT_STATUS_INVALID_PARAMS;
10387                         eir_len = 0;
10388                         break;
10389                 }
10390         } else {
10391                 status = MGMT_STATUS_NOT_POWERED;
10392                 eir_len = 0;
10393         }
10394
10395         rp_len = sizeof(*rp) + eir_len;
10396         rp = kmalloc(rp_len, GFP_ATOMIC);
10397         if (!rp)
10398                 return -ENOMEM;
10399
10400         if (!status && !lmp_ssp_capable(hdev)) {
10401                 status = MGMT_STATUS_NOT_SUPPORTED;
10402                 eir_len = 0;
10403         }
10404
10405         if (status)
10406                 goto complete;
10407
10408         hci_dev_lock(hdev);
10409
10410         eir_len = 0;
10411         switch (cp->type) {
10412         case BIT(BDADDR_BREDR):
10413                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
10414                         err = read_local_ssp_oob_req(hdev, sk, cp);
10415                         hci_dev_unlock(hdev);
10416                         if (!err)
10417                                 goto done;
10418
10419                         status = MGMT_STATUS_FAILED;
10420                         goto complete;
10421                 } else {
10422                         eir_len = eir_append_data(rp->eir, eir_len,
10423                                                   EIR_CLASS_OF_DEV,
10424                                                   hdev->dev_class, 3);
10425                 }
10426                 break;
10427         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
10428                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
10429                     smp_generate_oob(hdev, hash, rand) < 0) {
10430                         hci_dev_unlock(hdev);
10431                         status = MGMT_STATUS_FAILED;
10432                         goto complete;
10433                 }
10434
10435                 /* This should return the active RPA, but since the RPA
10436                  * is only programmed on demand, it is really hard to fill
10437                  * this in at the moment. For now disallow retrieving
10438                  * local out-of-band data when privacy is in use.
10439                  *
10440                  * Returning the identity address will not help here since
10441                  * pairing happens before the identity resolving key is
10442                  * known and thus the connection establishment happens
10443                  * based on the RPA and not the identity address.
10444                  */
10445                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
10446                         hci_dev_unlock(hdev);
10447                         status = MGMT_STATUS_REJECTED;
10448                         goto complete;
10449                 }
10450
10451                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
10452                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
10453                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
10454                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
10455                         memcpy(addr, &hdev->static_addr, 6);
10456                         addr[6] = 0x01;
10457                 } else {
10458                         memcpy(addr, &hdev->bdaddr, 6);
10459                         addr[6] = 0x00;
10460                 }
10461
10462                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
10463                                           addr, sizeof(addr));
10464
10465                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
10466                         role = 0x02;
10467                 else
10468                         role = 0x01;
10469
10470                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
10471                                           &role, sizeof(role));
10472
10473                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
10474                         eir_len = eir_append_data(rp->eir, eir_len,
10475                                                   EIR_LE_SC_CONFIRM,
10476                                                   hash, sizeof(hash));
10477
10478                         eir_len = eir_append_data(rp->eir, eir_len,
10479                                                   EIR_LE_SC_RANDOM,
10480                                                   rand, sizeof(rand));
10481                 }
10482
10483                 flags = mgmt_get_adv_discov_flags(hdev);
10484
10485                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
10486                         flags |= LE_AD_NO_BREDR;
10487
10488                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
10489                                           &flags, sizeof(flags));
10490                 break;
10491         }
10492
10493         hci_dev_unlock(hdev);
10494
10495         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
10496
10497         status = MGMT_STATUS_SUCCESS;
10498
10499 complete:
10500         rp->type = cp->type;
10501         rp->eir_len = cpu_to_le16(eir_len);
10502
10503         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
10504                                 status, rp, sizeof(*rp) + eir_len);
10505         if (err < 0 || status)
10506                 goto done;
10507
10508         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
10509                                  rp, sizeof(*rp) + eir_len,
10510                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
10511
10512 done:
10513         kfree(rp);
10514
10515         return err;
10516 }
10517
10518 static u32 get_supported_adv_flags(struct hci_dev *hdev)
10519 {
10520         u32 flags = 0;
10521
10522         flags |= MGMT_ADV_FLAG_CONNECTABLE;
10523         flags |= MGMT_ADV_FLAG_DISCOV;
10524         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
10525         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
10526         flags |= MGMT_ADV_FLAG_APPEARANCE;
10527         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
10528         flags |= MGMT_ADV_PARAM_DURATION;
10529         flags |= MGMT_ADV_PARAM_TIMEOUT;
10530         flags |= MGMT_ADV_PARAM_INTERVALS;
10531         flags |= MGMT_ADV_PARAM_TX_POWER;
10532         flags |= MGMT_ADV_PARAM_SCAN_RSP;
10533
10534         /* In extended adv TX_POWER returned from Set Adv Param
10535          * will be always valid.
10536          */
10537         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
10538                 flags |= MGMT_ADV_FLAG_TX_POWER;
10539
10540         if (ext_adv_capable(hdev)) {
10541                 flags |= MGMT_ADV_FLAG_SEC_1M;
10542                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
10543                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
10544
10545                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
10546                         flags |= MGMT_ADV_FLAG_SEC_2M;
10547
10548                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
10549                         flags |= MGMT_ADV_FLAG_SEC_CODED;
10550         }
10551
10552         return flags;
10553 }
10554
10555 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
10556                              void *data, u16 data_len)
10557 {
10558         struct mgmt_rp_read_adv_features *rp;
10559         size_t rp_len;
10560         int err;
10561         struct adv_info *adv_instance;
10562         u32 supported_flags;
10563         u8 *instance;
10564
10565         bt_dev_dbg(hdev, "sock %p", sk);
10566
10567         if (!lmp_le_capable(hdev))
10568                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
10569                                        MGMT_STATUS_REJECTED);
10570
10571         hci_dev_lock(hdev);
10572
10573         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
10574         rp = kmalloc(rp_len, GFP_ATOMIC);
10575         if (!rp) {
10576                 hci_dev_unlock(hdev);
10577                 return -ENOMEM;
10578         }
10579
10580         supported_flags = get_supported_adv_flags(hdev);
10581
10582         rp->supported_flags = cpu_to_le32(supported_flags);
10583         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
10584         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
10585         rp->max_instances = hdev->le_num_of_adv_sets;
10586         rp->num_instances = hdev->adv_instance_cnt;
10587
10588         instance = rp->instance;
10589         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
10590                 /* Only instances 1-le_num_of_adv_sets are externally visible */
10591                 if (adv_instance->instance <= hdev->adv_instance_cnt) {
10592                         *instance = adv_instance->instance;
10593                         instance++;
10594                 } else {
10595                         rp->num_instances--;
10596                         rp_len--;
10597                 }
10598         }
10599
10600         hci_dev_unlock(hdev);
10601
10602         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
10603                                 MGMT_STATUS_SUCCESS, rp, rp_len);
10604
10605         kfree(rp);
10606
10607         return err;
10608 }
10609
10610 static u8 calculate_name_len(struct hci_dev *hdev)
10611 {
10612         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
10613
10614         return eir_append_local_name(hdev, buf, 0);
10615 }
10616
10617 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
10618                            bool is_adv_data)
10619 {
10620         u8 max_len = HCI_MAX_AD_LENGTH;
10621
10622         if (is_adv_data) {
10623                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
10624                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
10625                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
10626                         max_len -= 3;
10627
10628                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
10629                         max_len -= 3;
10630         } else {
10631                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
10632                         max_len -= calculate_name_len(hdev);
10633
10634                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
10635                         max_len -= 4;
10636         }
10637
10638         return max_len;
10639 }
10640
10641 static bool flags_managed(u32 adv_flags)
10642 {
10643         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
10644                             MGMT_ADV_FLAG_LIMITED_DISCOV |
10645                             MGMT_ADV_FLAG_MANAGED_FLAGS);
10646 }
10647
10648 static bool tx_power_managed(u32 adv_flags)
10649 {
10650         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
10651 }
10652
10653 static bool name_managed(u32 adv_flags)
10654 {
10655         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
10656 }
10657
10658 static bool appearance_managed(u32 adv_flags)
10659 {
10660         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
10661 }
10662
10663 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
10664                               u8 len, bool is_adv_data)
10665 {
10666         int i, cur_len;
10667         u8 max_len;
10668
10669         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
10670
10671         if (len > max_len)
10672                 return false;
10673
10674         /* Make sure that the data is correctly formatted. */
10675         for (i = 0; i < len; i += (cur_len + 1)) {
10676                 cur_len = data[i];
10677
10678                 if (!cur_len)
10679                         continue;
10680
10681                 if (data[i + 1] == EIR_FLAGS &&
10682                     (!is_adv_data || flags_managed(adv_flags)))
10683                         return false;
10684
10685                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
10686                         return false;
10687
10688                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
10689                         return false;
10690
10691                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
10692                         return false;
10693
10694                 if (data[i + 1] == EIR_APPEARANCE &&
10695                     appearance_managed(adv_flags))
10696                         return false;
10697
10698                 /* If the current field length would exceed the total data
10699                  * length, then it's invalid.
