net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #endif
  38
  39 #include "hci_request.h"
  40 #include "smp.h"
  41 #include "mgmt_util.h"
  42 #include "mgmt_config.h"
  43 #include "msft.h"
  44 #include "eir.h"
  45 #include "aosp.h"
  46
  47 #define MGMT_VERSION    1
  48 #define MGMT_REVISION   22
  49
  50 static const u16 mgmt_commands[] = {
  51         MGMT_OP_READ_INDEX_LIST,
  52         MGMT_OP_READ_INFO,
  53         MGMT_OP_SET_POWERED,
  54         MGMT_OP_SET_DISCOVERABLE,
  55         MGMT_OP_SET_CONNECTABLE,
  56         MGMT_OP_SET_FAST_CONNECTABLE,
  57         MGMT_OP_SET_BONDABLE,
  58         MGMT_OP_SET_LINK_SECURITY,
  59         MGMT_OP_SET_SSP,
  60         MGMT_OP_SET_HS,
  61         MGMT_OP_SET_LE,
  62         MGMT_OP_SET_DEV_CLASS,
  63         MGMT_OP_SET_LOCAL_NAME,
  64         MGMT_OP_ADD_UUID,
  65         MGMT_OP_REMOVE_UUID,
  66         MGMT_OP_LOAD_LINK_KEYS,
  67         MGMT_OP_LOAD_LONG_TERM_KEYS,
  68         MGMT_OP_DISCONNECT,
  69         MGMT_OP_GET_CONNECTIONS,
  70         MGMT_OP_PIN_CODE_REPLY,
  71         MGMT_OP_PIN_CODE_NEG_REPLY,
  72         MGMT_OP_SET_IO_CAPABILITY,
  73         MGMT_OP_PAIR_DEVICE,
  74         MGMT_OP_CANCEL_PAIR_DEVICE,
  75         MGMT_OP_UNPAIR_DEVICE,
  76         MGMT_OP_USER_CONFIRM_REPLY,
  77         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  78         MGMT_OP_USER_PASSKEY_REPLY,
  79         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  80         MGMT_OP_READ_LOCAL_OOB_DATA,
  81         MGMT_OP_ADD_REMOTE_OOB_DATA,
  82         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  83         MGMT_OP_START_DISCOVERY,
  84         MGMT_OP_STOP_DISCOVERY,
  85         MGMT_OP_CONFIRM_NAME,
  86         MGMT_OP_BLOCK_DEVICE,
  87         MGMT_OP_UNBLOCK_DEVICE,
  88         MGMT_OP_SET_DEVICE_ID,
  89         MGMT_OP_SET_ADVERTISING,
  90         MGMT_OP_SET_BREDR,
  91         MGMT_OP_SET_STATIC_ADDRESS,
  92         MGMT_OP_SET_SCAN_PARAMS,
  93         MGMT_OP_SET_SECURE_CONN,
  94         MGMT_OP_SET_DEBUG_KEYS,
  95         MGMT_OP_SET_PRIVACY,
  96         MGMT_OP_LOAD_IRKS,
  97         MGMT_OP_GET_CONN_INFO,
  98         MGMT_OP_GET_CLOCK_INFO,
  99         MGMT_OP_ADD_DEVICE,
 100         MGMT_OP_REMOVE_DEVICE,
 101         MGMT_OP_LOAD_CONN_PARAM,
 102         MGMT_OP_READ_UNCONF_INDEX_LIST,
 103         MGMT_OP_READ_CONFIG_INFO,
 104         MGMT_OP_SET_EXTERNAL_CONFIG,
 105         MGMT_OP_SET_PUBLIC_ADDRESS,
 106         MGMT_OP_START_SERVICE_DISCOVERY,
 107         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 108         MGMT_OP_READ_EXT_INDEX_LIST,
 109         MGMT_OP_READ_ADV_FEATURES,
 110         MGMT_OP_ADD_ADVERTISING,
 111         MGMT_OP_REMOVE_ADVERTISING,
 112         MGMT_OP_GET_ADV_SIZE_INFO,
 113         MGMT_OP_START_LIMITED_DISCOVERY,
 114         MGMT_OP_READ_EXT_INFO,
 115         MGMT_OP_SET_APPEARANCE,
 116         MGMT_OP_GET_PHY_CONFIGURATION,
 117         MGMT_OP_SET_PHY_CONFIGURATION,
 118         MGMT_OP_SET_BLOCKED_KEYS,
 119         MGMT_OP_SET_WIDEBAND_SPEECH,
 120         MGMT_OP_READ_CONTROLLER_CAP,
 121         MGMT_OP_READ_EXP_FEATURES_INFO,
 122         MGMT_OP_SET_EXP_FEATURE,
 123         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 124         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 125         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 126         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 127         MGMT_OP_GET_DEVICE_FLAGS,
 128         MGMT_OP_SET_DEVICE_FLAGS,
 129         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 130         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 131         MGMT_OP_REMOVE_ADV_MONITOR,
 132         MGMT_OP_ADD_EXT_ADV_PARAMS,
 133         MGMT_OP_ADD_EXT_ADV_DATA,
 134         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 135         MGMT_OP_SET_MESH_RECEIVER,
 136         MGMT_OP_MESH_READ_FEATURES,
 137         MGMT_OP_MESH_SEND,
 138         MGMT_OP_MESH_SEND_CANCEL,
 139 };
 140
 141 static const u16 mgmt_events[] = {
 142         MGMT_EV_CONTROLLER_ERROR,
 143         MGMT_EV_INDEX_ADDED,
 144         MGMT_EV_INDEX_REMOVED,
 145         MGMT_EV_NEW_SETTINGS,
 146         MGMT_EV_CLASS_OF_DEV_CHANGED,
 147         MGMT_EV_LOCAL_NAME_CHANGED,
 148         MGMT_EV_NEW_LINK_KEY,
 149         MGMT_EV_NEW_LONG_TERM_KEY,
 150         MGMT_EV_DEVICE_CONNECTED,
 151         MGMT_EV_DEVICE_DISCONNECTED,
 152         MGMT_EV_CONNECT_FAILED,
 153         MGMT_EV_PIN_CODE_REQUEST,
 154         MGMT_EV_USER_CONFIRM_REQUEST,
 155         MGMT_EV_USER_PASSKEY_REQUEST,
 156         MGMT_EV_AUTH_FAILED,
 157         MGMT_EV_DEVICE_FOUND,
 158         MGMT_EV_DISCOVERING,
 159         MGMT_EV_DEVICE_BLOCKED,
 160         MGMT_EV_DEVICE_UNBLOCKED,
 161         MGMT_EV_DEVICE_UNPAIRED,
 162         MGMT_EV_PASSKEY_NOTIFY,
 163         MGMT_EV_NEW_IRK,
 164         MGMT_EV_NEW_CSRK,
 165         MGMT_EV_DEVICE_ADDED,
 166         MGMT_EV_DEVICE_REMOVED,
 167         MGMT_EV_NEW_CONN_PARAM,
 168         MGMT_EV_UNCONF_INDEX_ADDED,
 169         MGMT_EV_UNCONF_INDEX_REMOVED,
 170         MGMT_EV_NEW_CONFIG_OPTIONS,
 171         MGMT_EV_EXT_INDEX_ADDED,
 172         MGMT_EV_EXT_INDEX_REMOVED,
 173         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 174         MGMT_EV_ADVERTISING_ADDED,
 175         MGMT_EV_ADVERTISING_REMOVED,
 176         MGMT_EV_EXT_INFO_CHANGED,
 177         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 178         MGMT_EV_EXP_FEATURE_CHANGED,
 179         MGMT_EV_DEVICE_FLAGS_CHANGED,
 180         MGMT_EV_ADV_MONITOR_ADDED,
 181         MGMT_EV_ADV_MONITOR_REMOVED,
 182         MGMT_EV_CONTROLLER_SUSPEND,
 183         MGMT_EV_CONTROLLER_RESUME,
 184         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 185         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 186 };
 187
 188 static const u16 mgmt_untrusted_commands[] = {
 189         MGMT_OP_READ_INDEX_LIST,
 190         MGMT_OP_READ_INFO,
 191         MGMT_OP_READ_UNCONF_INDEX_LIST,
 192         MGMT_OP_READ_CONFIG_INFO,
 193         MGMT_OP_READ_EXT_INDEX_LIST,
 194         MGMT_OP_READ_EXT_INFO,
 195         MGMT_OP_READ_CONTROLLER_CAP,
 196         MGMT_OP_READ_EXP_FEATURES_INFO,
 197         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 198         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 199 };
 200
 201 static const u16 mgmt_untrusted_events[] = {
 202         MGMT_EV_INDEX_ADDED,
 203         MGMT_EV_INDEX_REMOVED,
 204         MGMT_EV_NEW_SETTINGS,
 205         MGMT_EV_CLASS_OF_DEV_CHANGED,
 206         MGMT_EV_LOCAL_NAME_CHANGED,
 207         MGMT_EV_UNCONF_INDEX_ADDED,
 208         MGMT_EV_UNCONF_INDEX_REMOVED,
 209         MGMT_EV_NEW_CONFIG_OPTIONS,
 210         MGMT_EV_EXT_INDEX_ADDED,
 211         MGMT_EV_EXT_INDEX_REMOVED,
 212         MGMT_EV_EXT_INFO_CHANGED,
 213         MGMT_EV_EXP_FEATURE_CHANGED,
 214 };
 215
 216 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 217
 218 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 219                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 220
 221 /* HCI to MGMT error code conversion table */
 222 static const u8 mgmt_status_table[] = {
 223         MGMT_STATUS_SUCCESS,
 224         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 225         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 226         MGMT_STATUS_FAILED,             /* Hardware Failure */
 227         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 228         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 229         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 230         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 231         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 232         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 233         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 234         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 235         MGMT_STATUS_BUSY,               /* Command Disallowed */
 236         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 237         MGMT_STATUS_REJECTED,           /* Rejected Security */
 238         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 239         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 240         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 241         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 242         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 243         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 244         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 245         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 246         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 247         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 248         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 249         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 250         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 251         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 252         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 253         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 254         MGMT_STATUS_FAILED,             /* Unspecified Error */
 255         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 256         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 257         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 258         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 259         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 260         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 261         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 262         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 263         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 264         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 265         MGMT_STATUS_FAILED,             /* Transaction Collision */
 266         MGMT_STATUS_FAILED,             /* Reserved for future use */
 267         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 268         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 269         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 270         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 271         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 272         MGMT_STATUS_FAILED,             /* Reserved for future use */
 273         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 274         MGMT_STATUS_FAILED,             /* Reserved for future use */
 275         MGMT_STATUS_FAILED,             /* Slot Violation */
 276         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 277         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 278         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 279         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 280         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 281         MGMT_STATUS_BUSY,               /* Controller Busy */
 282         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 283         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 284         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 285         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 286         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 287 };
 288
 289 static u8 mgmt_errno_status(int err)
 290 {
 291         switch (err) {
 292         case 0:
 293                 return MGMT_STATUS_SUCCESS;
 294         case -EPERM:
 295                 return MGMT_STATUS_REJECTED;
 296         case -EINVAL:
 297                 return MGMT_STATUS_INVALID_PARAMS;
 298         case -EOPNOTSUPP:
 299                 return MGMT_STATUS_NOT_SUPPORTED;
 300         case -EBUSY:
 301                 return MGMT_STATUS_BUSY;
 302         case -ETIMEDOUT:
 303                 return MGMT_STATUS_AUTH_FAILED;
 304         case -ENOMEM:
 305                 return MGMT_STATUS_NO_RESOURCES;
 306         case -EISCONN:
 307                 return MGMT_STATUS_ALREADY_CONNECTED;
 308         case -ENOTCONN:
 309                 return MGMT_STATUS_DISCONNECTED;
 310         }
 311
 312         return MGMT_STATUS_FAILED;
 313 }
 314
 315 static u8 mgmt_status(int err)
 316 {
 317         if (err < 0)
 318                 return mgmt_errno_status(err);
 319
 320         if (err < ARRAY_SIZE(mgmt_status_table))
 321                 return mgmt_status_table[err];
 322
 323         return MGMT_STATUS_FAILED;
 324 }
 325
 326 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 327                             u16 len, int flag)
 328 {
 329         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 330                                flag, NULL);
 331 }
 332
 333 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 334                               u16 len, int flag, struct sock *skip_sk)
 335 {
 336         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 337                                flag, skip_sk);
 338 }
 339
 340 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 341                       struct sock *skip_sk)
 342 {
 343         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 344                                HCI_SOCK_TRUSTED, skip_sk);
 345 }
 346
 347 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 348 {
 349         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 350                                    skip_sk);
 351 }
 352
 353 static u8 le_addr_type(u8 mgmt_addr_type)
 354 {
 355         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 356                 return ADDR_LE_DEV_PUBLIC;
 357         else
 358                 return ADDR_LE_DEV_RANDOM;
 359 }
 360
 361 void mgmt_fill_version_info(void *ver)
 362 {
 363         struct mgmt_rp_read_version *rp = ver;
 364
 365         rp->version = MGMT_VERSION;
 366         rp->revision = cpu_to_le16(MGMT_REVISION);
 367 }
 368
 369 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 370                         u16 data_len)
 371 {
 372         struct mgmt_rp_read_version rp;
 373
 374         bt_dev_dbg(hdev, "sock %p", sk);
 375
 376         mgmt_fill_version_info(&rp);
 377
 378         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 379                                  &rp, sizeof(rp));
 380 }
 381
 382 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 383                          u16 data_len)
 384 {
 385         struct mgmt_rp_read_commands *rp;
 386         u16 num_commands, num_events;
 387         size_t rp_size;
 388         int i, err;
 389
 390         bt_dev_dbg(hdev, "sock %p", sk);
 391
 392         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 393                 num_commands = ARRAY_SIZE(mgmt_commands);
 394                 num_events = ARRAY_SIZE(mgmt_events);
 395         } else {
 396                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 397                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 398         }
 399
 400         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 401
 402         rp = kmalloc(rp_size, GFP_KERNEL);
 403         if (!rp)
 404                 return -ENOMEM;
 405
 406         rp->num_commands = cpu_to_le16(num_commands);
 407         rp->num_events = cpu_to_le16(num_events);
 408
 409         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 410                 __le16 *opcode = rp->opcodes;
 411
 412                 for (i = 0; i < num_commands; i++, opcode++)
 413                         put_unaligned_le16(mgmt_commands[i], opcode);
 414
 415                 for (i = 0; i < num_events; i++, opcode++)
 416                         put_unaligned_le16(mgmt_events[i], opcode);
 417         } else {
 418                 __le16 *opcode = rp->opcodes;
 419
 420                 for (i = 0; i < num_commands; i++, opcode++)
 421                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 422
 423                 for (i = 0; i < num_events; i++, opcode++)
 424                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 425         }
 426
 427         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 428                                 rp, rp_size);
 429         kfree(rp);
 430
 431         return err;
 432 }
 433
 434 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 435                            u16 data_len)
 436 {
 437         struct mgmt_rp_read_index_list *rp;
 438         struct hci_dev *d;
 439         size_t rp_len;
 440         u16 count;
 441         int err;
 442
 443         bt_dev_dbg(hdev, "sock %p", sk);
 444
 445         read_lock(&hci_dev_list_lock);
 446
 447         count = 0;
 448         list_for_each_entry(d, &hci_dev_list, list) {
 449                 if (d->dev_type == HCI_PRIMARY &&
 450                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 451                         count++;
 452         }
 453
 454         rp_len = sizeof(*rp) + (2 * count);
 455         rp = kmalloc(rp_len, GFP_ATOMIC);
 456         if (!rp) {
 457                 read_unlock(&hci_dev_list_lock);
 458                 return -ENOMEM;
 459         }
 460
 461         count = 0;
 462         list_for_each_entry(d, &hci_dev_list, list) {
 463                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 464                     hci_dev_test_flag(d, HCI_CONFIG) ||
 465                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 466                         continue;
 467
 468                 /* Devices marked as raw-only are neither configured
 469                  * nor unconfigured controllers.