10700                  */
10701                 if (i + cur_len >= len)
10702                         return false;
10703         }
10704
10705         return true;
10706 }
10707
10708 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
10709 {
10710         u32 supported_flags, phy_flags;
10711
10712         /* The current implementation only supports a subset of the specified
10713          * flags. Also need to check mutual exclusiveness of sec flags.
10714          */
10715         supported_flags = get_supported_adv_flags(hdev);
10716         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
10717         if (adv_flags & ~supported_flags ||
10718             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
10719                 return false;
10720
10721         return true;
10722 }
10723
10724 static bool adv_busy(struct hci_dev *hdev)
10725 {
10726         return pending_find(MGMT_OP_SET_LE, hdev);
10727 }
10728
10729 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
10730                              int err)
10731 {
10732         struct adv_info *adv, *n;
10733
10734         bt_dev_dbg(hdev, "err %d", err);
10735
10736         hci_dev_lock(hdev);
10737
10738         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
10739                 u8 instance;
10740
10741                 if (!adv->pending)
10742                         continue;
10743
10744                 if (!err) {
10745                         adv->pending = false;
10746                         continue;
10747                 }
10748
10749                 instance = adv->instance;
10750
10751                 if (hdev->cur_adv_instance == instance)
10752                         cancel_adv_timeout(hdev);
10753
10754                 hci_remove_adv_instance(hdev, instance);
10755                 mgmt_advertising_removed(sk, hdev, instance);
10756         }
10757
10758         hci_dev_unlock(hdev);
10759 }
10760
10761 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
10762 {
10763         struct mgmt_pending_cmd *cmd = data;
10764         struct mgmt_cp_add_advertising *cp = cmd->param;
10765         struct mgmt_rp_add_advertising rp;
10766
10767         memset(&rp, 0, sizeof(rp));
10768
10769         rp.instance = cp->instance;
10770
10771         if (err)
10772                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10773                                 mgmt_status(err));
10774         else
10775                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10776                                   mgmt_status(err), &rp, sizeof(rp));
10777
10778         add_adv_complete(hdev, cmd->sk, cp->instance, err);
10779
10780         mgmt_pending_free(cmd);
10781 }
10782
10783 static int add_advertising_sync(struct hci_dev *hdev, void *data)
10784 {
10785         struct mgmt_pending_cmd *cmd = data;
10786         struct mgmt_cp_add_advertising *cp = cmd->param;
10787
10788         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
10789 }
10790
10791 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
10792                            void *data, u16 data_len)
10793 {
10794         struct mgmt_cp_add_advertising *cp = data;
10795         struct mgmt_rp_add_advertising rp;
10796         u32 flags;
10797         u8 status;
10798         u16 timeout, duration;
10799         unsigned int prev_instance_cnt;
10800         u8 schedule_instance = 0;
10801         struct adv_info *adv, *next_instance;
10802         int err;
10803         struct mgmt_pending_cmd *cmd;
10804
10805         bt_dev_dbg(hdev, "sock %p", sk);
10806
10807         status = mgmt_le_support(hdev);
10808         if (status)
10809                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10810                                        status);
10811
10812         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10813                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10814                                        MGMT_STATUS_INVALID_PARAMS);
10815
10816         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
10817                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10818                                        MGMT_STATUS_INVALID_PARAMS);
10819
10820         flags = __le32_to_cpu(cp->flags);
10821         timeout = __le16_to_cpu(cp->timeout);
10822         duration = __le16_to_cpu(cp->duration);
10823
10824         if (!requested_adv_flags_are_valid(hdev, flags))
10825                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10826                                        MGMT_STATUS_INVALID_PARAMS);
10827
10828         hci_dev_lock(hdev);
10829
10830         if (timeout && !hdev_is_powered(hdev)) {
10831                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10832                                       MGMT_STATUS_REJECTED);
10833                 goto unlock;
10834         }
10835
10836         if (adv_busy(hdev)) {
10837                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10838                                       MGMT_STATUS_BUSY);
10839                 goto unlock;
10840         }
10841
10842         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
10843             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
10844                                cp->scan_rsp_len, false)) {
10845                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10846                                       MGMT_STATUS_INVALID_PARAMS);
10847                 goto unlock;
10848         }
10849
10850         prev_instance_cnt = hdev->adv_instance_cnt;
10851
10852         adv = hci_add_adv_instance(hdev, cp->instance, flags,
10853                                    cp->adv_data_len, cp->data,
10854                                    cp->scan_rsp_len,
10855                                    cp->data + cp->adv_data_len,
10856                                    timeout, duration,
10857                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
10858                                    hdev->le_adv_min_interval,
10859                                    hdev->le_adv_max_interval, 0);
10860         if (IS_ERR(adv)) {
10861                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10862                                       MGMT_STATUS_FAILED);
10863                 goto unlock;
10864         }
10865
10866         /* Only trigger an advertising added event if a new instance was
10867          * actually added.
10868          */
10869         if (hdev->adv_instance_cnt > prev_instance_cnt)
10870                 mgmt_advertising_added(sk, hdev, cp->instance);
10871
10872         if (hdev->cur_adv_instance == cp->instance) {
10873                 /* If the currently advertised instance is being changed then
10874                  * cancel the current advertising and schedule the next
10875                  * instance. If there is only one instance then the overridden
10876                  * advertising data will be visible right away.
10877                  */
10878                 cancel_adv_timeout(hdev);
10879
10880                 next_instance = hci_get_next_instance(hdev, cp->instance);
10881                 if (next_instance)
10882                         schedule_instance = next_instance->instance;
10883         } else if (!hdev->adv_instance_timeout) {
10884                 /* Immediately advertise the new instance if no other
10885                  * instance is currently being advertised.
10886                  */
10887                 schedule_instance = cp->instance;
10888         }
10889
10890         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
10891          * there is no instance to be advertised then we have no HCI
10892          * communication to make. Simply return.
10893          */
10894         if (!hdev_is_powered(hdev) ||
10895             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
10896             !schedule_instance) {
10897                 rp.instance = cp->instance;
10898                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10899                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10900                 goto unlock;
10901         }
10902
10903         /* We're good to go, update advertising data, parameters, and start
10904          * advertising.
10905          */
10906         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
10907                                data_len);
10908         if (!cmd) {
10909                 err = -ENOMEM;
10910                 goto unlock;
10911         }
10912
10913         cp->instance = schedule_instance;
10914
10915         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
10916                                  add_advertising_complete);
10917         if (err < 0)
10918                 mgmt_pending_free(cmd);
10919
10920 unlock:
10921         hci_dev_unlock(hdev);
10922
10923         return err;
10924 }
10925
10926 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
10927                                         int err)
10928 {
10929         struct mgmt_pending_cmd *cmd = data;
10930         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
10931         struct mgmt_rp_add_ext_adv_params rp;
10932         struct adv_info *adv;
10933         u32 flags;
10934
10935         BT_DBG("%s", hdev->name);
10936
10937         hci_dev_lock(hdev);
10938
10939         adv = hci_find_adv_instance(hdev, cp->instance);
10940         if (!adv)
10941                 goto unlock;
10942
10943         rp.instance = cp->instance;
10944         rp.tx_power = adv->tx_power;
10945
10946         /* While we're at it, inform userspace of the available space for this
10947          * advertisement, given the flags that will be used.