 470                  */
 471                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 472                         continue;
 473
 474                 if (d->dev_type == HCI_PRIMARY &&
 475                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 476                         rp->index[count++] = cpu_to_le16(d->id);
 477                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 478                 }
 479         }
 480
 481         rp->num_controllers = cpu_to_le16(count);
 482         rp_len = sizeof(*rp) + (2 * count);
 483
 484         read_unlock(&hci_dev_list_lock);
 485
 486         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 487                                 0, rp, rp_len);
 488
 489         kfree(rp);
 490
 491         return err;
 492 }
 493
 494 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 495                                   void *data, u16 data_len)
 496 {
 497         struct mgmt_rp_read_unconf_index_list *rp;
 498         struct hci_dev *d;
 499         size_t rp_len;
 500         u16 count;
 501         int err;
 502
 503         bt_dev_dbg(hdev, "sock %p", sk);
 504
 505         read_lock(&hci_dev_list_lock);
 506
 507         count = 0;
 508         list_for_each_entry(d, &hci_dev_list, list) {
 509                 if (d->dev_type == HCI_PRIMARY &&
 510                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 511                         count++;
 512         }
 513
 514         rp_len = sizeof(*rp) + (2 * count);
 515         rp = kmalloc(rp_len, GFP_ATOMIC);
 516         if (!rp) {
 517                 read_unlock(&hci_dev_list_lock);
 518                 return -ENOMEM;
 519         }
 520
 521         count = 0;
 522         list_for_each_entry(d, &hci_dev_list, list) {
 523                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 524                     hci_dev_test_flag(d, HCI_CONFIG) ||
 525                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 526                         continue;
 527
 528                 /* Devices marked as raw-only are neither configured
 529                  * nor unconfigured controllers.
 530                  */
 531                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 532                         continue;
 533
 534                 if (d->dev_type == HCI_PRIMARY &&
 535                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 536                         rp->index[count++] = cpu_to_le16(d->id);
 537                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 538                 }
 539         }
 540
 541         rp->num_controllers = cpu_to_le16(count);
 542         rp_len = sizeof(*rp) + (2 * count);
 543
 544         read_unlock(&hci_dev_list_lock);
 545
 546         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 547                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 548
 549         kfree(rp);
 550
 551         return err;
 552 }
 553
 554 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 555                                void *data, u16 data_len)
 556 {
 557         struct mgmt_rp_read_ext_index_list *rp;
 558         struct hci_dev *d;
 559         u16 count;
 560         int err;
 561
 562         bt_dev_dbg(hdev, "sock %p", sk);
 563
 564         read_lock(&hci_dev_list_lock);
 565
 566         count = 0;
 567         list_for_each_entry(d, &hci_dev_list, list) {
 568                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 569                         count++;
 570         }
 571
 572         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 573         if (!rp) {
 574                 read_unlock(&hci_dev_list_lock);
 575                 return -ENOMEM;
 576         }
 577
 578         count = 0;
 579         list_for_each_entry(d, &hci_dev_list, list) {
 580                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 581                     hci_dev_test_flag(d, HCI_CONFIG) ||
 582                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 583                         continue;
 584
 585                 /* Devices marked as raw-only are neither configured
 586                  * nor unconfigured controllers.
 587                  */
 588                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 589                         continue;
 590
 591                 if (d->dev_type == HCI_PRIMARY) {
 592                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 593                                 rp->entry[count].type = 0x01;
 594                         else
 595                                 rp->entry[count].type = 0x00;
 596                 } else if (d->dev_type == HCI_AMP) {
 597                         rp->entry[count].type = 0x02;
 598                 } else {
 599                         continue;
 600                 }
 601
 602                 rp->entry[count].bus = d->bus;
 603                 rp->entry[count++].index = cpu_to_le16(d->id);
 604                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 605         }
 606
 607         rp->num_controllers = cpu_to_le16(count);
 608
 609         read_unlock(&hci_dev_list_lock);
 610
 611         /* If this command is called at least once, then all the
 612          * default index and unconfigured index events are disabled
 613          * and from now on only extended index events are used.
 614          */
 615         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 616         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 617         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 618
 619         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 620                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 621                                 struct_size(rp, entry, count));
 622
 623         kfree(rp);
 624
 625         return err;
 626 }
 627
 628 static bool is_configured(struct hci_dev *hdev)
 629 {
 630         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 631             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 632                 return false;
 633
 634         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 635              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 636             !bacmp(&hdev->public_addr, BDADDR_ANY))
 637                 return false;
 638
 639         return true;
 640 }
 641
 642 static __le32 get_missing_options(struct hci_dev *hdev)
 643 {
 644         u32 options = 0;
 645
 646         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 647             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 648                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 649
 650         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 651              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 652             !bacmp(&hdev->public_addr, BDADDR_ANY))
 653                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 654
 655         return cpu_to_le32(options);
 656 }
 657
 658 static int new_options(struct hci_dev *hdev, struct sock *skip)
 659 {
 660         __le32 options = get_missing_options(hdev);
 661
 662         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 663                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 664 }
 665
 666 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 667 {
 668         __le32 options = get_missing_options(hdev);
 669
 670         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 671                                  sizeof(options));
 672 }
 673
 674 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 675                             void *data, u16 data_len)
 676 {
 677         struct mgmt_rp_read_config_info rp;
 678         u32 options = 0;
 679
 680         bt_dev_dbg(hdev, "sock %p", sk);
 681
 682         hci_dev_lock(hdev);
 683
 684         memset(&rp, 0, sizeof(rp));
 685         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 686
 687         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 688                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 689
 690         if (hdev->set_bdaddr)
 691                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 692
 693         rp.supported_options = cpu_to_le32(options);
 694         rp.missing_options = get_missing_options(hdev);
 695
 696         hci_dev_unlock(hdev);
 697
 698         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 699                                  &rp, sizeof(rp));
 700 }
 701
 702 static u32 get_supported_phys(struct hci_dev *hdev)
 703 {
 704         u32 supported_phys = 0;
 705
 706         if (lmp_bredr_capable(hdev)) {
 707                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 708
 709                 if (hdev->features[0][0] & LMP_3SLOT)
 710                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 711
 712                 if (hdev->features[0][0] & LMP_5SLOT)
 713                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 714
 715                 if (lmp_edr_2m_capable(hdev)) {
 716                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 717
 718                         if (lmp_edr_3slot_capable(hdev))
 719                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 720
 721                         if (lmp_edr_5slot_capable(hdev))
 722                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 723
 724                         if (lmp_edr_3m_capable(hdev)) {
 725                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 726
 727                                 if (lmp_edr_3slot_capable(hdev))
 728                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 729
 730                                 if (lmp_edr_5slot_capable(hdev))
 731                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 732                         }
 733                 }
 734         }
 735
 736         if (lmp_le_capable(hdev)) {
 737                 supported_phys |= MGMT_PHY_LE_1M_TX;
 738                 supported_phys |= MGMT_PHY_LE_1M_RX;
 739
 740                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 741                         supported_phys |= MGMT_PHY_LE_2M_TX;
 742                         supported_phys |= MGMT_PHY_LE_2M_RX;
 743                 }
 744
 745                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 746                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 747                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 748                 }
 749         }
 750
 751         return supported_phys;
 752 }
 753
 754 static u32 get_selected_phys(struct hci_dev *hdev)
 755 {
 756         u32 selected_phys = 0;
 757
 758         if (lmp_bredr_capable(hdev)) {
 759                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 760
 761                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 762                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 763
 764                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 765                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 766
 767                 if (lmp_edr_2m_capable(hdev)) {
 768                         if (!(hdev->pkt_type & HCI_2DH1))
 769                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 770
 771                         if (lmp_edr_3slot_capable(hdev) &&
 772                             !(hdev->pkt_type & HCI_2DH3))
 773                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 774
 775                         if (lmp_edr_5slot_capable(hdev) &&
 776                             !(hdev->pkt_type & HCI_2DH5))
 777                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 778
 779                         if (lmp_edr_3m_capable(hdev)) {
 780                                 if (!(hdev->pkt_type & HCI_3DH1))
 781                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 782
 783                                 if (lmp_edr_3slot_capable(hdev) &&
 784                                     !(hdev->pkt_type & HCI_3DH3))
 785                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 786
 787                                 if (lmp_edr_5slot_capable(hdev) &&
 788                                     !(hdev->pkt_type & HCI_3DH5))
 789                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 790                         }
 791                 }
 792         }
 793
 794         if (lmp_le_capable(hdev)) {
 795                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 796                         selected_phys |= MGMT_PHY_LE_1M_TX;
 797
 798                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 799                         selected_phys |= MGMT_PHY_LE_1M_RX;
 800
 801                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 802                         selected_phys |= MGMT_PHY_LE_2M_TX;
 803
 804                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 805                         selected_phys |= MGMT_PHY_LE_2M_RX;
 806
 807                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 808                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 809
 810                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 811                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 812         }
 813
 814         return selected_phys;
 815 }
 816
 817 static u32 get_configurable_phys(struct hci_dev *hdev)
 818 {
 819         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 820                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 821 }
 822
 823 static u32 get_supported_settings(struct hci_dev *hdev)
 824 {
 825         u32 settings = 0;
 826
 827         settings |= MGMT_SETTING_POWERED;
 828         settings |= MGMT_SETTING_BONDABLE;
 829         settings |= MGMT_SETTING_DEBUG_KEYS;
 830         settings |= MGMT_SETTING_CONNECTABLE;
 831         settings |= MGMT_SETTING_DISCOVERABLE;
 832
 833         if (lmp_bredr_capable(hdev)) {
 834                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 835                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 836                 settings |= MGMT_SETTING_BREDR;
 837                 settings |= MGMT_SETTING_LINK_SECURITY;
 838
 839                 if (lmp_ssp_capable(hdev)) {
 840                         settings |= MGMT_SETTING_SSP;
 841                         if (IS_ENABLED(CONFIG_BT_HS))
 842                                 settings |= MGMT_SETTING_HS;
 843                 }
 844
 845                 if (lmp_sc_capable(hdev))
 846                         settings |= MGMT_SETTING_SECURE_CONN;
 847
 848                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 849                              &hdev->quirks))
 850                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 851         }
 852
 853         if (lmp_le_capable(hdev)) {
 854                 settings |= MGMT_SETTING_LE;
 855                 settings |= MGMT_SETTING_SECURE_CONN;
 856                 settings |= MGMT_SETTING_PRIVACY;
 857                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 858                 settings |= MGMT_SETTING_ADVERTISING;
 859         }
 860
 861         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 862             hdev->set_bdaddr)
 863                 settings |= MGMT_SETTING_CONFIGURATION;
 864
 865         if (cis_central_capable(hdev))
 866                 settings |= MGMT_SETTING_CIS_CENTRAL;
 867
 868         if (cis_peripheral_capable(hdev))
 869                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 870
 871         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 872
 873         return settings;
 874 }
 875
 876 static u32 get_current_settings(struct hci_dev *hdev)
 877 {
 878         u32 settings = 0;
 879
 880         if (hdev_is_powered(hdev))
 881                 settings |= MGMT_SETTING_POWERED;
 882
 883         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 884                 settings |= MGMT_SETTING_CONNECTABLE;
 885
 886         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 887                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 888
 889         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 890                 settings |= MGMT_SETTING_DISCOVERABLE;
 891
 892         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 893                 settings |= MGMT_SETTING_BONDABLE;
 894
 895         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 896                 settings |= MGMT_SETTING_BREDR;
 897
 898         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 899                 settings |= MGMT_SETTING_LE;
 900
 901         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 902                 settings |= MGMT_SETTING_LINK_SECURITY;
 903
 904         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 905                 settings |= MGMT_SETTING_SSP;
 906
 907         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 908                 settings |= MGMT_SETTING_HS;
 909
 910         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 911                 settings |= MGMT_SETTING_ADVERTISING;
 912
 913         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 914                 settings |= MGMT_SETTING_SECURE_CONN;
 915
 916         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 917                 settings |= MGMT_SETTING_DEBUG_KEYS;
 918
 919         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 920                 settings |= MGMT_SETTING_PRIVACY;
 921
 922         /* The current setting for static address has two purposes. The
 923          * first is to indicate if the static address will be used and
 924          * the second is to indicate if it is actually set.
 925          *
 926          * This means if the static address is not configured, this flag
 927          * will never be set. If the address is configured, then if the
 928          * address is actually used decides if the flag is set or not.
 929          *
 930          * For single mode LE only controllers and dual-mode controllers
 931          * with BR/EDR disabled, the existence of the static address will
 932          * be evaluated.
 933          */
 934         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 935             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 936             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 937                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 938                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 939         }
 940
 941         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 942                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 943
 944         if (cis_central_capable(hdev))
 945                 settings |= MGMT_SETTING_CIS_CENTRAL;
 946
 947         if (cis_peripheral_capable(hdev))
 948                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 949
 950         if (bis_capable(hdev))
 951                 settings |= MGMT_SETTING_ISO_BROADCASTER;
 952
 953         if (sync_recv_capable(hdev))
 954                 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER;
 955
 956         return settings;
 957 }
 958
 959 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 960 {
 961         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 962 }
 963
 964 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 965 {
 966         struct mgmt_pending_cmd *cmd;
 967
 968         /* If there's a pending mgmt command the flags will not yet have
 969          * their final values, so check for this first.
 970          */
 971         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 972         if (cmd) {
 973                 struct mgmt_mode *cp = cmd->param;
 974                 if (cp->val == 0x01)
 975                         return LE_AD_GENERAL;
 976                 else if (cp->val == 0x02)
 977                         return LE_AD_LIMITED;
 978         } else {
 979                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 980                         return LE_AD_LIMITED;
 981                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 982                         return LE_AD_GENERAL;
 983         }
 984
 985         return 0;
 986 }
 987
 988 bool mgmt_get_connectable(struct hci_dev *hdev)
 989 {
 990         struct mgmt_pending_cmd *cmd;
 991
 992         /* If there's a pending mgmt command the flag will not yet have
 993          * it's final value, so check for this first.
 994          */
 995         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 996         if (cmd) {
 997                 struct mgmt_mode *cp = cmd->param;
 998
 999                 return cp->val;
1000         }
1001
1002         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
1003 }
1004
1005 static int service_cache_sync(struct hci_dev *hdev, void *data)
1006 {
1007         hci_update_eir_sync(hdev);
1008         hci_update_class_sync(hdev);
1009
1010         return 0;
1011 }
1012
1013 static void service_cache_off(struct work_struct *work)
1014 {
1015         struct hci_dev *hdev = container_of(work, struct hci_dev,
1016                                             service_cache.work);
1017
1018         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1019                 return;
1020
1021         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1022 }
1023
1024 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1025 {
1026         /* The generation of a new RPA and programming it into the
1027          * controller happens in the hci_req_enable_advertising()
1028          * function.
1029          */
1030         if (ext_adv_capable(hdev))
1031                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1032         else
1033                 return hci_enable_advertising_sync(hdev);
1034 }
1035
1036 static void rpa_expired(struct work_struct *work)
1037 {
1038         struct hci_dev *hdev = container_of(work, struct hci_dev,
1039                                             rpa_expired.work);
1040
1041         bt_dev_dbg(hdev, "");
1042
1043         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1044
1045         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1046                 return;
1047
1048         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1049 }
1050
1051 static void discov_off(struct work_struct *work)
1052 {
1053         struct hci_dev *hdev = container_of(work, struct hci_dev,
1054                                             discov_off.work);
1055
1056         bt_dev_dbg(hdev, "");
1057
1058         hci_dev_lock(hdev);
1059
1060         /* When discoverable timeout triggers, then just make sure
1061          * the limited discoverable flag is cleared. Even in the case
1062          * of a timeout triggered from general discoverable, it is
1063          * safe to unconditionally clear the flag.
1064          */
1065         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1066         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1067         hdev->discov_timeout = 0;
1068
1069         hci_update_discoverable(hdev);
1070
1071         mgmt_new_settings(hdev);
1072
1073         hci_dev_unlock(hdev);
1074 }
1075
1076 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1077
1078 static void mesh_send_complete(struct hci_dev *hdev,
1079                                struct mgmt_mesh_tx *mesh_tx, bool silent)
1080 {
1081         u8 handle = mesh_tx->handle;
1082
1083         if (!silent)
1084                 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1085                            sizeof(handle), NULL);
1086
1087         mgmt_mesh_remove(mesh_tx);
1088 }
1089
1090 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1091 {
1092         struct mgmt_mesh_tx *mesh_tx;
1093
1094         hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1095         hci_disable_advertising_sync(hdev);
1096         mesh_tx = mgmt_mesh_next(hdev, NULL);
1097
1098         if (mesh_tx)
1099                 mesh_send_complete(hdev, mesh_tx, false);
1100
1101         return 0;
1102 }
1103
1104 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1105 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1106 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1107 {
1108         struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1109
1110         if (!mesh_tx)
1111                 return;
1112
1113         err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1114                                  mesh_send_start_complete);
1115
1116         if (err < 0)
1117                 mesh_send_complete(hdev, mesh_tx, false);
1118         else
1119                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1120 }
1121
1122 static void mesh_send_done(struct work_struct *work)
1123 {
1124         struct hci_dev *hdev = container_of(work, struct hci_dev,
1125                                             mesh_send_done.work);
1126
1127         if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1128                 return;
1129
1130         hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1131 }
1132
1133 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1134 {
1135         if (hci_dev_test_flag(hdev, HCI_MGMT))
1136                 return;
1137
1138         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1139
1140         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1141         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1142         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1143         INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1144
1145         /* Non-mgmt controlled devices get this bit set
1146          * implicitly so that pairing works for them, however
1147          * for mgmt we require user-space to explicitly enable
1148          * it
1149          */
1150         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1151
1152         hci_dev_set_flag(hdev, HCI_MGMT);
1153 }
1154
1155 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1156                                 void *data, u16 data_len)
1157 {
1158         struct mgmt_rp_read_info rp;
1159
1160         bt_dev_dbg(hdev, "sock %p", sk);
1161
1162         hci_dev_lock(hdev);
1163
1164         memset(&rp, 0, sizeof(rp));
1165
1166         bacpy(&rp.bdaddr, &hdev->bdaddr);
1167
1168         rp.version = hdev->hci_ver;
1169         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1170
1171         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1172         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1173
1174         memcpy(rp.dev_class, hdev->dev_class, 3);
1175
1176         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1177         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1178
1179         hci_dev_unlock(hdev);
1180
1181         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1182                                  sizeof(rp));
1183 }
1184
1185 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1186 {
1187         u16 eir_len = 0;
1188         size_t name_len;
1189
1190         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1191                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1192                                           hdev->dev_class, 3);
1193
1194         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1195                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1196                                           hdev->appearance);
1197
1198         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1199         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1200                                   hdev->dev_name, name_len);
1201
1202         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1203         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1204                                   hdev->short_name, name_len);
1205
1206         return eir_len;
1207 }
1208
1209 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1210                                     void *data, u16 data_len)
1211 {
1212         char buf[512];
1213         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1214         u16 eir_len;
1215
1216         bt_dev_dbg(hdev, "sock %p", sk);
1217
1218         memset(&buf, 0, sizeof(buf));
1219
1220         hci_dev_lock(hdev);
1221
1222         bacpy(&rp->bdaddr, &hdev->bdaddr);
1223
1224         rp->version = hdev->hci_ver;
1225         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1226
1227         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1228         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1229
1230
1231         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1232         rp->eir_len = cpu_to_le16(eir_len);
1233
1234         hci_dev_unlock(hdev);
1235
1236         /* If this command is called at least once, then the events
1237          * for class of device and local name changes are disabled
1238          * and only the new extended controller information event
1239          * is used.
1240          */
1241         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1242         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1243         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1244
1245         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1246                                  sizeof(*rp) + eir_len);
1247 }
1248
1249 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1250 {
1251         char buf[512];
1252         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1253         u16 eir_len;
1254
1255         memset(buf, 0, sizeof(buf));
1256
1257         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1258         ev->eir_len = cpu_to_le16(eir_len);
1259
1260         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1261                                   sizeof(*ev) + eir_len,
1262                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1263 }
1264
1265 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1266 {
1267         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1268
1269         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1270                                  sizeof(settings));
1271 }
1272
1273 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1274 {
1275         struct mgmt_ev_advertising_added ev;
1276
1277         ev.instance = instance;
1278
1279         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1280 }
1281
1282 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1283                               u8 instance)
1284 {
1285         struct mgmt_ev_advertising_removed ev;
1286
1287         ev.instance = instance;
1288
1289         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1290 }
1291
1292 static void cancel_adv_timeout(struct hci_dev *hdev)
1293 {
1294         if (hdev->adv_instance_timeout) {
1295                 hdev->adv_instance_timeout = 0;
1296                 cancel_delayed_work(&hdev->adv_instance_expire);
1297         }
1298 }
1299
1300 /* This function requires the caller holds hdev->lock */
1301 static void restart_le_actions(struct hci_dev *hdev)
1302 {
1303         struct hci_conn_params *p;
1304
1305         list_for_each_entry(p, &hdev->le_conn_params, list) {
1306                 /* Needed for AUTO_OFF case where might not "really"
1307                  * have been powered off.
1308                  */
1309                 hci_pend_le_list_del_init(p);
1310
1311                 switch (p->auto_connect) {
1312                 case HCI_AUTO_CONN_DIRECT:
1313                 case HCI_AUTO_CONN_ALWAYS:
1314                         hci_pend_le_list_add(p, &hdev->pend_le_conns);
1315                         break;
1316                 case HCI_AUTO_CONN_REPORT:
1317                         hci_pend_le_list_add(p, &hdev->pend_le_reports);
1318                         break;
1319                 default:
1320                         break;
1321                 }
1322         }
1323 }
1324
1325 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1326 {
1327         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1328
1329         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1330                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1331 }
1332
1333 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1334 {
1335         struct mgmt_pending_cmd *cmd = data;
1336         struct mgmt_mode *cp;
1337
1338         /* Make sure cmd still outstanding. */
1339         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1340                 return;
1341
1342         cp = cmd->param;
1343
1344         bt_dev_dbg(hdev, "err %d", err);
1345
1346         if (!err) {
1347                 if (cp->val) {
1348                         hci_dev_lock(hdev);
1349                         restart_le_actions(hdev);
1350                         hci_update_passive_scan(hdev);
1351                         hci_dev_unlock(hdev);
1352                 }
1353
1354                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1355
1356                 /* Only call new_setting for power on as power off is deferred
1357                  * to hdev->power_off work which does call hci_dev_do_close.
1358                  */
1359                 if (cp->val)
1360                         new_settings(hdev, cmd->sk);
1361         } else {
1362                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1363                                 mgmt_status(err));
1364         }
1365
1366         mgmt_pending_remove(cmd);
1367 }
1368
1369 static int set_powered_sync(struct hci_dev *hdev, void *data)
1370 {
1371         struct mgmt_pending_cmd *cmd = data;
1372         struct mgmt_mode *cp = cmd->param;
1373
1374         BT_DBG("%s", hdev->name);
1375
1376         return hci_set_powered_sync(hdev, cp->val);
1377 }
1378
1379 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1380                        u16 len)
1381 {
1382         struct mgmt_mode *cp = data;
1383         struct mgmt_pending_cmd *cmd;
1384         int err;
1385
1386         bt_dev_dbg(hdev, "sock %p", sk);
1387
1388         if (cp->val != 0x00 && cp->val != 0x01)
1389                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1390                                        MGMT_STATUS_INVALID_PARAMS);
1391
1392         hci_dev_lock(hdev);
1393
1394         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1395                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1396                                       MGMT_STATUS_BUSY);
1397                 goto failed;
1398         }
1399
1400         if (!!cp->val == hdev_is_powered(hdev)) {
1401                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1402                 goto failed;
1403         }
1404
1405         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1406         if (!cmd) {
1407                 err = -ENOMEM;
1408                 goto failed;
1409         }
1410
1411         /* Cancel potentially blocking sync operation before power off */
1412         if (cp->val == 0x00) {
1413                 __hci_cmd_sync_cancel(hdev, -EHOSTDOWN);
1414                 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1415                                          mgmt_set_powered_complete);
1416         } else {
1417                 /* Use hci_cmd_sync_submit since hdev might not be running */
1418                 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd,
1419                                           mgmt_set_powered_complete);
1420         }
1421
1422         if (err < 0)
1423                 mgmt_pending_remove(cmd);
1424
1425 failed:
1426         hci_dev_unlock(hdev);
1427         return err;
1428 }
1429
1430 int mgmt_new_settings(struct hci_dev *hdev)
1431 {
1432         return new_settings(hdev, NULL);
1433 }
1434
1435 struct cmd_lookup {
1436         struct sock *sk;
1437         struct hci_dev *hdev;
1438         u8 mgmt_status;
1439 };
1440
1441 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1442 {
1443         struct cmd_lookup *match = data;
1444
1445         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1446
1447         list_del(&cmd->list);
1448
1449         if (match->sk == NULL) {
1450                 match->sk = cmd->sk;
1451                 sock_hold(match->sk);
1452         }
1453
1454         mgmt_pending_free(cmd);
1455 }
1456
1457 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1458 {
1459         u8 *status = data;
1460
1461         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1462         mgmt_pending_remove(cmd);
1463 }
1464
1465 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1466 {
1467         if (cmd->cmd_complete) {
1468                 u8 *status = data;
1469
1470                 cmd->cmd_complete(cmd, *status);
1471                 mgmt_pending_remove(cmd);
1472
1473                 return;
1474         }
1475
1476         cmd_status_rsp(cmd, data);
1477 }
1478
1479 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1480 {
1481         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1482                                  cmd->param, cmd->param_len);
1483 }
1484
1485 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1486 {
1487         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1488                                  cmd->param, sizeof(struct mgmt_addr_info));
1489 }
1490
1491 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1492 {
1493         if (!lmp_bredr_capable(hdev))
1494                 return MGMT_STATUS_NOT_SUPPORTED;
1495         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1496                 return MGMT_STATUS_REJECTED;
1497         else
1498                 return MGMT_STATUS_SUCCESS;
1499 }
1500
1501 static u8 mgmt_le_support(struct hci_dev *hdev)
1502 {
1503         if (!lmp_le_capable(hdev))
1504                 return MGMT_STATUS_NOT_SUPPORTED;
1505         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1506                 return MGMT_STATUS_REJECTED;
1507         else
1508                 return MGMT_STATUS_SUCCESS;
1509 }
1510
1511 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1512                                            int err)
1513 {
1514         struct mgmt_pending_cmd *cmd = data;
1515
1516         bt_dev_dbg(hdev, "err %d", err);
1517
1518         /* Make sure cmd still outstanding. */
1519         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1520                 return;
1521
1522         hci_dev_lock(hdev);
1523
1524         if (err) {
1525                 u8 mgmt_err = mgmt_status(err);
1526                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1527                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1528                 goto done;
1529         }
1530
1531         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1532             hdev->discov_timeout > 0) {
1533                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1534                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1535         }
1536
1537         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1538         new_settings(hdev, cmd->sk);
1539
1540 done:
1541         mgmt_pending_remove(cmd);
1542         hci_dev_unlock(hdev);
1543 }
1544
1545 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1546 {
1547         BT_DBG("%s", hdev->name);
1548
1549         return hci_update_discoverable_sync(hdev);
1550 }
1551
1552 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1553                             u16 len)
1554 {
1555         struct mgmt_cp_set_discoverable *cp = data;
1556         struct mgmt_pending_cmd *cmd;
1557         u16 timeout;
1558         int err;
1559
1560         bt_dev_dbg(hdev, "sock %p", sk);
1561
1562         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1563             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1564                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1565                                        MGMT_STATUS_REJECTED);
1566
1567         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1568                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1569                                        MGMT_STATUS_INVALID_PARAMS);
1570
1571         timeout = __le16_to_cpu(cp->timeout);
1572
1573         /* Disabling discoverable requires that no timeout is set,
1574          * and enabling limited discoverable requires a timeout.
1575          */
1576         if ((cp->val == 0x00 && timeout > 0) ||
1577             (cp->val == 0x02 && timeout == 0))
1578                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1579                                        MGMT_STATUS_INVALID_PARAMS);
1580
1581         hci_dev_lock(hdev);
1582
1583         if (!hdev_is_powered(hdev) && timeout > 0) {
1584                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1585                                       MGMT_STATUS_NOT_POWERED);
1586                 goto failed;
1587         }
1588
1589         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1590             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1591                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1592                                       MGMT_STATUS_BUSY);
1593                 goto failed;
1594         }
1595
1596         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1597                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1598                                       MGMT_STATUS_REJECTED);
1599                 goto failed;
1600         }
1601
1602         if (hdev->advertising_paused) {
1603                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1604                                       MGMT_STATUS_BUSY);
1605                 goto failed;
1606         }
1607
1608         if (!hdev_is_powered(hdev)) {
1609                 bool changed = false;
1610
1611                 /* Setting limited discoverable when powered off is
1612                  * not a valid operation since it requires a timeout
1613                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1614                  */
1615                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1616                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1617                         changed = true;
1618                 }
1619
1620                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1621                 if (err < 0)
1622                         goto failed;
1623
1624                 if (changed)
1625                         err = new_settings(hdev, sk);
1626
1627                 goto failed;
1628         }
1629
1630         /* If the current mode is the same, then just update the timeout
1631          * value with the new value. And if only the timeout gets updated,
1632          * then no need for any HCI transactions.
1633          */
1634         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1635             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1636                                                    HCI_LIMITED_DISCOVERABLE)) {
1637                 cancel_delayed_work(&hdev->discov_off);
1638                 hdev->discov_timeout = timeout;
1639
1640                 if (cp->val && hdev->discov_timeout > 0) {
1641                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1642                         queue_delayed_work(hdev->req_workqueue,
1643                                            &hdev->discov_off, to);
1644                 }
1645
1646                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1647                 goto failed;
1648         }
1649
1650         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1651         if (!cmd) {
1652                 err = -ENOMEM;
1653                 goto failed;
1654         }
1655
1656         /* Cancel any potential discoverable timeout that might be
1657          * still active and store new timeout value. The arming of
1658          * the timeout happens in the complete handler.
1659          */
1660         cancel_delayed_work(&hdev->discov_off);
1661         hdev->discov_timeout = timeout;
1662
1663         if (cp->val)
1664                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1665         else
1666                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1667
1668         /* Limited discoverable mode */
1669         if (cp->val == 0x02)
1670                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1671         else
1672                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1673
1674         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1675                                  mgmt_set_discoverable_complete);
1676
1677         if (err < 0)
1678                 mgmt_pending_remove(cmd);
1679
1680 failed:
1681         hci_dev_unlock(hdev);
1682         return err;
1683 }
1684
1685 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1686                                           int err)
1687 {
1688         struct mgmt_pending_cmd *cmd = data;
1689
1690         bt_dev_dbg(hdev, "err %d", err);
1691
1692         /* Make sure cmd still outstanding. */
1693         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1694                 return;
1695
1696         hci_dev_lock(hdev);
1697
1698         if (err) {
1699                 u8 mgmt_err = mgmt_status(err);
1700                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1701                 goto done;
1702         }
1703
1704         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1705         new_settings(hdev, cmd->sk);
1706
1707 done:
1708         if (cmd)
1709                 mgmt_pending_remove(cmd);
1710
1711         hci_dev_unlock(hdev);
1712 }
1713
1714 static int set_connectable_update_settings(struct hci_dev *hdev,
1715                                            struct sock *sk, u8 val)
1716 {
1717         bool changed = false;
1718         int err;
1719
1720         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1721                 changed = true;
1722
1723         if (val) {
1724                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1725         } else {
1726                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1727                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1728         }
1729
1730         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1731         if (err < 0)
1732                 return err;
1733
1734         if (changed) {
1735                 hci_update_scan(hdev);
1736                 hci_update_passive_scan(hdev);
1737                 return new_settings(hdev, sk);
1738         }
1739
1740         return 0;
1741 }
1742
1743 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1744 {
1745         BT_DBG("%s", hdev->name);
1746
1747         return hci_update_connectable_sync(hdev);
1748 }
1749
1750 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1751                            u16 len)
1752 {
1753         struct mgmt_mode *cp = data;
1754         struct mgmt_pending_cmd *cmd;
1755         int err;
1756
1757         bt_dev_dbg(hdev, "sock %p", sk);
1758
1759         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1760             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1761                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1762                                        MGMT_STATUS_REJECTED);
1763
1764         if (cp->val != 0x00 && cp->val != 0x01)
1765                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1766                                        MGMT_STATUS_INVALID_PARAMS);
1767
1768         hci_dev_lock(hdev);
1769
1770         if (!hdev_is_powered(hdev)) {
1771                 err = set_connectable_update_settings(hdev, sk, cp->val);
1772                 goto failed;
1773         }
1774
1775         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1776             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1777                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1778                                       MGMT_STATUS_BUSY);
1779                 goto failed;
1780         }
1781
1782         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1783         if (!cmd) {
1784                 err = -ENOMEM;
1785                 goto failed;
1786         }
1787
1788         if (cp->val) {
1789                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1790         } else {
1791                 if (hdev->discov_timeout > 0)
1792                         cancel_delayed_work(&hdev->discov_off);
1793
1794                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1795                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1796                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1797         }
1798
1799         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1800                                  mgmt_set_connectable_complete);
1801
1802         if (err < 0)
1803                 mgmt_pending_remove(cmd);
1804
1805 failed:
1806         hci_dev_unlock(hdev);
1807         return err;
1808 }
1809
1810 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1811                         u16 len)
1812 {
1813         struct mgmt_mode *cp = data;
1814         bool changed;
1815         int err;
1816
1817         bt_dev_dbg(hdev, "sock %p", sk);
1818
1819         if (cp->val != 0x00 && cp->val != 0x01)
1820                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1821                                        MGMT_STATUS_INVALID_PARAMS);
1822
1823         hci_dev_lock(hdev);
1824
1825         if (cp->val)
1826                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1827         else
1828                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1829
1830         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1831         if (err < 0)
1832                 goto unlock;
1833
1834         if (changed) {
1835                 /* In limited privacy mode the change of bondable mode
1836                  * may affect the local advertising address.