10948          */
10949         flags = __le32_to_cpu(cp->flags);
10950         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10951         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10952
10953         if (err) {
10954                 /* If this advertisement was previously advertising and we
10955                  * failed to update it, we signal that it has been removed and
10956                  * delete its structure
10957                  */
10958                 if (!adv->pending)
10959                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
10960
10961                 hci_remove_adv_instance(hdev, cp->instance);
10962
10963                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10964                                 mgmt_status(err));
10965         } else {
10966                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10967                                   mgmt_status(err), &rp, sizeof(rp));
10968         }
10969
10970 unlock:
10971         if (cmd)
10972                 mgmt_pending_free(cmd);
10973
10974         hci_dev_unlock(hdev);
10975 }
10976
10977 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
10978 {
10979         struct mgmt_pending_cmd *cmd = data;
10980         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
10981
10982         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
10983 }
10984
10985 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
10986                               void *data, u16 data_len)
10987 {
10988         struct mgmt_cp_add_ext_adv_params *cp = data;
10989         struct mgmt_rp_add_ext_adv_params rp;
10990         struct mgmt_pending_cmd *cmd = NULL;
10991         struct adv_info *adv;
10992         u32 flags, min_interval, max_interval;
10993         u16 timeout, duration;
10994         u8 status;
10995         s8 tx_power;
10996         int err;
10997
10998         BT_DBG("%s", hdev->name);
10999
11000         status = mgmt_le_support(hdev);
11001         if (status)
11002                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11003                                        status);
11004
11005         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
11006                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11007                                        MGMT_STATUS_INVALID_PARAMS);
11008
11009         /* The purpose of breaking add_advertising into two separate MGMT calls
11010          * for params and data is to allow more parameters to be added to this
11011          * structure in the future. For this reason, we verify that we have the
11012          * bare minimum structure we know of when the interface was defined. Any
11013          * extra parameters we don't know about will be ignored in this request.
11014          */
11015         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
11016                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11017                                        MGMT_STATUS_INVALID_PARAMS);
11018
11019         flags = __le32_to_cpu(cp->flags);
11020
11021         if (!requested_adv_flags_are_valid(hdev, flags))
11022                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11023                                        MGMT_STATUS_INVALID_PARAMS);
11024
11025         hci_dev_lock(hdev);
11026
11027         /* In new interface, we require that we are powered to register */
11028         if (!hdev_is_powered(hdev)) {
11029                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11030                                       MGMT_STATUS_REJECTED);
11031                 goto unlock;
11032         }
11033
11034         if (adv_busy(hdev)) {
11035                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11036                                       MGMT_STATUS_BUSY);
11037                 goto unlock;
11038         }
11039
11040         /* Parse defined parameters from request, use defaults otherwise */
11041         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
11042                   __le16_to_cpu(cp->timeout) : 0;
11043
11044         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
11045                    __le16_to_cpu(cp->duration) :
11046                    hdev->def_multi_adv_rotation_duration;
11047
11048         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
11049                        __le32_to_cpu(cp->min_interval) :
11050                        hdev->le_adv_min_interval;
11051
11052         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
11053                        __le32_to_cpu(cp->max_interval) :
11054                        hdev->le_adv_max_interval;
11055
11056         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
11057                    cp->tx_power :
11058                    HCI_ADV_TX_POWER_NO_PREFERENCE;
11059
11060         /* Create advertising instance with no advertising or response data */
11061         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
11062                                    timeout, duration, tx_power, min_interval,
11063                                    max_interval, 0);
11064
11065         if (IS_ERR(adv)) {
11066                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11067                                       MGMT_STATUS_FAILED);
11068                 goto unlock;
11069         }
11070
11071         /* Submit request for advertising params if ext adv available */
11072         if (ext_adv_capable(hdev)) {
11073                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
11074                                        data, data_len);
11075                 if (!cmd) {
11076                         err = -ENOMEM;
11077                         hci_remove_adv_instance(hdev, cp->instance);
11078                         goto unlock;
11079                 }
11080
11081                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
11082                                          add_ext_adv_params_complete);
11083                 if (err < 0)
11084                         mgmt_pending_free(cmd);
11085         } else {
11086                 rp.instance = cp->instance;
11087                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
11088                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
11089                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
11090                 err = mgmt_cmd_complete(sk, hdev->id,
11091                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
11092                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11093         }
11094
11095 unlock:
11096         hci_dev_unlock(hdev);
11097
11098         return err;
11099 }
11100
11101 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
11102 {
11103         struct mgmt_pending_cmd *cmd = data;
11104         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
11105         struct mgmt_rp_add_advertising rp;
11106
11107         add_adv_complete(hdev, cmd->sk, cp->instance, err);
11108
11109         memset(&rp, 0, sizeof(rp));
11110
11111         rp.instance = cp->instance;
11112
11113         if (err)
11114                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
11115                                 mgmt_status(err));
11116         else
11117                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
11118                                   mgmt_status(err), &rp, sizeof(rp));
11119
11120         mgmt_pending_free(cmd);
11121 }
11122
11123 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
11124 {
11125         struct mgmt_pending_cmd *cmd = data;
11126         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
11127         int err;
11128
11129         if (ext_adv_capable(hdev)) {
11130                 err = hci_update_adv_data_sync(hdev, cp->instance);
11131                 if (err)
11132                         return err;
11133
11134                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
11135                 if (err)
11136                         return err;
11137
11138                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
11139         }
11140
11141         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
11142 }
11143
11144 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
11145                             u16 data_len)
11146 {
11147         struct mgmt_cp_add_ext_adv_data *cp = data;
11148         struct mgmt_rp_add_ext_adv_data rp;
11149         u8 schedule_instance = 0;
11150         struct adv_info *next_instance;
11151         struct adv_info *adv_instance;
11152         int err = 0;
11153         struct mgmt_pending_cmd *cmd;
11154
11155         BT_DBG("%s", hdev->name);
11156
11157         hci_dev_lock(hdev);
11158
11159         adv_instance = hci_find_adv_instance(hdev, cp->instance);
11160
11161         if (!adv_instance) {
11162                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11163                                       MGMT_STATUS_INVALID_PARAMS);
11164                 goto unlock;
11165         }
11166
11167         /* In new interface, we require that we are powered to register */
11168         if (!hdev_is_powered(hdev)) {
11169                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11170                                       MGMT_STATUS_REJECTED);
11171                 goto clear_new_instance;
11172         }
11173
11174         if (adv_busy(hdev)) {
11175                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11176                                       MGMT_STATUS_BUSY);
11177                 goto clear_new_instance;
11178         }
11179
11180         /* Validate new data */
11181         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
11182                                cp->adv_data_len, true) ||
11183             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
11184                                cp->adv_data_len, cp->scan_rsp_len, false)) {
11185                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11186                                       MGMT_STATUS_INVALID_PARAMS);
11187                 goto clear_new_instance;
11188         }
11189
11190         /* Set the data in the advertising instance */
11191         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
11192                                   cp->data, cp->scan_rsp_len,
11193                                   cp->data + cp->adv_data_len);
11194
11195         /* If using software rotation, determine next instance to use */
11196         if (hdev->cur_adv_instance == cp->instance) {
11197                 /* If the currently advertised instance is being changed
11198                  * then cancel the current advertising and schedule the
11199                  * next instance. If there is only one instance then the
11200                  * overridden advertising data will be visible right
11201                  * away
11202                  */
11203                 cancel_adv_timeout(hdev);
11204
11205                 next_instance = hci_get_next_instance(hdev, cp->instance);
11206                 if (next_instance)
11207                         schedule_instance = next_instance->instance;
11208         } else if (!hdev->adv_instance_timeout) {
11209                 /* Immediately advertise the new instance if no other
11210                  * instance is currently being advertised.
11211                  */
11212                 schedule_instance = cp->instance;
11213         }
11214
11215         /* If the HCI_ADVERTISING flag is set or there is no instance to
11216          * be advertised then we have no HCI communication to make.
11217          * Simply return.