1837                  */
1838                 hci_update_discoverable(hdev);
1839
1840                 err = new_settings(hdev, sk);
1841         }
1842
1843 unlock:
1844         hci_dev_unlock(hdev);
1845         return err;
1846 }
1847
1848 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1849                              u16 len)
1850 {
1851         struct mgmt_mode *cp = data;
1852         struct mgmt_pending_cmd *cmd;
1853         u8 val, status;
1854         int err;
1855
1856         bt_dev_dbg(hdev, "sock %p", sk);
1857
1858         status = mgmt_bredr_support(hdev);
1859         if (status)
1860                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1861                                        status);
1862
1863         if (cp->val != 0x00 && cp->val != 0x01)
1864                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1865                                        MGMT_STATUS_INVALID_PARAMS);
1866
1867         hci_dev_lock(hdev);
1868
1869         if (!hdev_is_powered(hdev)) {
1870                 bool changed = false;
1871
1872                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1873                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1874                         changed = true;
1875                 }
1876
1877                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1878                 if (err < 0)
1879                         goto failed;
1880
1881                 if (changed)
1882                         err = new_settings(hdev, sk);
1883
1884                 goto failed;
1885         }
1886
1887         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1888                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1889                                       MGMT_STATUS_BUSY);
1890                 goto failed;
1891         }
1892
1893         val = !!cp->val;
1894
1895         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1896                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1897                 goto failed;
1898         }
1899
1900         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1901         if (!cmd) {
1902                 err = -ENOMEM;
1903                 goto failed;
1904         }
1905
1906         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1907         if (err < 0) {
1908                 mgmt_pending_remove(cmd);
1909                 goto failed;
1910         }
1911
1912 failed:
1913         hci_dev_unlock(hdev);
1914         return err;
1915 }
1916
1917 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1918 {
1919         struct cmd_lookup match = { NULL, hdev };
1920         struct mgmt_pending_cmd *cmd = data;
1921         struct mgmt_mode *cp = cmd->param;
1922         u8 enable = cp->val;
1923         bool changed;
1924
1925         /* Make sure cmd still outstanding. */
1926         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1927                 return;
1928
1929         if (err) {
1930                 u8 mgmt_err = mgmt_status(err);
1931
1932                 if (enable && hci_dev_test_and_clear_flag(hdev,
1933                                                           HCI_SSP_ENABLED)) {
1934                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1935                         new_settings(hdev, NULL);
1936                 }
1937
1938                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1939                                      &mgmt_err);
1940                 return;
1941         }
1942
1943         if (enable) {
1944                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1945         } else {
1946                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1947
1948                 if (!changed)
1949                         changed = hci_dev_test_and_clear_flag(hdev,
1950                                                               HCI_HS_ENABLED);
1951                 else
1952                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1953         }
1954
1955         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1956
1957         if (changed)
1958                 new_settings(hdev, match.sk);
1959
1960         if (match.sk)
1961                 sock_put(match.sk);
1962
1963         hci_update_eir_sync(hdev);
1964 }
1965
1966 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1967 {
1968         struct mgmt_pending_cmd *cmd = data;
1969         struct mgmt_mode *cp = cmd->param;
1970         bool changed = false;
1971         int err;
1972
1973         if (cp->val)
1974                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1975
1976         err = hci_write_ssp_mode_sync(hdev, cp->val);
1977
1978         if (!err && changed)
1979                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1980
1981         return err;
1982 }
1983
1984 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1985 {
1986         struct mgmt_mode *cp = data;
1987         struct mgmt_pending_cmd *cmd;
1988         u8 status;
1989         int err;
1990
1991         bt_dev_dbg(hdev, "sock %p", sk);
1992
1993         status = mgmt_bredr_support(hdev);
1994         if (status)
1995                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1996
1997         if (!lmp_ssp_capable(hdev))
1998                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1999                                        MGMT_STATUS_NOT_SUPPORTED);
2000
2001         if (cp->val != 0x00 && cp->val != 0x01)
2002                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2003                                        MGMT_STATUS_INVALID_PARAMS);
2004
2005         hci_dev_lock(hdev);
2006
2007         if (!hdev_is_powered(hdev)) {
2008                 bool changed;
2009
2010                 if (cp->val) {
2011                         changed = !hci_dev_test_and_set_flag(hdev,
2012                                                              HCI_SSP_ENABLED);
2013                 } else {
2014                         changed = hci_dev_test_and_clear_flag(hdev,
2015                                                               HCI_SSP_ENABLED);
2016                         if (!changed)
2017                                 changed = hci_dev_test_and_clear_flag(hdev,
2018                                                                       HCI_HS_ENABLED);
2019                         else
2020                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2021                 }
2022
2023                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2024                 if (err < 0)
2025                         goto failed;
2026
2027                 if (changed)
2028                         err = new_settings(hdev, sk);
2029
2030                 goto failed;
2031         }
2032
2033         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2034                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2035                                       MGMT_STATUS_BUSY);
2036                 goto failed;
2037         }
2038
2039         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2040                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2041                 goto failed;
2042         }
2043
2044         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2045         if (!cmd)
2046                 err = -ENOMEM;
2047         else
2048                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2049                                          set_ssp_complete);
2050
2051         if (err < 0) {
2052                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2053                                       MGMT_STATUS_FAILED);
2054
2055                 if (cmd)
2056                         mgmt_pending_remove(cmd);
2057         }
2058
2059 failed:
2060         hci_dev_unlock(hdev);
2061         return err;
2062 }
2063
2064 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2065 {
2066         struct mgmt_mode *cp = data;
2067         bool changed;
2068         u8 status;
2069         int err;
2070
2071         bt_dev_dbg(hdev, "sock %p", sk);
2072
2073         if (!IS_ENABLED(CONFIG_BT_HS))
2074                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2075                                        MGMT_STATUS_NOT_SUPPORTED);
2076
2077         status = mgmt_bredr_support(hdev);
2078         if (status)
2079                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2080
2081         if (!lmp_ssp_capable(hdev))
2082                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2083                                        MGMT_STATUS_NOT_SUPPORTED);
2084
2085         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2086                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2087                                        MGMT_STATUS_REJECTED);
2088
2089         if (cp->val != 0x00 && cp->val != 0x01)
2090                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2091                                        MGMT_STATUS_INVALID_PARAMS);
2092
2093         hci_dev_lock(hdev);
2094
2095         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2096                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2097                                       MGMT_STATUS_BUSY);
2098                 goto unlock;
2099         }
2100
2101         if (cp->val) {
2102                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2103         } else {
2104                 if (hdev_is_powered(hdev)) {
2105                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2106                                               MGMT_STATUS_REJECTED);
2107                         goto unlock;
2108                 }
2109
2110                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2111         }
2112
2113         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2114         if (err < 0)
2115                 goto unlock;
2116
2117         if (changed)
2118                 err = new_settings(hdev, sk);
2119
2120 unlock:
2121         hci_dev_unlock(hdev);
2122         return err;
2123 }
2124
2125 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2126 {
2127         struct cmd_lookup match = { NULL, hdev };
2128         u8 status = mgmt_status(err);
2129
2130         bt_dev_dbg(hdev, "err %d", err);
2131
2132         if (status) {
2133                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2134                                                         &status);
2135                 return;
2136         }
2137
2138         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2139
2140         new_settings(hdev, match.sk);
2141
2142         if (match.sk)
2143                 sock_put(match.sk);
2144 }
2145
2146 static int set_le_sync(struct hci_dev *hdev, void *data)
2147 {
2148         struct mgmt_pending_cmd *cmd = data;
2149         struct mgmt_mode *cp = cmd->param;
2150         u8 val = !!cp->val;
2151         int err;
2152
2153         if (!val) {
2154                 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2155
2156                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2157                         hci_disable_advertising_sync(hdev);
2158
2159                 if (ext_adv_capable(hdev))
2160                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2161         } else {
2162                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2163         }
2164
2165         err = hci_write_le_host_supported_sync(hdev, val, 0);
2166
2167         /* Make sure the controller has a good default for
2168          * advertising data. Restrict the update to when LE
2169          * has actually been enabled. During power on, the
2170          * update in powered_update_hci will take care of it.
2171          */
2172         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2173                 if (ext_adv_capable(hdev)) {
2174                         int status;
2175
2176                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2177                         if (!status)
2178                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2179                 } else {
2180                         hci_update_adv_data_sync(hdev, 0x00);
2181                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2182                 }
2183
2184                 hci_update_passive_scan(hdev);
2185         }
2186
2187         return err;
2188 }
2189
2190 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2191 {
2192         struct mgmt_pending_cmd *cmd = data;
2193         u8 status = mgmt_status(err);
2194         struct sock *sk = cmd->sk;
2195
2196         if (status) {
2197                 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2198                                      cmd_status_rsp, &status);
2199                 return;
2200         }
2201
2202         mgmt_pending_remove(cmd);
2203         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2204 }
2205
2206 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2207 {
2208         struct mgmt_pending_cmd *cmd = data;
2209         struct mgmt_cp_set_mesh *cp = cmd->param;
2210         size_t len = cmd->param_len;
2211
2212         memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2213
2214         if (cp->enable)
2215                 hci_dev_set_flag(hdev, HCI_MESH);
2216         else
2217                 hci_dev_clear_flag(hdev, HCI_MESH);
2218
2219         len -= sizeof(*cp);
2220
2221         /* If filters don't fit, forward all adv pkts */
2222         if (len <= sizeof(hdev->mesh_ad_types))
2223                 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2224
2225         hci_update_passive_scan_sync(hdev);
2226         return 0;
2227 }
2228
2229 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2230 {
2231         struct mgmt_cp_set_mesh *cp = data;
2232         struct mgmt_pending_cmd *cmd;
2233         int err = 0;
2234
2235         bt_dev_dbg(hdev, "sock %p", sk);
2236
2237         if (!lmp_le_capable(hdev) ||
2238             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2239                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2240                                        MGMT_STATUS_NOT_SUPPORTED);
2241
2242         if (cp->enable != 0x00 && cp->enable != 0x01)
2243                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2244                                        MGMT_STATUS_INVALID_PARAMS);
2245
2246         hci_dev_lock(hdev);
2247
2248         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2249         if (!cmd)
2250                 err = -ENOMEM;
2251         else
2252                 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2253                                          set_mesh_complete);
2254
2255         if (err < 0) {
2256                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2257                                       MGMT_STATUS_FAILED);
2258
2259                 if (cmd)
2260                         mgmt_pending_remove(cmd);
2261         }
2262
2263         hci_dev_unlock(hdev);
2264         return err;
2265 }
2266
2267 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2268 {
2269         struct mgmt_mesh_tx *mesh_tx = data;
2270         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2271         unsigned long mesh_send_interval;
2272         u8 mgmt_err = mgmt_status(err);
2273
2274         /* Report any errors here, but don't report completion */
2275
2276         if (mgmt_err) {
2277                 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2278                 /* Send Complete Error Code for handle */
2279                 mesh_send_complete(hdev, mesh_tx, false);
2280                 return;
2281         }
2282
2283         mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2284         queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2285                            mesh_send_interval);
2286 }
2287
2288 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2289 {
2290         struct mgmt_mesh_tx *mesh_tx = data;
2291         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2292         struct adv_info *adv, *next_instance;
2293         u8 instance = hdev->le_num_of_adv_sets + 1;
2294         u16 timeout, duration;
2295         int err = 0;
2296
2297         if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2298                 return MGMT_STATUS_BUSY;
2299
2300         timeout = 1000;
2301         duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2302         adv = hci_add_adv_instance(hdev, instance, 0,
2303                                    send->adv_data_len, send->adv_data,
2304                                    0, NULL,
2305                                    timeout, duration,
2306                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
2307                                    hdev->le_adv_min_interval,
2308                                    hdev->le_adv_max_interval,
2309                                    mesh_tx->handle);
2310
2311         if (!IS_ERR(adv))
2312                 mesh_tx->instance = instance;
2313         else
2314                 err = PTR_ERR(adv);
2315
2316         if (hdev->cur_adv_instance == instance) {
2317                 /* If the currently advertised instance is being changed then
2318                  * cancel the current advertising and schedule the next
2319                  * instance. If there is only one instance then the overridden
2320                  * advertising data will be visible right away.
2321                  */
2322                 cancel_adv_timeout(hdev);
2323
2324                 next_instance = hci_get_next_instance(hdev, instance);
2325                 if (next_instance)
2326                         instance = next_instance->instance;
2327                 else
2328                         instance = 0;
2329         } else if (hdev->adv_instance_timeout) {
2330                 /* Immediately advertise the new instance if no other, or
2331                  * let it go naturally from queue if ADV is already happening
2332                  */
2333                 instance = 0;
2334         }
2335
2336         if (instance)
2337                 return hci_schedule_adv_instance_sync(hdev, instance, true);
2338
2339         return err;
2340 }
2341
2342 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2343 {
2344         struct mgmt_rp_mesh_read_features *rp = data;
2345
2346         if (rp->used_handles >= rp->max_handles)
2347                 return;
2348
2349         rp->handles[rp->used_handles++] = mesh_tx->handle;
2350 }
2351
2352 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2353                          void *data, u16 len)
2354 {
2355         struct mgmt_rp_mesh_read_features rp;
2356
2357         if (!lmp_le_capable(hdev) ||
2358             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2359                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2360                                        MGMT_STATUS_NOT_SUPPORTED);
2361
2362         memset(&rp, 0, sizeof(rp));
2363         rp.index = cpu_to_le16(hdev->id);
2364         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2365                 rp.max_handles = MESH_HANDLES_MAX;
2366
2367         hci_dev_lock(hdev);
2368
2369         if (rp.max_handles)
2370                 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2371
2372         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2373                           rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2374
2375         hci_dev_unlock(hdev);
2376         return 0;
2377 }
2378
2379 static int send_cancel(struct hci_dev *hdev, void *data)
2380 {
2381         struct mgmt_pending_cmd *cmd = data;
2382         struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2383         struct mgmt_mesh_tx *mesh_tx;
2384
2385         if (!cancel->handle) {
2386                 do {
2387                         mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2388
2389                         if (mesh_tx)
2390                                 mesh_send_complete(hdev, mesh_tx, false);
2391                 } while (mesh_tx);
2392         } else {
2393                 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2394
2395                 if (mesh_tx && mesh_tx->sk == cmd->sk)
2396                         mesh_send_complete(hdev, mesh_tx, false);
2397         }
2398
2399         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2400                           0, NULL, 0);
2401         mgmt_pending_free(cmd);
2402
2403         return 0;
2404 }
2405
2406 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2407                             void *data, u16 len)
2408 {
2409         struct mgmt_pending_cmd *cmd;
2410         int err;
2411
2412         if (!lmp_le_capable(hdev) ||
2413             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2414                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2415                                        MGMT_STATUS_NOT_SUPPORTED);
2416
2417         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2418                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2419                                        MGMT_STATUS_REJECTED);
2420
2421         hci_dev_lock(hdev);
2422         cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2423         if (!cmd)
2424                 err = -ENOMEM;
2425         else
2426                 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2427
2428         if (err < 0) {
2429                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2430                                       MGMT_STATUS_FAILED);
2431
2432                 if (cmd)
2433                         mgmt_pending_free(cmd);
2434         }
2435
2436         hci_dev_unlock(hdev);
2437         return err;
2438 }
2439
2440 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2441 {
2442         struct mgmt_mesh_tx *mesh_tx;
2443         struct mgmt_cp_mesh_send *send = data;
2444         struct mgmt_rp_mesh_read_features rp;
2445         bool sending;
2446         int err = 0;
2447
2448         if (!lmp_le_capable(hdev) ||
2449             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2450                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2451                                        MGMT_STATUS_NOT_SUPPORTED);
2452         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2453             len <= MGMT_MESH_SEND_SIZE ||
2454             len > (MGMT_MESH_SEND_SIZE + 31))
2455                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2456                                        MGMT_STATUS_REJECTED);
2457
2458         hci_dev_lock(hdev);
2459
2460         memset(&rp, 0, sizeof(rp));
2461         rp.max_handles = MESH_HANDLES_MAX;
2462
2463         mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2464
2465         if (rp.max_handles <= rp.used_handles) {
2466                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2467                                       MGMT_STATUS_BUSY);
2468                 goto done;
2469         }
2470
2471         sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2472         mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2473
2474         if (!mesh_tx)
2475                 err = -ENOMEM;
2476         else if (!sending)
2477                 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2478                                          mesh_send_start_complete);
2479
2480         if (err < 0) {
2481                 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2482                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2483                                       MGMT_STATUS_FAILED);
2484
2485                 if (mesh_tx) {
2486                         if (sending)
2487                                 mgmt_mesh_remove(mesh_tx);
2488                 }
2489         } else {
2490                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2491
2492                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2493                                   &mesh_tx->handle, 1);
2494         }
2495
2496 done:
2497         hci_dev_unlock(hdev);
2498         return err;
2499 }
2500
2501 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2502 {
2503         struct mgmt_mode *cp = data;
2504         struct mgmt_pending_cmd *cmd;
2505         int err;
2506         u8 val, enabled;
2507
2508         bt_dev_dbg(hdev, "sock %p", sk);
2509
2510         if (!lmp_le_capable(hdev))
2511                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2512                                        MGMT_STATUS_NOT_SUPPORTED);
2513
2514         if (cp->val != 0x00 && cp->val != 0x01)
2515                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2516                                        MGMT_STATUS_INVALID_PARAMS);
2517
2518         /* Bluetooth single mode LE only controllers or dual-mode
2519          * controllers configured as LE only devices, do not allow
2520          * switching LE off. These have either LE enabled explicitly
2521          * or BR/EDR has been previously switched off.