11218          */
11219         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
11220                 if (adv_instance->pending) {
11221                         mgmt_advertising_added(sk, hdev, cp->instance);
11222                         adv_instance->pending = false;
11223                 }
11224                 rp.instance = cp->instance;
11225                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11226                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11227                 goto unlock;
11228         }
11229
11230         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
11231                                data_len);
11232         if (!cmd) {
11233                 err = -ENOMEM;
11234                 goto clear_new_instance;
11235         }
11236
11237         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
11238                                  add_ext_adv_data_complete);
11239         if (err < 0) {
11240                 mgmt_pending_free(cmd);
11241                 goto clear_new_instance;
11242         }
11243
11244         /* We were successful in updating data, so trigger advertising_added
11245          * event if this is an instance that wasn't previously advertising. If
11246          * a failure occurs in the requests we initiated, we will remove the
11247          * instance again in add_advertising_complete
11248          */
11249         if (adv_instance->pending)
11250                 mgmt_advertising_added(sk, hdev, cp->instance);
11251
11252         goto unlock;
11253
11254 clear_new_instance:
11255         hci_remove_adv_instance(hdev, cp->instance);
11256
11257 unlock:
11258         hci_dev_unlock(hdev);
11259
11260         return err;
11261 }
11262
11263 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
11264                                         int err)
11265 {
11266         struct mgmt_pending_cmd *cmd = data;
11267         struct mgmt_cp_remove_advertising *cp = cmd->param;
11268         struct mgmt_rp_remove_advertising rp;
11269
11270         bt_dev_dbg(hdev, "err %d", err);
11271
11272         memset(&rp, 0, sizeof(rp));
11273         rp.instance = cp->instance;
11274
11275         if (err)
11276                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
11277                                 mgmt_status(err));
11278         else
11279                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
11280                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11281
11282         mgmt_pending_free(cmd);
11283 }
11284
11285 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
11286 {
11287         struct mgmt_pending_cmd *cmd = data;
11288         struct mgmt_cp_remove_advertising *cp = cmd->param;
11289         int err;
11290
11291         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
11292         if (err)
11293                 return err;
11294
11295         if (list_empty(&hdev->adv_instances))
11296                 err = hci_disable_advertising_sync(hdev);
11297
11298         return err;
11299 }
11300
11301 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
11302                               void *data, u16 data_len)
11303 {
11304         struct mgmt_cp_remove_advertising *cp = data;
11305         struct mgmt_pending_cmd *cmd;
11306         int err;
11307
11308         bt_dev_dbg(hdev, "sock %p", sk);
11309
11310         hci_dev_lock(hdev);
11311
11312         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
11313                 err = mgmt_cmd_status(sk, hdev->id,
11314                                       MGMT_OP_REMOVE_ADVERTISING,
11315                                       MGMT_STATUS_INVALID_PARAMS);
11316                 goto unlock;
11317         }
11318
11319         if (pending_find(MGMT_OP_SET_LE, hdev)) {
11320                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
11321                                       MGMT_STATUS_BUSY);
11322                 goto unlock;
11323         }
11324
11325         if (list_empty(&hdev->adv_instances)) {
11326                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
11327                                       MGMT_STATUS_INVALID_PARAMS);
11328                 goto unlock;
11329         }
11330
11331         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
11332                                data_len);
11333         if (!cmd) {
11334                 err = -ENOMEM;
11335                 goto unlock;
11336         }
11337
11338         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
11339                                  remove_advertising_complete);
11340         if (err < 0)
11341                 mgmt_pending_free(cmd);
11342
11343 unlock:
11344         hci_dev_unlock(hdev);
11345
11346         return err;
11347 }
11348
11349 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
11350                              void *data, u16 data_len)
11351 {
11352         struct mgmt_cp_get_adv_size_info *cp = data;
11353         struct mgmt_rp_get_adv_size_info rp;
11354         u32 flags, supported_flags;
11355
11356         bt_dev_dbg(hdev, "sock %p", sk);
11357
11358         if (!lmp_le_capable(hdev))
11359                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11360                                        MGMT_STATUS_REJECTED);
11361
11362         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
11363                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11364                                        MGMT_STATUS_INVALID_PARAMS);
11365
11366         flags = __le32_to_cpu(cp->flags);
11367
11368         /* The current implementation only supports a subset of the specified
11369          * flags.
11370          */
11371         supported_flags = get_supported_adv_flags(hdev);
11372         if (flags & ~supported_flags)
11373                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11374                                        MGMT_STATUS_INVALID_PARAMS);
11375
11376         rp.instance = cp->instance;
11377         rp.flags = cp->flags;
11378         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
11379         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
11380
11381         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11382                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11383 }
11384
11385 static const struct hci_mgmt_handler mgmt_handlers[] = {
11386         { NULL }, /* 0x0000 (no command) */
11387         { read_version,            MGMT_READ_VERSION_SIZE,
11388                                                 HCI_MGMT_NO_HDEV |
11389                                                 HCI_MGMT_UNTRUSTED },
11390         { read_commands,           MGMT_READ_COMMANDS_SIZE,
11391                                                 HCI_MGMT_NO_HDEV |
11392                                                 HCI_MGMT_UNTRUSTED },
11393         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
11394                                                 HCI_MGMT_NO_HDEV |
11395                                                 HCI_MGMT_UNTRUSTED },
11396         { read_controller_info,    MGMT_READ_INFO_SIZE,
11397                                                 HCI_MGMT_UNTRUSTED },
11398         { set_powered,             MGMT_SETTING_SIZE },
11399         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
11400         { set_connectable,         MGMT_SETTING_SIZE },
11401         { set_fast_connectable,    MGMT_SETTING_SIZE },
11402         { set_bondable,            MGMT_SETTING_SIZE },
11403         { set_link_security,       MGMT_SETTING_SIZE },
11404         { set_ssp,                 MGMT_SETTING_SIZE },
11405         { set_hs,                  MGMT_SETTING_SIZE },
11406         { set_le,                  MGMT_SETTING_SIZE },
11407         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
11408         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
11409         { add_uuid,                MGMT_ADD_UUID_SIZE },
11410         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
11411         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
11412                                                 HCI_MGMT_VAR_LEN },
11413         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
11414                                                 HCI_MGMT_VAR_LEN },
11415         { disconnect,              MGMT_DISCONNECT_SIZE },
11416         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
11417         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
11418         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
11419         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
11420         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
11421         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
11422         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
11423         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
11424         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
11425         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
11426         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
11427         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
11428         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
11429                                                 HCI_MGMT_VAR_LEN },
11430         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
11431         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
11432         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
11433         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
11434         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
11435         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
11436         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
11437         { set_advertising,         MGMT_SETTING_SIZE },
11438         { set_bredr,               MGMT_SETTING_SIZE },
11439         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
11440         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
11441         { set_secure_conn,         MGMT_SETTING_SIZE },
11442         { set_debug_keys,          MGMT_SETTING_SIZE },
11443         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
11444         { load_irks,               MGMT_LOAD_IRKS_SIZE,
11445                                                 HCI_MGMT_VAR_LEN },
11446         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
11447         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
11448         { add_device,              MGMT_ADD_DEVICE_SIZE },
11449         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
11450         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
11451                                                 HCI_MGMT_VAR_LEN },
11452         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
11453                                                 HCI_MGMT_NO_HDEV |
11454                                                 HCI_MGMT_UNTRUSTED },
11455         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
11456                                                 HCI_MGMT_UNCONFIGURED |
11457                                                 HCI_MGMT_UNTRUSTED },
11458         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
11459                                                 HCI_MGMT_UNCONFIGURED },
11460         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
11461                                                 HCI_MGMT_UNCONFIGURED },
11462         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
11463                                                 HCI_MGMT_VAR_LEN },
11464         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
11465         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
11466                                                 HCI_MGMT_NO_HDEV |
11467                                                 HCI_MGMT_UNTRUSTED },
11468         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
11469         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
11470                                                 HCI_MGMT_VAR_LEN },
11471         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
11472         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
11473         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
11474         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
11475                                                 HCI_MGMT_UNTRUSTED },
11476         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
11477         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
11478         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
11479         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
11480                                                 HCI_MGMT_VAR_LEN },
11481         { set_wideband_speech,     MGMT_SETTING_SIZE },
11482         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
11483                                                 HCI_MGMT_UNTRUSTED },
11484         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
11485                                                 HCI_MGMT_UNTRUSTED |
11486                                                 HCI_MGMT_HDEV_OPTIONAL },
11487         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
11488                                                 HCI_MGMT_VAR_LEN |
11489                                                 HCI_MGMT_HDEV_OPTIONAL },
11490         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
11491                                                 HCI_MGMT_UNTRUSTED },
11492         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
11493                                                 HCI_MGMT_VAR_LEN },
11494         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
11495                                                 HCI_MGMT_UNTRUSTED },
11496         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
11497                                                 HCI_MGMT_VAR_LEN },
11498         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
11499         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
11500         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
11501         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
11502                                                 HCI_MGMT_VAR_LEN },
11503         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
11504         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
11505                                                 HCI_MGMT_VAR_LEN },
11506         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
11507                                                 HCI_MGMT_VAR_LEN },
11508         { add_adv_patterns_monitor_rssi,
11509                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
11510                                                 HCI_MGMT_VAR_LEN },
11511         { set_mesh,                MGMT_SET_MESH_RECEIVER_SIZE,
11512                                                 HCI_MGMT_VAR_LEN },
11513         { mesh_features,           MGMT_MESH_READ_FEATURES_SIZE },
11514         { mesh_send,               MGMT_MESH_SEND_SIZE,
11515                                                 HCI_MGMT_VAR_LEN },
11516         { mesh_send_cancel,        MGMT_MESH_SEND_CANCEL_SIZE },
11517 };
11518
11519 #ifdef TIZEN_BT
11520 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
11521         { NULL }, /* 0x0000 (no command) */
11522         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
11523         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
11524                                                 HCI_MGMT_VAR_LEN },
11525         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
11526                                                 HCI_MGMT_VAR_LEN },
11527         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
11528         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
11529         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
11530         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
11531         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
11532         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
11533         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
11534         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
11535         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
11536         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
11537         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
11538         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
11539         { set_voice_setting,       MGMT_SET_VOICE_SETTING_SIZE },
11540         { get_adv_tx_power,        MGMT_GET_ADV_TX_POWER_SIZE },
11541         { enable_bt_6lowpan,       MGMT_ENABLE_BT_6LOWPAN_SIZE },
11542         { connect_bt_6lowpan,      MGMT_CONNECT_6LOWPAN_SIZE },
11543         { disconnect_bt_6lowpan,   MGMT_DISCONNECT_6LOWPAN_SIZE },
11544         { read_maximum_le_data_length,
11545                                    MGMT_LE_READ_MAXIMUM_DATA_LENGTH_SIZE },
11546 };
11547 #endif
11548
11549 void mgmt_index_added(struct hci_dev *hdev)
11550 {
11551         struct mgmt_ev_ext_index ev;
11552
11553         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
11554                 return;
11555
11556         switch (hdev->dev_type) {
11557         case HCI_PRIMARY:
11558                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
11559                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
11560                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
11561                         ev.type = 0x01;
11562                 } else {
11563                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
11564                                          HCI_MGMT_INDEX_EVENTS);
11565                         ev.type = 0x00;
11566                 }
11567                 break;
11568         case HCI_AMP:
11569                 ev.type = 0x02;
11570                 break;
11571         default:
11572                 return;
11573         }
11574
11575         ev.bus = hdev->bus;
11576
11577         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
11578                          HCI_MGMT_EXT_INDEX_EVENTS);
11579 }
11580
11581 void mgmt_index_removed(struct hci_dev *hdev)
11582 {
11583         struct mgmt_ev_ext_index ev;
11584         u8 status = MGMT_STATUS_INVALID_INDEX;
11585
11586         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
11587                 return;
11588
11589         switch (hdev->dev_type) {
11590         case HCI_PRIMARY:
11591                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
11592
11593                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
11594                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
11595                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
11596                         ev.type = 0x01;
11597                 } else {
11598                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
11599                                          HCI_MGMT_INDEX_EVENTS);
11600                         ev.type = 0x00;
11601                 }
11602                 break;
11603         case HCI_AMP:
11604                 ev.type = 0x02;
11605                 break;
11606         default:
11607                 return;
11608         }
11609
11610         ev.bus = hdev->bus;
11611
11612         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
11613                          HCI_MGMT_EXT_INDEX_EVENTS);
11614
11615         /* Cancel any remaining timed work */
11616         if (!hci_dev_test_flag(hdev, HCI_MGMT))
11617                 return;
11618         cancel_delayed_work_sync(&hdev->discov_off);
11619         cancel_delayed_work_sync(&hdev->service_cache);
11620         cancel_delayed_work_sync(&hdev->rpa_expired);
11621 }
11622
11623 void mgmt_power_on(struct hci_dev *hdev, int err)
11624 {
11625         struct cmd_lookup match = { NULL, hdev };
11626
11627         bt_dev_dbg(hdev, "err %d", err);
11628
11629         hci_dev_lock(hdev);
11630
11631         if (!err) {
11632                 restart_le_actions(hdev);
11633                 hci_update_passive_scan(hdev);
11634         }
11635
11636         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
11637
11638         new_settings(hdev, match.sk);
11639
11640         if (match.sk)
11641                 sock_put(match.sk);
11642
11643         hci_dev_unlock(hdev);
11644 }
11645
11646 void __mgmt_power_off(struct hci_dev *hdev)
11647 {
11648         struct cmd_lookup match = { NULL, hdev };
11649         u8 status, zero_cod[] = { 0, 0, 0 };
11650
11651         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
11652
11653         /* If the power off is because of hdev unregistration let
11654          * use the appropriate INVALID_INDEX status. Otherwise use
11655          * NOT_POWERED. We cover both scenarios here since later in
11656          * mgmt_index_removed() any hci_conn callbacks will have already
11657          * been triggered, potentially causing misleading DISCONNECTED
11658          * status responses.
11659          */
11660         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
11661                 status = MGMT_STATUS_INVALID_INDEX;
11662         else
11663                 status = MGMT_STATUS_NOT_POWERED;
11664
11665         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
11666
11667         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
11668                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
11669                                    zero_cod, sizeof(zero_cod),
11670                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11671                 ext_info_changed(hdev, NULL);
11672         }
11673
11674         new_settings(hdev, match.sk);
11675
11676         if (match.sk)
11677                 sock_put(match.sk);
11678 }
11679
11680 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
11681 {
11682         struct mgmt_pending_cmd *cmd;
11683         u8 status;
11684
11685         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11686         if (!cmd)
11687                 return;
11688
11689         if (err == -ERFKILL)
11690                 status = MGMT_STATUS_RFKILLED;
11691         else
11692                 status = MGMT_STATUS_FAILED;
11693
11694         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
11695
11696         mgmt_pending_remove(cmd);
11697 }
11698
11699 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
11700                        bool persistent)
11701 {
11702         struct mgmt_ev_new_link_key ev;
11703
11704         memset(&ev, 0, sizeof(ev));
11705
11706         ev.store_hint = persistent;
11707         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11708         ev.key.addr.type = BDADDR_BREDR;
11709         ev.key.type = key->type;
11710         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
11711         ev.key.pin_len = key->pin_len;
11712
11713         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
11714 }
11715
11716 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
11717 {
11718         switch (ltk->type) {
11719         case SMP_LTK:
11720         case SMP_LTK_RESPONDER:
11721                 if (ltk->authenticated)
11722                         return MGMT_LTK_AUTHENTICATED;
11723                 return MGMT_LTK_UNAUTHENTICATED;
11724         case SMP_LTK_P256:
11725                 if (ltk->authenticated)
11726                         return MGMT_LTK_P256_AUTH;
11727                 return MGMT_LTK_P256_UNAUTH;
11728         case SMP_LTK_P256_DEBUG:
11729                 return MGMT_LTK_P256_DEBUG;
11730         }
11731
11732         return MGMT_LTK_UNAUTHENTICATED;
11733 }
11734
11735 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
11736 {
11737         struct mgmt_ev_new_long_term_key ev;
11738
11739         memset(&ev, 0, sizeof(ev));
11740
11741         /* Devices using resolvable or non-resolvable random addresses
11742          * without providing an identity resolving key don't require
11743          * to store long term keys. Their addresses will change the
11744          * next time around.
11745          *
11746          * Only when a remote device provides an identity address
11747          * make sure the long term key is stored. If the remote
11748          * identity is known, the long term keys are internally
11749          * mapped to the identity address. So allow static random
11750          * and public addresses here.
11751          */
11752         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11753             (key->bdaddr.b[5] & 0xc0) != 0xc0)
11754                 ev.store_hint = 0x00;
11755         else
11756                 ev.store_hint = persistent;
11757
11758         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11759         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
11760         ev.key.type = mgmt_ltk_type(key);
11761         ev.key.enc_size = key->enc_size;
11762         ev.key.ediv = key->ediv;
11763         ev.key.rand = key->rand;
11764
11765         if (key->type == SMP_LTK)
11766                 ev.key.initiator = 1;
11767
11768         /* Make sure we copy only the significant bytes based on the
11769          * encryption key size, and set the rest of the value to zeroes.
11770          */
11771         memcpy(ev.key.val, key->val, key->enc_size);
11772         memset(ev.key.val + key->enc_size, 0,
11773                sizeof(ev.key.val) - key->enc_size);
11774
11775         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
11776 }
11777
11778 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
11779 {
11780         struct mgmt_ev_new_irk ev;
11781
11782         memset(&ev, 0, sizeof(ev));
11783
11784         ev.store_hint = persistent;
11785
11786         bacpy(&ev.rpa, &irk->rpa);
11787         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
11788         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
11789         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
11790
11791         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
11792 }
11793
11794 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
11795                    bool persistent)
11796 {
11797         struct mgmt_ev_new_csrk ev;
11798
11799         memset(&ev, 0, sizeof(ev));
11800
11801         /* Devices using resolvable or non-resolvable random addresses
11802          * without providing an identity resolving key don't require
11803          * to store signature resolving keys. Their addresses will change
11804          * the next time around.
11805          *
11806          * Only when a remote device provides an identity address
11807          * make sure the signature resolving key is stored. So allow
11808          * static random and public addresses here.