2522          *
2523          * When trying to enable an already enabled LE, then gracefully
2524          * send a positive response. Trying to disable it however will
2525          * result into rejection.
2526          */
2527         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2528                 if (cp->val == 0x01)
2529                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2530
2531                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2532                                        MGMT_STATUS_REJECTED);
2533         }
2534
2535         hci_dev_lock(hdev);
2536
2537         val = !!cp->val;
2538         enabled = lmp_host_le_capable(hdev);
2539
2540         if (!hdev_is_powered(hdev) || val == enabled) {
2541                 bool changed = false;
2542
2543                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2544                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2545                         changed = true;
2546                 }
2547
2548                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2549                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2550                         changed = true;
2551                 }
2552
2553                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2554                 if (err < 0)
2555                         goto unlock;
2556
2557                 if (changed)
2558                         err = new_settings(hdev, sk);
2559
2560                 goto unlock;
2561         }
2562
2563         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2564             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2565                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2566                                       MGMT_STATUS_BUSY);
2567                 goto unlock;
2568         }
2569
2570         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2571         if (!cmd)
2572                 err = -ENOMEM;
2573         else
2574                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2575                                          set_le_complete);
2576
2577         if (err < 0) {
2578                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2579                                       MGMT_STATUS_FAILED);
2580
2581                 if (cmd)
2582                         mgmt_pending_remove(cmd);
2583         }
2584
2585 unlock:
2586         hci_dev_unlock(hdev);
2587         return err;
2588 }
2589
2590 /* This is a helper function to test for pending mgmt commands that can
2591  * cause CoD or EIR HCI commands. We can only allow one such pending
2592  * mgmt command at a time since otherwise we cannot easily track what
2593  * the current values are, will be, and based on that calculate if a new
2594  * HCI command needs to be sent and if yes with what value.
2595  */
2596 static bool pending_eir_or_class(struct hci_dev *hdev)
2597 {
2598         struct mgmt_pending_cmd *cmd;
2599
2600         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2601                 switch (cmd->opcode) {
2602                 case MGMT_OP_ADD_UUID:
2603                 case MGMT_OP_REMOVE_UUID:
2604                 case MGMT_OP_SET_DEV_CLASS:
2605                 case MGMT_OP_SET_POWERED:
2606                         return true;
2607                 }
2608         }
2609
2610         return false;
2611 }
2612
2613 static const u8 bluetooth_base_uuid[] = {
2614                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2615                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2616 };
2617
2618 static u8 get_uuid_size(const u8 *uuid)
2619 {
2620         u32 val;
2621
2622         if (memcmp(uuid, bluetooth_base_uuid, 12))
2623                 return 128;
2624
2625         val = get_unaligned_le32(&uuid[12]);
2626         if (val > 0xffff)
2627                 return 32;
2628
2629         return 16;
2630 }
2631
2632 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2633 {
2634         struct mgmt_pending_cmd *cmd = data;
2635
2636         bt_dev_dbg(hdev, "err %d", err);
2637
2638         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2639                           mgmt_status(err), hdev->dev_class, 3);
2640
2641         mgmt_pending_free(cmd);
2642 }
2643
2644 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2645 {
2646         int err;
2647
2648         err = hci_update_class_sync(hdev);
2649         if (err)
2650                 return err;
2651
2652         return hci_update_eir_sync(hdev);
2653 }
2654
2655 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2656 {
2657         struct mgmt_cp_add_uuid *cp = data;
2658         struct mgmt_pending_cmd *cmd;
2659         struct bt_uuid *uuid;
2660         int err;
2661
2662         bt_dev_dbg(hdev, "sock %p", sk);
2663
2664         hci_dev_lock(hdev);
2665
2666         if (pending_eir_or_class(hdev)) {
2667                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2668                                       MGMT_STATUS_BUSY);
2669                 goto failed;
2670         }
2671
2672         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2673         if (!uuid) {
2674                 err = -ENOMEM;
2675                 goto failed;
2676         }
2677
2678         memcpy(uuid->uuid, cp->uuid, 16);
2679         uuid->svc_hint = cp->svc_hint;
2680         uuid->size = get_uuid_size(cp->uuid);
2681
2682         list_add_tail(&uuid->list, &hdev->uuids);
2683
2684         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2685         if (!cmd) {
2686                 err = -ENOMEM;
2687                 goto failed;
2688         }
2689
2690         err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2691         if (err < 0) {
2692                 mgmt_pending_free(cmd);
2693                 goto failed;
2694         }
2695
2696 failed:
2697         hci_dev_unlock(hdev);
2698         return err;
2699 }
2700
2701 static bool enable_service_cache(struct hci_dev *hdev)
2702 {
2703         if (!hdev_is_powered(hdev))
2704                 return false;
2705
2706         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2707                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2708                                    CACHE_TIMEOUT);
2709                 return true;
2710         }
2711
2712         return false;
2713 }
2714
2715 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2716 {
2717         int err;
2718
2719         err = hci_update_class_sync(hdev);
2720         if (err)
2721                 return err;
2722
2723         return hci_update_eir_sync(hdev);
2724 }
2725
2726 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2727                        u16 len)
2728 {
2729         struct mgmt_cp_remove_uuid *cp = data;
2730         struct mgmt_pending_cmd *cmd;
2731         struct bt_uuid *match, *tmp;
2732         static const u8 bt_uuid_any[] = {
2733                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2734         };
2735         int err, found;
2736
2737         bt_dev_dbg(hdev, "sock %p", sk);
2738
2739         hci_dev_lock(hdev);
2740
2741         if (pending_eir_or_class(hdev)) {
2742                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2743                                       MGMT_STATUS_BUSY);
2744                 goto unlock;
2745         }
2746
2747         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2748                 hci_uuids_clear(hdev);
2749
2750                 if (enable_service_cache(hdev)) {
2751                         err = mgmt_cmd_complete(sk, hdev->id,
2752                                                 MGMT_OP_REMOVE_UUID,
2753                                                 0, hdev->dev_class, 3);
2754                         goto unlock;
2755                 }
2756
2757                 goto update_class;
2758         }
2759
2760         found = 0;
2761
2762         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2763                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2764                         continue;
2765
2766                 list_del(&match->list);
2767                 kfree(match);
2768                 found++;
2769         }
2770
2771         if (found == 0) {
2772                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2773                                       MGMT_STATUS_INVALID_PARAMS);
2774                 goto unlock;
2775         }
2776
2777 update_class:
2778         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2779         if (!cmd) {
2780                 err = -ENOMEM;
2781                 goto unlock;
2782         }
2783
2784         err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2785                                  mgmt_class_complete);
2786         if (err < 0)
2787                 mgmt_pending_free(cmd);
2788
2789 unlock:
2790         hci_dev_unlock(hdev);
2791         return err;
2792 }
2793
2794 static int set_class_sync(struct hci_dev *hdev, void *data)
2795 {
2796         int err = 0;
2797
2798         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2799                 cancel_delayed_work_sync(&hdev->service_cache);
2800                 err = hci_update_eir_sync(hdev);
2801         }
2802
2803         if (err)
2804                 return err;
2805
2806         return hci_update_class_sync(hdev);
2807 }
2808
2809 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2810                          u16 len)
2811 {
2812         struct mgmt_cp_set_dev_class *cp = data;
2813         struct mgmt_pending_cmd *cmd;
2814         int err;
2815
2816         bt_dev_dbg(hdev, "sock %p", sk);
2817
2818         if (!lmp_bredr_capable(hdev))
2819                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2820                                        MGMT_STATUS_NOT_SUPPORTED);
2821
2822         hci_dev_lock(hdev);
2823
2824         if (pending_eir_or_class(hdev)) {
2825                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2826                                       MGMT_STATUS_BUSY);
2827                 goto unlock;
2828         }
2829
2830         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2831                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2832                                       MGMT_STATUS_INVALID_PARAMS);
2833                 goto unlock;
2834         }
2835
2836         hdev->major_class = cp->major;
2837         hdev->minor_class = cp->minor;
2838
2839         if (!hdev_is_powered(hdev)) {
2840                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2841                                         hdev->dev_class, 3);
2842                 goto unlock;
2843         }
2844
2845         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2846         if (!cmd) {
2847                 err = -ENOMEM;
2848                 goto unlock;
2849         }
2850
2851         err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2852                                  mgmt_class_complete);
2853         if (err < 0)
2854                 mgmt_pending_free(cmd);
2855
2856 unlock:
2857         hci_dev_unlock(hdev);
2858         return err;
2859 }
2860
2861 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2862                           u16 len)
2863 {
2864         struct mgmt_cp_load_link_keys *cp = data;
2865         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2866                                    sizeof(struct mgmt_link_key_info));
2867         u16 key_count, expected_len;
2868         bool changed;
2869         int i;
2870
2871         bt_dev_dbg(hdev, "sock %p", sk);
2872
2873         if (!lmp_bredr_capable(hdev))
2874                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2875                                        MGMT_STATUS_NOT_SUPPORTED);
2876
2877         key_count = __le16_to_cpu(cp->key_count);
2878         if (key_count > max_key_count) {
2879                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2880                            key_count);
2881                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2882                                        MGMT_STATUS_INVALID_PARAMS);
2883         }
2884
2885         expected_len = struct_size(cp, keys, key_count);
2886         if (expected_len != len) {
2887                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2888                            expected_len, len);
2889                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2890                                        MGMT_STATUS_INVALID_PARAMS);
2891         }
2892
2893         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2894                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2895                                        MGMT_STATUS_INVALID_PARAMS);
2896
2897         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2898                    key_count);
2899
2900         for (i = 0; i < key_count; i++) {
2901                 struct mgmt_link_key_info *key = &cp->keys[i];
2902
2903                 /* Considering SMP over BREDR/LE, there is no need to check addr_type */
2904                 if (key->type > 0x08)
2905                         return mgmt_cmd_status(sk, hdev->id,
2906                                                MGMT_OP_LOAD_LINK_KEYS,
2907                                                MGMT_STATUS_INVALID_PARAMS);
2908         }
2909
2910         hci_dev_lock(hdev);
2911
2912         hci_link_keys_clear(hdev);
2913
2914         if (cp->debug_keys)
2915                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2916         else
2917                 changed = hci_dev_test_and_clear_flag(hdev,
2918                                                       HCI_KEEP_DEBUG_KEYS);
2919
2920         if (changed)
2921                 new_settings(hdev, NULL);
2922
2923         for (i = 0; i < key_count; i++) {
2924                 struct mgmt_link_key_info *key = &cp->keys[i];
2925
2926                 if (hci_is_blocked_key(hdev,
2927                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2928                                        key->val)) {
2929                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2930                                     &key->addr.bdaddr);
2931                         continue;
2932                 }
2933
2934                 /* Always ignore debug keys and require a new pairing if
2935                  * the user wants to use them.
2936                  */
2937                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2938                         continue;
2939
2940                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2941                                  key->type, key->pin_len, NULL);
2942         }
2943
2944         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2945
2946         hci_dev_unlock(hdev);
2947
2948         return 0;
2949 }
2950
2951 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2952                            u8 addr_type, struct sock *skip_sk)
2953 {
2954         struct mgmt_ev_device_unpaired ev;
2955
2956         bacpy(&ev.addr.bdaddr, bdaddr);
2957         ev.addr.type = addr_type;
2958
2959         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2960                           skip_sk);
2961 }
2962
2963 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2964 {
2965         struct mgmt_pending_cmd *cmd = data;
2966         struct mgmt_cp_unpair_device *cp = cmd->param;
2967
2968         if (!err)
2969                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2970
2971         cmd->cmd_complete(cmd, err);
2972         mgmt_pending_free(cmd);
2973 }
2974
2975 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2976 {
2977         struct mgmt_pending_cmd *cmd = data;
2978         struct mgmt_cp_unpair_device *cp = cmd->param;
2979         struct hci_conn *conn;
2980
2981         if (cp->addr.type == BDADDR_BREDR)
2982                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2983                                                &cp->addr.bdaddr);
2984         else
2985                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2986                                                le_addr_type(cp->addr.type));
2987
2988         if (!conn)
2989                 return 0;
2990
2991         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2992 }
2993
2994 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2995                          u16 len)
2996 {
2997         struct mgmt_cp_unpair_device *cp = data;
2998         struct mgmt_rp_unpair_device rp;
2999         struct hci_conn_params *params;
3000         struct mgmt_pending_cmd *cmd;
3001         struct hci_conn *conn;
3002         u8 addr_type;
3003         int err;
3004
3005         memset(&rp, 0, sizeof(rp));
3006         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3007         rp.addr.type = cp->addr.type;
3008
3009         if (!bdaddr_type_is_valid(cp->addr.type))
3010                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3011                                          MGMT_STATUS_INVALID_PARAMS,
3012                                          &rp, sizeof(rp));
3013
3014         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
3015                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3016                                          MGMT_STATUS_INVALID_PARAMS,
3017                                          &rp, sizeof(rp));
3018
3019         hci_dev_lock(hdev);
3020
3021         if (!hdev_is_powered(hdev)) {
3022                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3023                                         MGMT_STATUS_NOT_POWERED, &rp,
3024                                         sizeof(rp));
3025                 goto unlock;
3026         }
3027
3028         if (cp->addr.type == BDADDR_BREDR) {
3029                 /* If disconnection is requested, then look up the
3030                  * connection. If the remote device is connected, it
3031                  * will be later used to terminate the link.
3032                  *
3033                  * Setting it to NULL explicitly will cause no
3034                  * termination of the link.
3035                  */
3036                 if (cp->disconnect)
3037                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3038                                                        &cp->addr.bdaddr);
3039                 else
3040                         conn = NULL;
3041
3042                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3043                 if (err < 0) {
3044                         err = mgmt_cmd_complete(sk, hdev->id,
3045                                                 MGMT_OP_UNPAIR_DEVICE,
3046                                                 MGMT_STATUS_NOT_PAIRED, &rp,
3047                                                 sizeof(rp));
3048                         goto unlock;
3049                 }
3050
3051                 goto done;
3052         }
3053
3054         /* LE address type */
3055         addr_type = le_addr_type(cp->addr.type);
3056
3057         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3058         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3059         if (err < 0) {
3060                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3061                                         MGMT_STATUS_NOT_PAIRED, &rp,
3062                                         sizeof(rp));
3063                 goto unlock;
3064         }
3065
3066         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3067         if (!conn) {
3068                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3069                 goto done;
3070         }
3071
3072
3073         /* Defer clearing up the connection parameters until closing to
3074          * give a chance of keeping them if a repairing happens.
3075          */
3076         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3077
3078         /* Disable auto-connection parameters if present */
3079         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3080         if (params) {
3081                 if (params->explicit_connect)
3082                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3083                 else
3084                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3085         }
3086
3087         /* If disconnection is not requested, then clear the connection
3088          * variable so that the link is not terminated.
3089          */
3090         if (!cp->disconnect)
3091                 conn = NULL;
3092
3093 done:
3094         /* If the connection variable is set, then termination of the
3095          * link is requested.
3096          */
3097         if (!conn) {
3098                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3099                                         &rp, sizeof(rp));
3100                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3101                 goto unlock;
3102         }
3103
3104         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3105                                sizeof(*cp));
3106         if (!cmd) {
3107                 err = -ENOMEM;
3108                 goto unlock;
3109         }
3110
3111         cmd->cmd_complete = addr_cmd_complete;
3112
3113         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3114                                  unpair_device_complete);
3115         if (err < 0)
3116                 mgmt_pending_free(cmd);
3117
3118 unlock:
3119         hci_dev_unlock(hdev);
3120         return err;
3121 }
3122
3123 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3124                       u16 len)
3125 {
3126         struct mgmt_cp_disconnect *cp = data;
3127         struct mgmt_rp_disconnect rp;
3128         struct mgmt_pending_cmd *cmd;
3129         struct hci_conn *conn;
3130         int err;
3131
3132         bt_dev_dbg(hdev, "sock %p", sk);
3133
3134         memset(&rp, 0, sizeof(rp));
3135         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3136         rp.addr.type = cp->addr.type;
3137
3138         if (!bdaddr_type_is_valid(cp->addr.type))
3139                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3140                                          MGMT_STATUS_INVALID_PARAMS,
3141                                          &rp, sizeof(rp));
3142
3143         hci_dev_lock(hdev);
3144
3145         if (!test_bit(HCI_UP, &hdev->flags)) {
3146                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3147                                         MGMT_STATUS_NOT_POWERED, &rp,
3148                                         sizeof(rp));
3149                 goto failed;
3150         }
3151
3152         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3153                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3154                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3155                 goto failed;
3156         }
3157
3158         if (cp->addr.type == BDADDR_BREDR)
3159                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3160                                                &cp->addr.bdaddr);
3161         else
3162                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3163                                                le_addr_type(cp->addr.type));
3164
3165         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3166                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3167                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3168                                         sizeof(rp));
3169                 goto failed;
3170         }
3171
3172         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3173         if (!cmd) {
3174                 err = -ENOMEM;
3175                 goto failed;
3176         }
3177
3178         cmd->cmd_complete = generic_cmd_complete;
3179
3180         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3181         if (err < 0)
3182                 mgmt_pending_remove(cmd);
3183
3184 failed:
3185         hci_dev_unlock(hdev);
3186         return err;
3187 }
3188
3189 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3190 {
3191         switch (link_type) {
3192         case LE_LINK:
3193                 switch (addr_type) {
3194                 case ADDR_LE_DEV_PUBLIC:
3195                         return BDADDR_LE_PUBLIC;
3196
3197                 default:
3198                         /* Fallback to LE Random address type */
3199                         return BDADDR_LE_RANDOM;
3200                 }
3201
3202         default:
3203                 /* Fallback to BR/EDR type */
3204                 return BDADDR_BREDR;
3205         }
3206 }
3207
3208 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3209                            u16 data_len)
3210 {
3211         struct mgmt_rp_get_connections *rp;
3212         struct hci_conn *c;
3213         int err;
3214         u16 i;
3215
3216         bt_dev_dbg(hdev, "sock %p", sk);
3217
3218         hci_dev_lock(hdev);
3219
3220         if (!hdev_is_powered(hdev)) {
3221                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3222                                       MGMT_STATUS_NOT_POWERED);
3223                 goto unlock;
3224         }
3225
3226         i = 0;
3227         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3228                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3229                         i++;
3230         }
3231
3232         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
3233         if (!rp) {
3234                 err = -ENOMEM;
3235                 goto unlock;
3236         }
3237
3238         i = 0;
3239         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3240                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3241                         continue;
3242                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3243                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3244                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3245                         continue;
3246                 i++;
3247         }
3248
3249         rp->conn_count = cpu_to_le16(i);
3250
3251         /* Recalculate length in case of filtered SCO connections, etc */
3252         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3253                                 struct_size(rp, addr, i));
3254
3255         kfree(rp);
3256
3257 unlock:
3258         hci_dev_unlock(hdev);
3259         return err;
3260 }
3261
3262 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3263                                    struct mgmt_cp_pin_code_neg_reply *cp)
3264 {
3265         struct mgmt_pending_cmd *cmd;
3266         int err;
3267
3268         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3269                                sizeof(*cp));
3270         if (!cmd)
3271                 return -ENOMEM;
3272
3273         cmd->cmd_complete = addr_cmd_complete;
3274
3275         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3276                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3277         if (err < 0)
3278                 mgmt_pending_remove(cmd);
3279
3280         return err;
3281 }
3282
3283 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3284                           u16 len)
3285 {
3286         struct hci_conn *conn;
3287         struct mgmt_cp_pin_code_reply *cp = data;
3288         struct hci_cp_pin_code_reply reply;
3289         struct mgmt_pending_cmd *cmd;
3290         int err;
3291
3292         bt_dev_dbg(hdev, "sock %p", sk);
3293
3294         hci_dev_lock(hdev);
3295
3296         if (!hdev_is_powered(hdev)) {
3297                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3298                                       MGMT_STATUS_NOT_POWERED);
3299                 goto failed;
3300         }
3301
3302         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3303         if (!conn) {
3304                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3305                                       MGMT_STATUS_NOT_CONNECTED);
3306                 goto failed;
3307         }
3308
3309         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3310                 struct mgmt_cp_pin_code_neg_reply ncp;
3311
3312                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3313
3314                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3315
3316                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3317                 if (err >= 0)
3318                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3319                                               MGMT_STATUS_INVALID_PARAMS);
3320
3321                 goto failed;
3322         }
3323
3324         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3325         if (!cmd) {
3326                 err = -ENOMEM;
3327                 goto failed;
3328         }
3329
3330         cmd->cmd_complete = addr_cmd_complete;
3331
3332         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3333         reply.pin_len = cp->pin_len;
3334         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3335
3336         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3337         if (err < 0)
3338                 mgmt_pending_remove(cmd);
3339
3340 failed:
3341         hci_dev_unlock(hdev);
3342         return err;
3343 }
3344
3345 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3346                              u16 len)
3347 {
3348         struct mgmt_cp_set_io_capability *cp = data;
3349
3350         bt_dev_dbg(hdev, "sock %p", sk);
3351
3352         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3353                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3354                                        MGMT_STATUS_INVALID_PARAMS);
3355
3356         hci_dev_lock(hdev);
3357
3358         hdev->io_capability = cp->io_capability;
3359
3360         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3361
3362         hci_dev_unlock(hdev);
3363
3364         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3365                                  NULL, 0);
3366 }
3367
3368 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3369 {
3370         struct hci_dev *hdev = conn->hdev;
3371         struct mgmt_pending_cmd *cmd;
3372
3373         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3374                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3375                         continue;
3376
3377                 if (cmd->user_data != conn)
3378                         continue;
3379
3380                 return cmd;
3381         }
3382
3383         return NULL;
3384 }
3385
3386 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3387 {
3388         struct mgmt_rp_pair_device rp;
3389         struct hci_conn *conn = cmd->user_data;
3390         int err;
3391
3392         bacpy(&rp.addr.bdaddr, &conn->dst);
3393         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3394
3395         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3396                                 status, &rp, sizeof(rp));
3397
3398         /* So we don't get further callbacks for this connection */
3399         conn->connect_cfm_cb = NULL;
3400         conn->security_cfm_cb = NULL;
3401         conn->disconn_cfm_cb = NULL;
3402
3403         hci_conn_drop(conn);
3404
3405         /* The device is paired so there is no need to remove
3406          * its connection parameters anymore.
3407          */
3408         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3409
3410         hci_conn_put(conn);
3411
3412         return err;
3413 }
3414
3415 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3416 {
3417         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3418         struct mgmt_pending_cmd *cmd;
3419
3420         cmd = find_pairing(conn);
3421         if (cmd) {
3422                 cmd->cmd_complete(cmd, status);
3423                 mgmt_pending_remove(cmd);
3424         }
3425 }
3426
3427 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3428 {
3429         struct mgmt_pending_cmd *cmd;
3430
3431         BT_DBG("status %u", status);
3432
3433         cmd = find_pairing(conn);
3434         if (!cmd) {
3435                 BT_DBG("Unable to find a pending command");
3436                 return;
3437         }
3438
3439         cmd->cmd_complete(cmd, mgmt_status(status));
3440         mgmt_pending_remove(cmd);
3441 }
3442
3443 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3444 {
3445         struct mgmt_pending_cmd *cmd;
3446
3447         BT_DBG("status %u", status);
3448
3449         if (!status)
3450                 return;
3451
3452         cmd = find_pairing(conn);
3453         if (!cmd) {
3454                 BT_DBG("Unable to find a pending command");
3455                 return;
3456         }
3457
3458         cmd->cmd_complete(cmd, mgmt_status(status));
3459         mgmt_pending_remove(cmd);
3460 }
3461
3462 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3463                        u16 len)
3464 {
3465         struct mgmt_cp_pair_device *cp = data;
3466         struct mgmt_rp_pair_device rp;
3467         struct mgmt_pending_cmd *cmd;
3468         u8 sec_level, auth_type;
3469         struct hci_conn *conn;
3470         int err;
3471
3472         bt_dev_dbg(hdev, "sock %p", sk);
3473
3474         memset(&rp, 0, sizeof(rp));
3475         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3476         rp.addr.type = cp->addr.type;
3477
3478         if (!bdaddr_type_is_valid(cp->addr.type))
3479                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3480                                          MGMT_STATUS_INVALID_PARAMS,
3481                                          &rp, sizeof(rp));
3482
3483         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3484                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3485                                          MGMT_STATUS_INVALID_PARAMS,
3486                                          &rp, sizeof(rp));
3487
3488         hci_dev_lock(hdev);
3489
3490         if (!hdev_is_powered(hdev)) {
3491                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3492                                         MGMT_STATUS_NOT_POWERED, &rp,
3493                                         sizeof(rp));
3494                 goto unlock;
3495         }
3496
3497         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3498                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3499                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3500                                         sizeof(rp));
3501                 goto unlock;
3502         }
3503
3504         sec_level = BT_SECURITY_MEDIUM;
3505         auth_type = HCI_AT_DEDICATED_BONDING;
3506
3507         if (cp->addr.type == BDADDR_BREDR) {
3508                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3509                                        auth_type, CONN_REASON_PAIR_DEVICE);
3510         } else {
3511                 u8 addr_type = le_addr_type(cp->addr.type);
3512                 struct hci_conn_params *p;
3513
3514                 /* When pairing a new device, it is expected to remember
3515                  * this device for future connections. Adding the connection
3516                  * parameter information ahead of time allows tracking
3517                  * of the peripheral preferred values and will speed up any
3518                  * further connection establishment.
3519                  *
3520                  * If connection parameters already exist, then they
3521                  * will be kept and this function does nothing.
3522                  */
3523                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3524
3525                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3526                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3527
3528                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3529                                            sec_level, HCI_LE_CONN_TIMEOUT,
3530                                            CONN_REASON_PAIR_DEVICE);
3531         }
3532
3533         if (IS_ERR(conn)) {
3534                 int status;
3535
3536                 if (PTR_ERR(conn) == -EBUSY)
3537                         status = MGMT_STATUS_BUSY;
3538                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3539                         status = MGMT_STATUS_NOT_SUPPORTED;
3540                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3541                         status = MGMT_STATUS_REJECTED;
3542                 else
3543                         status = MGMT_STATUS_CONNECT_FAILED;
3544
3545                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3546                                         status, &rp, sizeof(rp));
3547                 goto unlock;
3548         }
3549
3550         if (conn->connect_cfm_cb) {
3551                 hci_conn_drop(conn);
3552                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3553                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3554                 goto unlock;
3555         }
3556
3557         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3558         if (!cmd) {
3559                 err = -ENOMEM;
3560                 hci_conn_drop(conn);
3561                 goto unlock;
3562         }
3563
3564         cmd->cmd_complete = pairing_complete;
3565
3566         /* For LE, just connecting isn't a proof that the pairing finished */
3567         if (cp->addr.type == BDADDR_BREDR) {
3568                 conn->connect_cfm_cb = pairing_complete_cb;
3569                 conn->security_cfm_cb = pairing_complete_cb;
3570                 conn->disconn_cfm_cb = pairing_complete_cb;
3571         } else {
3572                 conn->connect_cfm_cb = le_pairing_complete_cb;
3573                 conn->security_cfm_cb = le_pairing_complete_cb;
3574                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3575         }
3576
3577         conn->io_capability = cp->io_cap;
3578         cmd->user_data = hci_conn_get(conn);
3579
3580         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3581             hci_conn_security(conn, sec_level, auth_type, true)) {
3582                 cmd->cmd_complete(cmd, 0);
3583                 mgmt_pending_remove(cmd);
3584         }
3585
3586         err = 0;
3587
3588 unlock:
3589         hci_dev_unlock(hdev);
3590         return err;
3591 }
3592
3593 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3594                               u16 len)
3595 {
3596         struct mgmt_addr_info *addr = data;
3597         struct mgmt_pending_cmd *cmd;
3598         struct hci_conn *conn;
3599         int err;
3600
3601         bt_dev_dbg(hdev, "sock %p", sk);
3602
3603         hci_dev_lock(hdev);
3604
3605         if (!hdev_is_powered(hdev)) {
3606                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3607                                       MGMT_STATUS_NOT_POWERED);
3608                 goto unlock;
3609         }
3610
3611         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3612         if (!cmd) {
3613                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3614                                       MGMT_STATUS_INVALID_PARAMS);
3615                 goto unlock;
3616         }
3617
3618         conn = cmd->user_data;
3619
3620         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3621                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3622                                       MGMT_STATUS_INVALID_PARAMS);
3623                 goto unlock;
3624         }
3625
3626         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3627         mgmt_pending_remove(cmd);
3628
3629         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3630                                 addr, sizeof(*addr));
3631
3632         /* Since user doesn't want to proceed with the connection, abort any
3633          * ongoing pairing and then terminate the link if it was created
3634          * because of the pair device action.