11809          */
11810         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11811             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
11812                 ev.store_hint = 0x00;
11813         else
11814                 ev.store_hint = persistent;
11815
11816         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
11817         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
11818         ev.key.type = csrk->type;
11819         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
11820
11821         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
11822 }
11823
11824 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
11825                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
11826                          u16 max_interval, u16 latency, u16 timeout)
11827 {
11828         struct mgmt_ev_new_conn_param ev;
11829
11830         if (!hci_is_identity_address(bdaddr, bdaddr_type))
11831                 return;
11832
11833         memset(&ev, 0, sizeof(ev));
11834         bacpy(&ev.addr.bdaddr, bdaddr);
11835         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
11836         ev.store_hint = store_hint;
11837         ev.min_interval = cpu_to_le16(min_interval);
11838         ev.max_interval = cpu_to_le16(max_interval);
11839         ev.latency = cpu_to_le16(latency);
11840         ev.timeout = cpu_to_le16(timeout);
11841
11842         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
11843 }
11844
11845 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
11846                            u8 *name, u8 name_len)
11847 {
11848         struct sk_buff *skb;
11849         struct mgmt_ev_device_connected *ev;
11850         u16 eir_len = 0;
11851         u32 flags = 0;
11852
11853         /* allocate buff for LE or BR/EDR adv */
11854         if (conn->le_adv_data_len > 0)
11855                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
11856                                      sizeof(*ev) + conn->le_adv_data_len);
11857         else
11858                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
11859                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
11860                                      eir_precalc_len(sizeof(conn->dev_class)));
11861
11862         ev = skb_put(skb, sizeof(*ev));
11863         bacpy(&ev->addr.bdaddr, &conn->dst);
11864         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11865
11866         if (conn->out)
11867                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
11868
11869         ev->flags = __cpu_to_le32(flags);
11870
11871         /* We must ensure that the EIR Data fields are ordered and
11872          * unique. Keep it simple for now and avoid the problem by not
11873          * adding any BR/EDR data to the LE adv.
11874          */
11875         if (conn->le_adv_data_len > 0) {
11876                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
11877                 eir_len = conn->le_adv_data_len;
11878         } else {
11879                 if (name)
11880                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
11881
11882                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
11883                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
11884                                                     conn->dev_class, sizeof(conn->dev_class));
11885         }
11886
11887         ev->eir_len = cpu_to_le16(eir_len);
11888
11889         mgmt_event_skb(skb, NULL);
11890 }
11891
11892 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
11893 {
11894         struct sock **sk = data;
11895
11896         cmd->cmd_complete(cmd, 0);
11897
11898         *sk = cmd->sk;
11899         sock_hold(*sk);
11900
11901         mgmt_pending_remove(cmd);
11902 }
11903
11904 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
11905 {
11906         struct hci_dev *hdev = data;
11907         struct mgmt_cp_unpair_device *cp = cmd->param;
11908
11909         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
11910
11911         cmd->cmd_complete(cmd, 0);
11912         mgmt_pending_remove(cmd);
11913 }
11914
11915 bool mgmt_powering_down(struct hci_dev *hdev)
11916 {
11917         struct mgmt_pending_cmd *cmd;
11918         struct mgmt_mode *cp;
11919
11920         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11921         if (!cmd)
11922                 return false;
11923
11924         cp = cmd->param;
11925         if (!cp->val)
11926                 return true;
11927
11928         return false;
11929 }
11930
11931 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
11932                               u8 link_type, u8 addr_type, u8 reason,
11933                               bool mgmt_connected)
11934 {
11935         struct mgmt_ev_device_disconnected ev;
11936         struct sock *sk = NULL;
11937
11938         /* The connection is still in hci_conn_hash so test for 1
11939          * instead of 0 to know if this is the last one.
11940          */
11941         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11942                 cancel_delayed_work(&hdev->power_off);
11943                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11944         }
11945
11946         if (!mgmt_connected)
11947                 return;
11948
11949         if (link_type != ACL_LINK && link_type != LE_LINK)
11950                 return;
11951
11952         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
11953
11954         bacpy(&ev.addr.bdaddr, bdaddr);
11955         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11956         ev.reason = reason;
11957
11958         /* Report disconnects due to suspend */
11959         if (hdev->suspended)
11960                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
11961
11962         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
11963
11964         if (sk)
11965                 sock_put(sk);
11966
11967         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11968                              hdev);
11969 }
11970
11971 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
11972                             u8 link_type, u8 addr_type, u8 status)
11973 {
11974         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
11975         struct mgmt_cp_disconnect *cp;
11976         struct mgmt_pending_cmd *cmd;
11977
11978         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11979                              hdev);
11980
11981         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
11982         if (!cmd)
11983                 return;
11984
11985         cp = cmd->param;
11986
11987         if (bacmp(bdaddr, &cp->addr.bdaddr))
11988                 return;
11989
11990         if (cp->addr.type != bdaddr_type)
11991                 return;
11992
11993         cmd->cmd_complete(cmd, mgmt_status(status));
11994         mgmt_pending_remove(cmd);
11995 }
11996
11997 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11998                          u8 addr_type, u8 status)
11999 {
12000         struct mgmt_ev_connect_failed ev;
12001
12002         /* The connection is still in hci_conn_hash so test for 1
12003          * instead of 0 to know if this is the last one.
12004          */
12005         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
12006                 cancel_delayed_work(&hdev->power_off);
12007                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
12008         }
12009
12010         bacpy(&ev.addr.bdaddr, bdaddr);
12011         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12012         ev.status = mgmt_status(status);
12013
12014         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
12015 }
12016
12017 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
12018 {
12019         struct mgmt_ev_pin_code_request ev;
12020
12021         bacpy(&ev.addr.bdaddr, bdaddr);
12022         ev.addr.type = BDADDR_BREDR;
12023         ev.secure = secure;
12024
12025         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
12026 }
12027
12028 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12029                                   u8 status)
12030 {
12031         struct mgmt_pending_cmd *cmd;
12032
12033         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
12034         if (!cmd)
12035                 return;
12036
12037         cmd->cmd_complete(cmd, mgmt_status(status));
12038         mgmt_pending_remove(cmd);
12039 }
12040
12041 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12042                                       u8 status)
12043 {
12044         struct mgmt_pending_cmd *cmd;
12045
12046         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
12047         if (!cmd)
12048                 return;
12049
12050         cmd->cmd_complete(cmd, mgmt_status(status));
12051         mgmt_pending_remove(cmd);
12052 }
12053
12054 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
12055                               u8 link_type, u8 addr_type, u32 value,
12056                               u8 confirm_hint)
12057 {
12058         struct mgmt_ev_user_confirm_request ev;
12059
12060         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
12061
12062         bacpy(&ev.addr.bdaddr, bdaddr);
12063         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12064         ev.confirm_hint = confirm_hint;
12065         ev.value = cpu_to_le32(value);
12066
12067         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
12068                           NULL);
12069 }
12070
12071 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
12072                               u8 link_type, u8 addr_type)
12073 {
12074         struct mgmt_ev_user_passkey_request ev;
12075
12076         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
12077
12078         bacpy(&ev.addr.bdaddr, bdaddr);
12079         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12080
12081         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
12082                           NULL);
12083 }
12084
12085 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12086                                       u8 link_type, u8 addr_type, u8 status,
12087                                       u8 opcode)
12088 {
12089         struct mgmt_pending_cmd *cmd;
12090
12091         cmd = pending_find(opcode, hdev);
12092         if (!cmd)
12093                 return -ENOENT;
12094
12095         cmd->cmd_complete(cmd, mgmt_status(status));
12096         mgmt_pending_remove(cmd);
12097
12098         return 0;
12099 }
12100
12101 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12102                                      u8 link_type, u8 addr_type, u8 status)
12103 {
12104         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12105                                           status, MGMT_OP_USER_CONFIRM_REPLY);
12106 }
12107
12108 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12109                                          u8 link_type, u8 addr_type, u8 status)
12110 {
12111         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12112                                           status,
12113                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
12114 }
12115
12116 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12117                                      u8 link_type, u8 addr_type, u8 status)
12118 {
12119         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12120                                           status, MGMT_OP_USER_PASSKEY_REPLY);
12121 }
12122
12123 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12124                                          u8 link_type, u8 addr_type, u8 status)
12125 {
12126         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12127                                           status,
12128                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
12129 }
12130
12131 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
12132                              u8 link_type, u8 addr_type, u32 passkey,
12133                              u8 entered)
12134 {
12135         struct mgmt_ev_passkey_notify ev;
12136
12137         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
12138
12139         bacpy(&ev.addr.bdaddr, bdaddr);
12140         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12141         ev.passkey = __cpu_to_le32(passkey);
12142         ev.entered = entered;
12143
12144         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
12145 }
12146
12147 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
12148 {
12149         struct mgmt_ev_auth_failed ev;
12150         struct mgmt_pending_cmd *cmd;
12151         u8 status = mgmt_status(hci_status);
12152
12153         bacpy(&ev.addr.bdaddr, &conn->dst);
12154         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
12155         ev.status = status;
12156
12157         cmd = find_pairing(conn);
12158
12159         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
12160                     cmd ? cmd->sk : NULL);
12161
12162         if (cmd) {
12163                 cmd->cmd_complete(cmd, status);
12164                 mgmt_pending_remove(cmd);
12165         }
12166 }
12167
12168 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
12169 {
12170         struct cmd_lookup match = { NULL, hdev };
12171         bool changed;
12172
12173         if (status) {
12174                 u8 mgmt_err = mgmt_status(status);
12175                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
12176                                      cmd_status_rsp, &mgmt_err);
12177                 return;
12178         }
12179
12180         if (test_bit(HCI_AUTH, &hdev->flags))
12181                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
12182         else
12183                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
12184
12185         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
12186                              &match);
12187
12188         if (changed)
12189                 new_settings(hdev, match.sk);
12190
12191         if (match.sk)
12192                 sock_put(match.sk);
12193 }
12194
12195 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
12196 {
12197         struct cmd_lookup *match = data;
12198
12199         if (match->sk == NULL) {
12200                 match->sk = cmd->sk;
12201                 sock_hold(match->sk);
12202         }
12203 }
12204
12205 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
12206                                     u8 status)
12207 {
12208         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
12209
12210         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
12211         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
12212         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
12213
12214         if (!status) {
12215                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
12216                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
12217                 ext_info_changed(hdev, NULL);
12218         }
12219
12220         if (match.sk)
12221                 sock_put(match.sk);
12222 }
12223
12224 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
12225 {
12226         struct mgmt_cp_set_local_name ev;
12227         struct mgmt_pending_cmd *cmd;
12228
12229         if (status)
12230                 return;
12231
12232         memset(&ev, 0, sizeof(ev));
12233         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
12234         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
12235
12236         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
12237         if (!cmd) {
12238                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
12239
12240                 /* If this is a HCI command related to powering on the
12241                  * HCI dev don't send any mgmt signals.
12242                  */
12243                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
12244                         return;
12245         }
12246
12247         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
12248                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
12249         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
12250 }
12251
12252 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
12253 {
12254         int i;
12255
12256         for (i = 0; i < uuid_count; i++) {
12257                 if (!memcmp(uuid, uuids[i], 16))
12258                         return true;
12259         }
12260
12261         return false;
12262 }
12263
12264 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
12265 {
12266         u16 parsed = 0;
12267
12268         while (parsed < eir_len) {
12269                 u8 field_len = eir[0];
12270                 u8 uuid[16];
12271                 int i;
12272
12273                 if (field_len == 0)
12274                         break;
12275
12276                 if (eir_len - parsed < field_len + 1)
12277                         break;
12278
12279                 switch (eir[1]) {
12280                 case EIR_UUID16_ALL:
12281                 case EIR_UUID16_SOME:
12282                         for (i = 0; i + 3 <= field_len; i += 2) {
12283                                 memcpy(uuid, bluetooth_base_uuid, 16);
12284                                 uuid[13] = eir[i + 3];
12285                                 uuid[12] = eir[i + 2];
12286                                 if (has_uuid(uuid, uuid_count, uuids))
12287                                         return true;
12288                         }
12289                         break;
12290                 case EIR_UUID32_ALL:
12291                 case EIR_UUID32_SOME:
12292                         for (i = 0; i + 5 <= field_len; i += 4) {
12293                                 memcpy(uuid, bluetooth_base_uuid, 16);
12294                                 uuid[15] = eir[i + 5];
12295                                 uuid[14] = eir[i + 4];
12296                                 uuid[13] = eir[i + 3];
12297                                 uuid[12] = eir[i + 2];
12298                                 if (has_uuid(uuid, uuid_count, uuids))
12299                                         return true;
12300                         }
12301                         break;
12302                 case EIR_UUID128_ALL:
12303                 case EIR_UUID128_SOME:
12304                         for (i = 0; i + 17 <= field_len; i += 16) {
12305                                 memcpy(uuid, eir + i + 2, 16);
12306                                 if (has_uuid(uuid, uuid_count, uuids))
12307                                         return true;
12308                         }
12309                         break;
12310                 }
12311
12312                 parsed += field_len + 1;
12313                 eir += field_len + 1;
12314         }
12315
12316         return false;
12317 }
12318
12319 static void restart_le_scan(struct hci_dev *hdev)
12320 {
12321         /* If controller is not scanning we are done. */
12322         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
12323                 return;
12324
12325         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
12326                        hdev->discovery.scan_start +
12327                        hdev->discovery.scan_duration))
12328                 return;
12329
12330         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
12331                            DISCOV_LE_RESTART_DELAY);
12332 }
12333
12334 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
12335                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
12336 {
12337         /* If a RSSI threshold has been specified, and
12338          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
12339          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
12340          * is set, let it through for further processing, as we might need to
12341          * restart the scan.
12342          *
12343          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
12344          * the results are also dropped.
12345          */
12346         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
12347             (rssi == HCI_RSSI_INVALID ||
12348             (rssi < hdev->discovery.rssi &&
12349              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
12350                 return  false;
12351
12352         if (hdev->discovery.uuid_count != 0) {
12353                 /* If a list of UUIDs is provided in filter, results with no
12354                  * matching UUID should be dropped.
12355                  */
12356                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
12357                                    hdev->discovery.uuids) &&
12358                     !eir_has_uuids(scan_rsp, scan_rsp_len,
12359                                    hdev->discovery.uuid_count,
12360                                    hdev->discovery.uuids))
12361                         return false;
12362         }
12363
12364         /* If duplicate filtering does not report RSSI changes, then restart
12365          * scanning to ensure updated result with updated RSSI values.
12366          */
12367         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
12368                 restart_le_scan(hdev);
12369
12370                 /* Validate RSSI value against the RSSI threshold once more. */
12371                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
12372                     rssi < hdev->discovery.rssi)
12373                         return false;
12374         }
12375
12376         return true;
12377 }
12378
12379 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
12380                                   bdaddr_t *bdaddr, u8 addr_type)
12381 {
12382         struct mgmt_ev_adv_monitor_device_lost ev;
12383
12384         ev.monitor_handle = cpu_to_le16(handle);
12385         bacpy(&ev.addr.bdaddr, bdaddr);
12386         ev.addr.type = addr_type;
12387
12388         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
12389                    NULL);
12390 }
12391
12392 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
12393                                                struct sk_buff *skb,
12394                                                struct sock *skip_sk,
12395                                                u16 handle)
12396 {
12397         struct sk_buff *advmon_skb;
12398         size_t advmon_skb_len;
12399         __le16 *monitor_handle;
12400
12401         if (!skb)
12402                 return;
12403
12404         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
12405                           sizeof(struct mgmt_ev_device_found)) + skb->len;
12406         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
12407                                     advmon_skb_len);
12408         if (!advmon_skb)
12409                 return;
12410
12411         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
12412          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
12413          * store monitor_handle of the matched monitor.
12414          */
12415         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
12416         *monitor_handle = cpu_to_le16(handle);
12417         skb_put_data(advmon_skb, skb->data, skb->len);
12418
12419         mgmt_event_skb(advmon_skb, skip_sk);
12420 }
12421
12422 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
12423                                           bdaddr_t *bdaddr, bool report_device,
12424                                           struct sk_buff *skb,
12425                                           struct sock *skip_sk)
12426 {
12427         struct monitored_device *dev, *tmp;
12428         bool matched = false;
12429         bool notified = false;
12430
12431         /* We have received the Advertisement Report because:
12432          * 1. the kernel has initiated active discovery
12433          * 2. if not, we have pend_le_reports > 0 in which case we are doing
12434          *    passive scanning
12435          * 3. if none of the above is true, we have one or more active
12436          *    Advertisement Monitor
12437          *
12438          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
12439          * and report ONLY one advertisement per device for the matched Monitor
12440          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
12441          *
12442          * For case 3, since we are not active scanning and all advertisements
12443          * received are due to a matched Advertisement Monitor, report all
12444          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
12445          */
12446         if (report_device && !hdev->advmon_pend_notify) {
12447                 mgmt_event_skb(skb, skip_sk);
12448                 return;
12449         }
12450
12451         hdev->advmon_pend_notify = false;
12452
12453         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
12454                 if (!bacmp(&dev->bdaddr, bdaddr)) {
12455                         matched = true;
12456
12457                         if (!dev->notified) {
12458                                 mgmt_send_adv_monitor_device_found(hdev, skb,
12459                                                                    skip_sk,
12460                                                                    dev->handle);
12461                                 notified = true;
12462                                 dev->notified = true;
12463                         }
12464                 }
12465
12466                 if (!dev->notified)
12467                         hdev->advmon_pend_notify = true;
12468         }
12469
12470         if (!report_device &&
12471             ((matched && !notified) || !msft_monitor_supported(hdev))) {
12472                 /* Handle 0 indicates that we are not active scanning and this
12473                  * is a subsequent advertisement report for an already matched
12474                  * Advertisement Monitor or the controller offloading support
12475                  * is not available.