3635          */
3636         if (addr->type == BDADDR_BREDR)
3637                 hci_remove_link_key(hdev, &addr->bdaddr);
3638         else
3639                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3640                                               le_addr_type(addr->type));
3641
3642         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3643                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3644
3645 unlock:
3646         hci_dev_unlock(hdev);
3647         return err;
3648 }
3649
3650 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3651                              struct mgmt_addr_info *addr, u16 mgmt_op,
3652                              u16 hci_op, __le32 passkey)
3653 {
3654         struct mgmt_pending_cmd *cmd;
3655         struct hci_conn *conn;
3656         int err;
3657
3658         hci_dev_lock(hdev);
3659
3660         if (!hdev_is_powered(hdev)) {
3661                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3662                                         MGMT_STATUS_NOT_POWERED, addr,
3663                                         sizeof(*addr));
3664                 goto done;
3665         }
3666
3667         if (addr->type == BDADDR_BREDR)
3668                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3669         else
3670                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3671                                                le_addr_type(addr->type));
3672
3673         if (!conn) {
3674                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3675                                         MGMT_STATUS_NOT_CONNECTED, addr,
3676                                         sizeof(*addr));
3677                 goto done;
3678         }
3679
3680         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3681                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3682                 if (!err)
3683                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3684                                                 MGMT_STATUS_SUCCESS, addr,
3685                                                 sizeof(*addr));
3686                 else
3687                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3688                                                 MGMT_STATUS_FAILED, addr,
3689                                                 sizeof(*addr));
3690
3691                 goto done;
3692         }
3693
3694         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3695         if (!cmd) {
3696                 err = -ENOMEM;
3697                 goto done;
3698         }
3699
3700         cmd->cmd_complete = addr_cmd_complete;
3701
3702         /* Continue with pairing via HCI */
3703         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3704                 struct hci_cp_user_passkey_reply cp;
3705
3706                 bacpy(&cp.bdaddr, &addr->bdaddr);
3707                 cp.passkey = passkey;
3708                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3709         } else
3710                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3711                                    &addr->bdaddr);
3712
3713         if (err < 0)
3714                 mgmt_pending_remove(cmd);
3715
3716 done:
3717         hci_dev_unlock(hdev);
3718         return err;
3719 }
3720
3721 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3722                               void *data, u16 len)
3723 {
3724         struct mgmt_cp_pin_code_neg_reply *cp = data;
3725
3726         bt_dev_dbg(hdev, "sock %p", sk);
3727
3728         return user_pairing_resp(sk, hdev, &cp->addr,
3729                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3730                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3731 }
3732
3733 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3734                               u16 len)
3735 {
3736         struct mgmt_cp_user_confirm_reply *cp = data;
3737
3738         bt_dev_dbg(hdev, "sock %p", sk);
3739
3740         if (len != sizeof(*cp))
3741                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3742                                        MGMT_STATUS_INVALID_PARAMS);
3743
3744         return user_pairing_resp(sk, hdev, &cp->addr,
3745                                  MGMT_OP_USER_CONFIRM_REPLY,
3746                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3747 }
3748
3749 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3750                                   void *data, u16 len)
3751 {
3752         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3753
3754         bt_dev_dbg(hdev, "sock %p", sk);
3755
3756         return user_pairing_resp(sk, hdev, &cp->addr,
3757                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3758                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3759 }
3760
3761 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3762                               u16 len)
3763 {
3764         struct mgmt_cp_user_passkey_reply *cp = data;
3765
3766         bt_dev_dbg(hdev, "sock %p", sk);
3767
3768         return user_pairing_resp(sk, hdev, &cp->addr,
3769                                  MGMT_OP_USER_PASSKEY_REPLY,
3770                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3771 }
3772
3773 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3774                                   void *data, u16 len)
3775 {
3776         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3777
3778         bt_dev_dbg(hdev, "sock %p", sk);
3779
3780         return user_pairing_resp(sk, hdev, &cp->addr,
3781                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3782                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3783 }
3784
3785 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3786 {
3787         struct adv_info *adv_instance;
3788
3789         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3790         if (!adv_instance)
3791                 return 0;
3792
3793         /* stop if current instance doesn't need to be changed */
3794         if (!(adv_instance->flags & flags))
3795                 return 0;
3796
3797         cancel_adv_timeout(hdev);
3798
3799         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3800         if (!adv_instance)
3801                 return 0;
3802
3803         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3804
3805         return 0;
3806 }
3807
3808 static int name_changed_sync(struct hci_dev *hdev, void *data)
3809 {
3810         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3811 }
3812
3813 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3814 {
3815         struct mgmt_pending_cmd *cmd = data;
3816         struct mgmt_cp_set_local_name *cp = cmd->param;
3817         u8 status = mgmt_status(err);
3818
3819         bt_dev_dbg(hdev, "err %d", err);
3820
3821         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3822                 return;
3823
3824         if (status) {
3825                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3826                                 status);
3827         } else {
3828                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3829                                   cp, sizeof(*cp));
3830
3831                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3832                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3833         }
3834
3835         mgmt_pending_remove(cmd);
3836 }
3837
3838 static int set_name_sync(struct hci_dev *hdev, void *data)
3839 {
3840         if (lmp_bredr_capable(hdev)) {
3841                 hci_update_name_sync(hdev);
3842                 hci_update_eir_sync(hdev);
3843         }
3844
3845         /* The name is stored in the scan response data and so
3846          * no need to update the advertising data here.
3847          */
3848         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3849                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3850
3851         return 0;
3852 }
3853
3854 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3855                           u16 len)
3856 {
3857         struct mgmt_cp_set_local_name *cp = data;
3858         struct mgmt_pending_cmd *cmd;
3859         int err;
3860
3861         bt_dev_dbg(hdev, "sock %p", sk);
3862
3863         hci_dev_lock(hdev);
3864
3865         /* If the old values are the same as the new ones just return a
3866          * direct command complete event.
3867          */
3868         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3869             !memcmp(hdev->short_name, cp->short_name,
3870                     sizeof(hdev->short_name))) {
3871                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3872                                         data, len);
3873                 goto failed;
3874         }
3875
3876         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3877
3878         if (!hdev_is_powered(hdev)) {
3879                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3880
3881                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3882                                         data, len);
3883                 if (err < 0)
3884                         goto failed;
3885
3886                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3887                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3888                 ext_info_changed(hdev, sk);
3889
3890                 goto failed;
3891         }
3892
3893         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3894         if (!cmd)
3895                 err = -ENOMEM;
3896         else
3897                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3898                                          set_name_complete);
3899
3900         if (err < 0) {
3901                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3902                                       MGMT_STATUS_FAILED);
3903
3904                 if (cmd)
3905                         mgmt_pending_remove(cmd);
3906
3907                 goto failed;
3908         }
3909
3910         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3911
3912 failed:
3913         hci_dev_unlock(hdev);
3914         return err;
3915 }
3916
3917 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3918 {
3919         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3920 }
3921
3922 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3923                           u16 len)
3924 {
3925         struct mgmt_cp_set_appearance *cp = data;
3926         u16 appearance;
3927         int err;
3928
3929         bt_dev_dbg(hdev, "sock %p", sk);
3930
3931         if (!lmp_le_capable(hdev))
3932                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3933                                        MGMT_STATUS_NOT_SUPPORTED);
3934
3935         appearance = le16_to_cpu(cp->appearance);
3936
3937         hci_dev_lock(hdev);
3938
3939         if (hdev->appearance != appearance) {
3940                 hdev->appearance = appearance;
3941
3942                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3943                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3944                                            NULL);
3945
3946                 ext_info_changed(hdev, sk);
3947         }
3948
3949         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3950                                 0);
3951
3952         hci_dev_unlock(hdev);
3953
3954         return err;
3955 }
3956
3957 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3958                                  void *data, u16 len)
3959 {
3960         struct mgmt_rp_get_phy_configuration rp;
3961
3962         bt_dev_dbg(hdev, "sock %p", sk);
3963
3964         hci_dev_lock(hdev);
3965
3966         memset(&rp, 0, sizeof(rp));
3967
3968         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3969         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3970         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3971
3972         hci_dev_unlock(hdev);
3973
3974         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3975                                  &rp, sizeof(rp));
3976 }
3977
3978 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3979 {
3980         struct mgmt_ev_phy_configuration_changed ev;
3981
3982         memset(&ev, 0, sizeof(ev));
3983
3984         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3985
3986         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3987                           sizeof(ev), skip);
3988 }
3989
3990 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3991 {
3992         struct mgmt_pending_cmd *cmd = data;
3993         struct sk_buff *skb = cmd->skb;
3994         u8 status = mgmt_status(err);
3995
3996         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3997                 return;
3998
3999         if (!status) {
4000                 if (!skb)
4001                         status = MGMT_STATUS_FAILED;
4002                 else if (IS_ERR(skb))
4003                         status = mgmt_status(PTR_ERR(skb));
4004                 else
4005                         status = mgmt_status(skb->data[0]);
4006         }
4007
4008         bt_dev_dbg(hdev, "status %d", status);
4009
4010         if (status) {
4011                 mgmt_cmd_status(cmd->sk, hdev->id,
4012                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
4013         } else {
4014                 mgmt_cmd_complete(cmd->sk, hdev->id,
4015                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
4016                                   NULL, 0);
4017
4018                 mgmt_phy_configuration_changed(hdev, cmd->sk);
4019         }
4020
4021         if (skb && !IS_ERR(skb))
4022                 kfree_skb(skb);
4023
4024         mgmt_pending_remove(cmd);
4025 }
4026
4027 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4028 {
4029         struct mgmt_pending_cmd *cmd = data;
4030         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4031         struct hci_cp_le_set_default_phy cp_phy;
4032         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
4033
4034         memset(&cp_phy, 0, sizeof(cp_phy));
4035
4036         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4037                 cp_phy.all_phys |= 0x01;
4038
4039         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4040                 cp_phy.all_phys |= 0x02;
4041
4042         if (selected_phys & MGMT_PHY_LE_1M_TX)
4043                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4044
4045         if (selected_phys & MGMT_PHY_LE_2M_TX)
4046                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4047
4048         if (selected_phys & MGMT_PHY_LE_CODED_TX)
4049                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4050
4051         if (selected_phys & MGMT_PHY_LE_1M_RX)
4052                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4053
4054         if (selected_phys & MGMT_PHY_LE_2M_RX)
4055                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4056
4057         if (selected_phys & MGMT_PHY_LE_CODED_RX)
4058                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4059
4060         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4061                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4062
4063         return 0;
4064 }
4065
4066 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4067                                  void *data, u16 len)
4068 {
4069         struct mgmt_cp_set_phy_configuration *cp = data;
4070         struct mgmt_pending_cmd *cmd;
4071         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4072         u16 pkt_type = (HCI_DH1 | HCI_DM1);
4073         bool changed = false;
4074         int err;
4075
4076         bt_dev_dbg(hdev, "sock %p", sk);
4077
4078         configurable_phys = get_configurable_phys(hdev);
4079         supported_phys = get_supported_phys(hdev);
4080         selected_phys = __le32_to_cpu(cp->selected_phys);
4081
4082         if (selected_phys & ~supported_phys)
4083                 return mgmt_cmd_status(sk, hdev->id,
4084                                        MGMT_OP_SET_PHY_CONFIGURATION,
4085                                        MGMT_STATUS_INVALID_PARAMS);
4086
4087         unconfigure_phys = supported_phys & ~configurable_phys;
4088
4089         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4090                 return mgmt_cmd_status(sk, hdev->id,
4091                                        MGMT_OP_SET_PHY_CONFIGURATION,
4092                                        MGMT_STATUS_INVALID_PARAMS);
4093
4094         if (selected_phys == get_selected_phys(hdev))
4095                 return mgmt_cmd_complete(sk, hdev->id,
4096                                          MGMT_OP_SET_PHY_CONFIGURATION,
4097                                          0, NULL, 0);
4098
4099         hci_dev_lock(hdev);
4100
4101         if (!hdev_is_powered(hdev)) {
4102                 err = mgmt_cmd_status(sk, hdev->id,
4103                                       MGMT_OP_SET_PHY_CONFIGURATION,
4104                                       MGMT_STATUS_REJECTED);
4105                 goto unlock;
4106         }
4107
4108         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4109                 err = mgmt_cmd_status(sk, hdev->id,
4110                                       MGMT_OP_SET_PHY_CONFIGURATION,
4111                                       MGMT_STATUS_BUSY);
4112                 goto unlock;
4113         }
4114
4115         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4116                 pkt_type |= (HCI_DH3 | HCI_DM3);
4117         else
4118                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4119
4120         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4121                 pkt_type |= (HCI_DH5 | HCI_DM5);
4122         else
4123                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4124
4125         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4126                 pkt_type &= ~HCI_2DH1;
4127         else
4128                 pkt_type |= HCI_2DH1;
4129
4130         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4131                 pkt_type &= ~HCI_2DH3;
4132         else
4133                 pkt_type |= HCI_2DH3;
4134
4135         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4136                 pkt_type &= ~HCI_2DH5;
4137         else
4138                 pkt_type |= HCI_2DH5;
4139
4140         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4141                 pkt_type &= ~HCI_3DH1;
4142         else
4143                 pkt_type |= HCI_3DH1;
4144
4145         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4146                 pkt_type &= ~HCI_3DH3;
4147         else
4148                 pkt_type |= HCI_3DH3;
4149
4150         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4151                 pkt_type &= ~HCI_3DH5;
4152         else
4153                 pkt_type |= HCI_3DH5;
4154
4155         if (pkt_type != hdev->pkt_type) {
4156                 hdev->pkt_type = pkt_type;
4157                 changed = true;
4158         }
4159
4160         if ((selected_phys & MGMT_PHY_LE_MASK) ==
4161             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4162                 if (changed)
4163                         mgmt_phy_configuration_changed(hdev, sk);
4164
4165                 err = mgmt_cmd_complete(sk, hdev->id,
4166                                         MGMT_OP_SET_PHY_CONFIGURATION,
4167                                         0, NULL, 0);
4168
4169                 goto unlock;
4170         }
4171
4172         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4173                                len);
4174         if (!cmd)
4175                 err = -ENOMEM;
4176         else
4177                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4178                                          set_default_phy_complete);
4179
4180         if (err < 0) {
4181                 err = mgmt_cmd_status(sk, hdev->id,
4182                                       MGMT_OP_SET_PHY_CONFIGURATION,
4183                                       MGMT_STATUS_FAILED);
4184
4185                 if (cmd)
4186                         mgmt_pending_remove(cmd);
4187         }
4188
4189 unlock:
4190         hci_dev_unlock(hdev);
4191
4192         return err;
4193 }
4194
4195 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4196                             u16 len)
4197 {
4198         int err = MGMT_STATUS_SUCCESS;
4199         struct mgmt_cp_set_blocked_keys *keys = data;
4200         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4201                                    sizeof(struct mgmt_blocked_key_info));
4202         u16 key_count, expected_len;
4203         int i;
4204
4205         bt_dev_dbg(hdev, "sock %p", sk);
4206
4207         key_count = __le16_to_cpu(keys->key_count);
4208         if (key_count > max_key_count) {
4209                 bt_dev_err(hdev, "too big key_count value %u", key_count);
4210                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4211                                        MGMT_STATUS_INVALID_PARAMS);
4212         }
4213
4214         expected_len = struct_size(keys, keys, key_count);
4215         if (expected_len != len) {
4216                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4217                            expected_len, len);
4218                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4219                                        MGMT_STATUS_INVALID_PARAMS);
4220         }
4221
4222         hci_dev_lock(hdev);
4223
4224         hci_blocked_keys_clear(hdev);
4225
4226         for (i = 0; i < key_count; ++i) {
4227                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4228
4229                 if (!b) {
4230                         err = MGMT_STATUS_NO_RESOURCES;
4231                         break;
4232                 }
4233
4234                 b->type = keys->keys[i].type;
4235                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4236                 list_add_rcu(&b->list, &hdev->blocked_keys);
4237         }
4238         hci_dev_unlock(hdev);
4239
4240         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4241                                 err, NULL, 0);
4242 }
4243
4244 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4245                                void *data, u16 len)
4246 {
4247         struct mgmt_mode *cp = data;
4248         int err;
4249         bool changed = false;
4250
4251         bt_dev_dbg(hdev, "sock %p", sk);
4252
4253         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4254                 return mgmt_cmd_status(sk, hdev->id,
4255                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4256                                        MGMT_STATUS_NOT_SUPPORTED);
4257
4258         if (cp->val != 0x00 && cp->val != 0x01)
4259                 return mgmt_cmd_status(sk, hdev->id,
4260                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4261                                        MGMT_STATUS_INVALID_PARAMS);
4262
4263         hci_dev_lock(hdev);
4264
4265         if (hdev_is_powered(hdev) &&
4266             !!cp->val != hci_dev_test_flag(hdev,
4267                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
4268                 err = mgmt_cmd_status(sk, hdev->id,
4269                                       MGMT_OP_SET_WIDEBAND_SPEECH,
4270                                       MGMT_STATUS_REJECTED);
4271                 goto unlock;
4272         }
4273
4274         if (cp->val)
4275                 changed = !hci_dev_test_and_set_flag(hdev,
4276                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4277         else
4278                 changed = hci_dev_test_and_clear_flag(hdev,
4279                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4280
4281         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4282         if (err < 0)
4283                 goto unlock;
4284
4285         if (changed)
4286                 err = new_settings(hdev, sk);
4287
4288 unlock:
4289         hci_dev_unlock(hdev);
4290         return err;
4291 }
4292
4293 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4294                                void *data, u16 data_len)
4295 {
4296         char buf[20];
4297         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4298         u16 cap_len = 0;
4299         u8 flags = 0;
4300         u8 tx_power_range[2];
4301
4302         bt_dev_dbg(hdev, "sock %p", sk);
4303
4304         memset(&buf, 0, sizeof(buf));
4305
4306         hci_dev_lock(hdev);
4307
4308         /* When the Read Simple Pairing Options command is supported, then
4309          * the remote public key validation is supported.
4310          *
4311          * Alternatively, when Microsoft extensions are available, they can
4312          * indicate support for public key validation as well.
4313          */
4314         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4315                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
4316
4317         flags |= 0x02;          /* Remote public key validation (LE) */
4318
4319         /* When the Read Encryption Key Size command is supported, then the
4320          * encryption key size is enforced.
4321          */
4322         if (hdev->commands[20] & 0x10)
4323                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
4324
4325         flags |= 0x08;          /* Encryption key size enforcement (LE) */
4326
4327         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4328                                   &flags, 1);
4329
4330         /* When the Read Simple Pairing Options command is supported, then
4331          * also max encryption key size information is provided.