12476                  */
12477                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
12478         }
12479
12480         if (report_device)
12481                 mgmt_event_skb(skb, skip_sk);
12482         else
12483                 kfree_skb(skb);
12484 }
12485
12486 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
12487                               u8 addr_type, s8 rssi, u32 flags, u8 *eir,
12488                               u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
12489                               u64 instant)
12490 {
12491         struct sk_buff *skb;
12492         struct mgmt_ev_mesh_device_found *ev;
12493         int i, j;
12494
12495         if (!hdev->mesh_ad_types[0])
12496                 goto accepted;
12497
12498         /* Scan for requested AD types */
12499         if (eir_len > 0) {
12500                 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
12501                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
12502                                 if (!hdev->mesh_ad_types[j])
12503                                         break;
12504
12505                                 if (hdev->mesh_ad_types[j] == eir[i + 1])
12506                                         goto accepted;
12507                         }
12508                 }
12509         }
12510
12511         if (scan_rsp_len > 0) {
12512                 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
12513                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
12514                                 if (!hdev->mesh_ad_types[j])
12515                                         break;
12516
12517                                 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
12518                                         goto accepted;
12519                         }
12520                 }
12521         }
12522
12523         return;
12524
12525 accepted:
12526         skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
12527                              sizeof(*ev) + eir_len + scan_rsp_len);
12528         if (!skb)
12529                 return;
12530
12531         ev = skb_put(skb, sizeof(*ev));
12532
12533         bacpy(&ev->addr.bdaddr, bdaddr);
12534         ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
12535         ev->rssi = rssi;
12536         ev->flags = cpu_to_le32(flags);
12537         ev->instant = cpu_to_le64(instant);
12538
12539         if (eir_len > 0)
12540                 /* Copy EIR or advertising data into event */
12541                 skb_put_data(skb, eir, eir_len);
12542
12543         if (scan_rsp_len > 0)
12544                 /* Append scan response data to event */
12545                 skb_put_data(skb, scan_rsp, scan_rsp_len);
12546
12547         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
12548
12549         mgmt_event_skb(skb, NULL);
12550 }
12551
12552 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
12553                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
12554                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
12555                        u64 instant)
12556 {
12557         struct sk_buff *skb;
12558         struct mgmt_ev_device_found *ev;
12559         bool report_device = hci_discovery_active(hdev);
12560
12561         if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
12562                 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
12563                                   eir, eir_len, scan_rsp, scan_rsp_len,
12564                                   instant);
12565
12566         /* Don't send events for a non-kernel initiated discovery. With
12567          * LE one exception is if we have pend_le_reports > 0 in which
12568          * case we're doing passive scanning and want these events.
12569          */
12570         if (!hci_discovery_active(hdev)) {
12571                 if (link_type == ACL_LINK)
12572                         return;
12573                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
12574                         report_device = true;
12575                 else if (!hci_is_adv_monitoring(hdev))
12576                         return;
12577         }
12578
12579         if (hdev->discovery.result_filtering) {
12580                 /* We are using service discovery */
12581                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
12582                                      scan_rsp_len))
12583                         return;
12584         }
12585
12586         if (hdev->discovery.limited) {
12587                 /* Check for limited discoverable bit */
12588                 if (dev_class) {
12589                         if (!(dev_class[1] & 0x20))
12590                                 return;
12591                 } else {
12592                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
12593                         if (!flags || !(flags[0] & LE_AD_LIMITED))
12594                                 return;
12595                 }
12596         }
12597
12598         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
12599         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
12600                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
12601         if (!skb)
12602                 return;
12603
12604         ev = skb_put(skb, sizeof(*ev));
12605
12606         /* In case of device discovery with BR/EDR devices (pre 1.2), the
12607          * RSSI value was reported as 0 when not available. This behavior
12608          * is kept when using device discovery. This is required for full
12609          * backwards compatibility with the API.
12610          *
12611          * However when using service discovery, the value 127 will be
12612          * returned when the RSSI is not available.
12613          */
12614         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
12615             link_type == ACL_LINK)
12616                 rssi = 0;
12617
12618         bacpy(&ev->addr.bdaddr, bdaddr);
12619         ev->addr.type = link_to_bdaddr(link_type, addr_type);
12620         ev->rssi = rssi;
12621         ev->flags = cpu_to_le32(flags);
12622
12623         if (eir_len > 0)
12624                 /* Copy EIR or advertising data into event */
12625                 skb_put_data(skb, eir, eir_len);
12626
12627         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
12628                 u8 eir_cod[5];
12629
12630                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
12631                                            dev_class, 3);
12632                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
12633         }
12634
12635         if (scan_rsp_len > 0)
12636                 /* Append scan response data to event */
12637                 skb_put_data(skb, scan_rsp, scan_rsp_len);
12638
12639         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
12640
12641         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
12642 }
12643
12644 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
12645                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
12646 {
12647         struct sk_buff *skb;
12648         struct mgmt_ev_device_found *ev;
12649         u16 eir_len = 0;
12650         u32 flags = 0;
12651
12652         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
12653                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
12654
12655         ev = skb_put(skb, sizeof(*ev));
12656         bacpy(&ev->addr.bdaddr, bdaddr);
12657         ev->addr.type = link_to_bdaddr(link_type, addr_type);
12658         ev->rssi = rssi;
12659
12660         if (name)
12661                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
12662         else
12663                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
12664
12665         ev->eir_len = cpu_to_le16(eir_len);
12666         ev->flags = cpu_to_le32(flags);
12667
12668         mgmt_event_skb(skb, NULL);
12669 }
12670
12671 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
12672 {
12673         struct mgmt_ev_discovering ev;
12674
12675         bt_dev_dbg(hdev, "discovering %u", discovering);
12676
12677         memset(&ev, 0, sizeof(ev));
12678         ev.type = hdev->discovery.type;
12679         ev.discovering = discovering;
12680
12681         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
12682 }
12683
12684 void mgmt_suspending(struct hci_dev *hdev, u8 state)
12685 {
12686         struct mgmt_ev_controller_suspend ev;
12687
12688         ev.suspend_state = state;
12689         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
12690 }
12691
12692 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
12693                    u8 addr_type)
12694 {
12695         struct mgmt_ev_controller_resume ev;
12696
12697         ev.wake_reason = reason;
12698         if (bdaddr) {
12699                 bacpy(&ev.addr.bdaddr, bdaddr);
12700                 ev.addr.type = addr_type;
12701         } else {
12702                 memset(&ev.addr, 0, sizeof(ev.addr));
12703         }
12704
12705         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
12706 }
12707
12708 static struct hci_mgmt_chan chan = {
12709         .channel        = HCI_CHANNEL_CONTROL,
12710         .handler_count  = ARRAY_SIZE(mgmt_handlers),
12711         .handlers       = mgmt_handlers,
12712 #ifdef TIZEN_BT
12713         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
12714         .tizen_handlers = tizen_mgmt_handlers,
12715 #endif
12716         .hdev_init      = mgmt_init_hdev,
12717 };
12718
12719 int mgmt_init(void)
12720 {
12721         return hci_mgmt_chan_register(&chan);
12722 }
12723
12724 void mgmt_exit(void)
12725 {
12726         hci_mgmt_chan_unregister(&chan);
12727 }
12728
12729 void mgmt_cleanup(struct sock *sk)
12730 {
12731         struct mgmt_mesh_tx *mesh_tx;
12732         struct hci_dev *hdev;
12733
12734         read_lock(&hci_dev_list_lock);
12735
12736         list_for_each_entry(hdev, &hci_dev_list, list) {
12737                 do {
12738                         mesh_tx = mgmt_mesh_next(hdev, sk);
12739
12740                         if (mesh_tx)
12741                                 mesh_send_complete(hdev, mesh_tx, true);
12742                 } while (mesh_tx);
12743         }
12744
12745         read_unlock(&hci_dev_list_lock);
12746 }