4332          */
4333         if (hdev->commands[41] & 0x08)
4334                 cap_len = eir_append_le16(rp->cap, cap_len,
4335                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
4336                                           hdev->max_enc_key_size);
4337
4338         cap_len = eir_append_le16(rp->cap, cap_len,
4339                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4340                                   SMP_MAX_ENC_KEY_SIZE);
4341
4342         /* Append the min/max LE tx power parameters if we were able to fetch
4343          * it from the controller
4344          */
4345         if (hdev->commands[38] & 0x80) {
4346                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4347                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4348                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4349                                           tx_power_range, 2);
4350         }
4351
4352         rp->cap_len = cpu_to_le16(cap_len);
4353
4354         hci_dev_unlock(hdev);
4355
4356         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4357                                  rp, sizeof(*rp) + cap_len);
4358 }
4359
4360 #ifdef CONFIG_BT_FEATURE_DEBUG
4361 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4362 static const u8 debug_uuid[16] = {
4363         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4364         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4365 };
4366 #endif
4367
4368 /* 330859bc-7506-492d-9370-9a6f0614037f */
4369 static const u8 quality_report_uuid[16] = {
4370         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4371         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4372 };
4373
4374 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4375 static const u8 offload_codecs_uuid[16] = {
4376         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4377         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4378 };
4379
4380 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4381 static const u8 le_simultaneous_roles_uuid[16] = {
4382         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4383         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4384 };
4385
4386 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
4387 static const u8 rpa_resolution_uuid[16] = {
4388         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4389         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4390 };
4391
4392 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4393 static const u8 iso_socket_uuid[16] = {
4394         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4395         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4396 };
4397
4398 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4399 static const u8 mgmt_mesh_uuid[16] = {
4400         0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4401         0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4402 };
4403
4404 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4405                                   void *data, u16 data_len)
4406 {
4407         struct mgmt_rp_read_exp_features_info *rp;
4408         size_t len;
4409         u16 idx = 0;
4410         u32 flags;
4411         int status;
4412
4413         bt_dev_dbg(hdev, "sock %p", sk);
4414
4415         /* Enough space for 7 features */
4416         len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4417         rp = kzalloc(len, GFP_KERNEL);
4418         if (!rp)
4419                 return -ENOMEM;
4420
4421 #ifdef CONFIG_BT_FEATURE_DEBUG
4422         if (!hdev) {
4423                 flags = bt_dbg_get() ? BIT(0) : 0;
4424
4425                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4426                 rp->features[idx].flags = cpu_to_le32(flags);
4427                 idx++;
4428         }
4429 #endif
4430
4431         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4432                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4433                         flags = BIT(0);
4434                 else
4435                         flags = 0;
4436
4437                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4438                 rp->features[idx].flags = cpu_to_le32(flags);
4439                 idx++;
4440         }
4441
4442         if (hdev && ll_privacy_capable(hdev)) {
4443                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4444                         flags = BIT(0) | BIT(1);
4445                 else
4446                         flags = BIT(1);
4447
4448                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4449                 rp->features[idx].flags = cpu_to_le32(flags);
4450                 idx++;
4451         }
4452
4453         if (hdev && (aosp_has_quality_report(hdev) ||
4454                      hdev->set_quality_report)) {
4455                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4456                         flags = BIT(0);
4457                 else
4458                         flags = 0;
4459
4460                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4461                 rp->features[idx].flags = cpu_to_le32(flags);
4462                 idx++;
4463         }
4464
4465         if (hdev && hdev->get_data_path_id) {
4466                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4467                         flags = BIT(0);
4468                 else
4469                         flags = 0;
4470
4471                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4472                 rp->features[idx].flags = cpu_to_le32(flags);
4473                 idx++;
4474         }
4475
4476         if (IS_ENABLED(CONFIG_BT_LE)) {
4477                 flags = iso_enabled() ? BIT(0) : 0;
4478                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4479                 rp->features[idx].flags = cpu_to_le32(flags);
4480                 idx++;
4481         }
4482
4483         if (hdev && lmp_le_capable(hdev)) {
4484                 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4485                         flags = BIT(0);
4486                 else
4487                         flags = 0;
4488
4489                 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4490                 rp->features[idx].flags = cpu_to_le32(flags);
4491                 idx++;
4492         }
4493
4494         rp->feature_count = cpu_to_le16(idx);
4495
4496         /* After reading the experimental features information, enable
4497          * the events to update client on any future change.
4498          */
4499         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4500
4501         status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4502                                    MGMT_OP_READ_EXP_FEATURES_INFO,
4503                                    0, rp, sizeof(*rp) + (20 * idx));
4504
4505         kfree(rp);
4506         return status;
4507 }
4508
4509 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4510                                           struct sock *skip)
4511 {
4512         struct mgmt_ev_exp_feature_changed ev;
4513
4514         memset(&ev, 0, sizeof(ev));
4515         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4516         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4517
4518         // Do we need to be atomic with the conn_flags?
4519         if (enabled && privacy_mode_capable(hdev))
4520                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4521         else
4522                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4523
4524         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4525                                   &ev, sizeof(ev),
4526                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4527
4528 }
4529
4530 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4531                                bool enabled, struct sock *skip)
4532 {
4533         struct mgmt_ev_exp_feature_changed ev;
4534
4535         memset(&ev, 0, sizeof(ev));
4536         memcpy(ev.uuid, uuid, 16);
4537         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4538
4539         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4540                                   &ev, sizeof(ev),
4541                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4542 }
4543
4544 #define EXP_FEAT(_uuid, _set_func)      \
4545 {                                       \
4546         .uuid = _uuid,                  \
4547         .set_func = _set_func,          \
4548 }
4549
4550 /* The zero key uuid is special. Multiple exp features are set through it. */
4551 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4552                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4553 {
4554         struct mgmt_rp_set_exp_feature rp;
4555
4556         memset(rp.uuid, 0, 16);
4557         rp.flags = cpu_to_le32(0);
4558
4559 #ifdef CONFIG_BT_FEATURE_DEBUG
4560         if (!hdev) {
4561                 bool changed = bt_dbg_get();
4562
4563                 bt_dbg_set(false);
4564
4565                 if (changed)
4566                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4567         }
4568 #endif
4569
4570         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4571                 bool changed;
4572
4573                 changed = hci_dev_test_and_clear_flag(hdev,
4574                                                       HCI_ENABLE_LL_PRIVACY);
4575                 if (changed)
4576                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4577                                             sk);
4578         }
4579
4580         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4581
4582         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4583                                  MGMT_OP_SET_EXP_FEATURE, 0,
4584                                  &rp, sizeof(rp));
4585 }
4586
4587 #ifdef CONFIG_BT_FEATURE_DEBUG
4588 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4589                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4590 {
4591         struct mgmt_rp_set_exp_feature rp;
4592
4593         bool val, changed;
4594         int err;
4595
4596         /* Command requires to use the non-controller index */
4597         if (hdev)
4598                 return mgmt_cmd_status(sk, hdev->id,
4599                                        MGMT_OP_SET_EXP_FEATURE,
4600                                        MGMT_STATUS_INVALID_INDEX);
4601
4602         /* Parameters are limited to a single octet */
4603         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4604                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4605                                        MGMT_OP_SET_EXP_FEATURE,
4606                                        MGMT_STATUS_INVALID_PARAMS);
4607
4608         /* Only boolean on/off is supported */
4609         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4610                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4611                                        MGMT_OP_SET_EXP_FEATURE,
4612                                        MGMT_STATUS_INVALID_PARAMS);
4613
4614         val = !!cp->param[0];
4615         changed = val ? !bt_dbg_get() : bt_dbg_get();
4616         bt_dbg_set(val);
4617
4618         memcpy(rp.uuid, debug_uuid, 16);
4619         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4620
4621         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4622
4623         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4624                                 MGMT_OP_SET_EXP_FEATURE, 0,
4625                                 &rp, sizeof(rp));
4626
4627         if (changed)
4628                 exp_feature_changed(hdev, debug_uuid, val, sk);
4629
4630         return err;
4631 }
4632 #endif
4633
4634 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4635                               struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4636 {
4637         struct mgmt_rp_set_exp_feature rp;
4638         bool val, changed;
4639         int err;
4640
4641         /* Command requires to use the controller index */
4642         if (!hdev)
4643                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4644                                        MGMT_OP_SET_EXP_FEATURE,
4645                                        MGMT_STATUS_INVALID_INDEX);
4646
4647         /* Parameters are limited to a single octet */
4648         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4649                 return mgmt_cmd_status(sk, hdev->id,
4650                                        MGMT_OP_SET_EXP_FEATURE,
4651                                        MGMT_STATUS_INVALID_PARAMS);
4652
4653         /* Only boolean on/off is supported */
4654         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4655                 return mgmt_cmd_status(sk, hdev->id,
4656                                        MGMT_OP_SET_EXP_FEATURE,
4657                                        MGMT_STATUS_INVALID_PARAMS);
4658
4659         val = !!cp->param[0];
4660
4661         if (val) {
4662                 changed = !hci_dev_test_and_set_flag(hdev,
4663                                                      HCI_MESH_EXPERIMENTAL);
4664         } else {
4665                 hci_dev_clear_flag(hdev, HCI_MESH);
4666                 changed = hci_dev_test_and_clear_flag(hdev,
4667                                                       HCI_MESH_EXPERIMENTAL);
4668         }
4669
4670         memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4671         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4672
4673         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4674
4675         err = mgmt_cmd_complete(sk, hdev->id,
4676                                 MGMT_OP_SET_EXP_FEATURE, 0,
4677                                 &rp, sizeof(rp));
4678
4679         if (changed)
4680                 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4681
4682         return err;
4683 }
4684
4685 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4686                                    struct mgmt_cp_set_exp_feature *cp,
4687                                    u16 data_len)
4688 {
4689         struct mgmt_rp_set_exp_feature rp;
4690         bool val, changed;
4691         int err;
4692         u32 flags;
4693
4694         /* Command requires to use the controller index */
4695         if (!hdev)
4696                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4697                                        MGMT_OP_SET_EXP_FEATURE,
4698                                        MGMT_STATUS_INVALID_INDEX);
4699
4700         /* Changes can only be made when controller is powered down */
4701         if (hdev_is_powered(hdev))
4702                 return mgmt_cmd_status(sk, hdev->id,
4703                                        MGMT_OP_SET_EXP_FEATURE,
4704                                        MGMT_STATUS_REJECTED);
4705
4706         /* Parameters are limited to a single octet */
4707         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4708                 return mgmt_cmd_status(sk, hdev->id,
4709                                        MGMT_OP_SET_EXP_FEATURE,
4710                                        MGMT_STATUS_INVALID_PARAMS);
4711
4712         /* Only boolean on/off is supported */
4713         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4714                 return mgmt_cmd_status(sk, hdev->id,
4715                                        MGMT_OP_SET_EXP_FEATURE,
4716                                        MGMT_STATUS_INVALID_PARAMS);
4717
4718         val = !!cp->param[0];
4719
4720         if (val) {
4721                 changed = !hci_dev_test_and_set_flag(hdev,
4722                                                      HCI_ENABLE_LL_PRIVACY);
4723                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4724
4725                 /* Enable LL privacy + supported settings changed */
4726                 flags = BIT(0) | BIT(1);
4727         } else {
4728                 changed = hci_dev_test_and_clear_flag(hdev,
4729                                                       HCI_ENABLE_LL_PRIVACY);
4730
4731                 /* Disable LL privacy + supported settings changed */
4732                 flags = BIT(1);
4733         }
4734
4735         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4736         rp.flags = cpu_to_le32(flags);
4737
4738         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4739
4740         err = mgmt_cmd_complete(sk, hdev->id,
4741                                 MGMT_OP_SET_EXP_FEATURE, 0,
4742                                 &rp, sizeof(rp));
4743
4744         if (changed)
4745                 exp_ll_privacy_feature_changed(val, hdev, sk);
4746
4747         return err;
4748 }
4749
4750 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4751                                    struct mgmt_cp_set_exp_feature *cp,
4752                                    u16 data_len)
4753 {
4754         struct mgmt_rp_set_exp_feature rp;
4755         bool val, changed;
4756         int err;
4757
4758         /* Command requires to use a valid controller index */
4759         if (!hdev)
4760                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4761                                        MGMT_OP_SET_EXP_FEATURE,
4762                                        MGMT_STATUS_INVALID_INDEX);
4763
4764         /* Parameters are limited to a single octet */
4765         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4766                 return mgmt_cmd_status(sk, hdev->id,
4767                                        MGMT_OP_SET_EXP_FEATURE,
4768                                        MGMT_STATUS_INVALID_PARAMS);
4769
4770         /* Only boolean on/off is supported */
4771         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4772                 return mgmt_cmd_status(sk, hdev->id,
4773                                        MGMT_OP_SET_EXP_FEATURE,
4774                                        MGMT_STATUS_INVALID_PARAMS);
4775
4776         hci_req_sync_lock(hdev);
4777
4778         val = !!cp->param[0];
4779         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4780
4781         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4782                 err = mgmt_cmd_status(sk, hdev->id,
4783                                       MGMT_OP_SET_EXP_FEATURE,
4784                                       MGMT_STATUS_NOT_SUPPORTED);
4785                 goto unlock_quality_report;
4786         }
4787
4788         if (changed) {
4789                 if (hdev->set_quality_report)
4790                         err = hdev->set_quality_report(hdev, val);
4791                 else
4792                         err = aosp_set_quality_report(hdev, val);
4793
4794                 if (err) {
4795                         err = mgmt_cmd_status(sk, hdev->id,
4796                                               MGMT_OP_SET_EXP_FEATURE,
4797                                               MGMT_STATUS_FAILED);
4798                         goto unlock_quality_report;
4799                 }
4800
4801                 if (val)
4802                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4803                 else
4804                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4805         }
4806
4807         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4808
4809         memcpy(rp.uuid, quality_report_uuid, 16);
4810         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4811         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4812
4813         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4814                                 &rp, sizeof(rp));
4815
4816         if (changed)
4817                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4818
4819 unlock_quality_report:
4820         hci_req_sync_unlock(hdev);
4821         return err;
4822 }
4823
4824 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4825                                   struct mgmt_cp_set_exp_feature *cp,
4826                                   u16 data_len)
4827 {
4828         bool val, changed;
4829         int err;
4830         struct mgmt_rp_set_exp_feature rp;
4831
4832         /* Command requires to use a valid controller index */
4833         if (!hdev)
4834                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4835                                        MGMT_OP_SET_EXP_FEATURE,
4836                                        MGMT_STATUS_INVALID_INDEX);
4837
4838         /* Parameters are limited to a single octet */
4839         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4840                 return mgmt_cmd_status(sk, hdev->id,
4841                                        MGMT_OP_SET_EXP_FEATURE,
4842                                        MGMT_STATUS_INVALID_PARAMS);
4843
4844         /* Only boolean on/off is supported */
4845         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4846                 return mgmt_cmd_status(sk, hdev->id,
4847                                        MGMT_OP_SET_EXP_FEATURE,
4848                                        MGMT_STATUS_INVALID_PARAMS);
4849
4850         val = !!cp->param[0];
4851         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4852
4853         if (!hdev->get_data_path_id) {
4854                 return mgmt_cmd_status(sk, hdev->id,
4855                                        MGMT_OP_SET_EXP_FEATURE,
4856                                        MGMT_STATUS_NOT_SUPPORTED);
4857         }
4858
4859         if (changed) {
4860                 if (val)
4861                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4862                 else
4863                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4864         }
4865
4866         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4867                     val, changed);
4868
4869         memcpy(rp.uuid, offload_codecs_uuid, 16);
4870         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4871         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4872         err = mgmt_cmd_complete(sk, hdev->id,
4873                                 MGMT_OP_SET_EXP_FEATURE, 0,
4874                                 &rp, sizeof(rp));
4875
4876         if (changed)
4877                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4878
4879         return err;
4880 }
4881
4882 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4883                                           struct mgmt_cp_set_exp_feature *cp,
4884                                           u16 data_len)
4885 {
4886         bool val, changed;
4887         int err;
4888         struct mgmt_rp_set_exp_feature rp;
4889
4890         /* Command requires to use a valid controller index */
4891         if (!hdev)
4892                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4893                                        MGMT_OP_SET_EXP_FEATURE,
4894                                        MGMT_STATUS_INVALID_INDEX);
4895
4896         /* Parameters are limited to a single octet */
4897         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4898                 return mgmt_cmd_status(sk, hdev->id,
4899                                        MGMT_OP_SET_EXP_FEATURE,
4900                                        MGMT_STATUS_INVALID_PARAMS);
4901
4902         /* Only boolean on/off is supported */
4903         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4904                 return mgmt_cmd_status(sk, hdev->id,
4905                                        MGMT_OP_SET_EXP_FEATURE,
4906                                        MGMT_STATUS_INVALID_PARAMS);
4907
4908         val = !!cp->param[0];
4909         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4910
4911         if (!hci_dev_le_state_simultaneous(hdev)) {
4912                 return mgmt_cmd_status(sk, hdev->id,
4913                                        MGMT_OP_SET_EXP_FEATURE,
4914                                        MGMT_STATUS_NOT_SUPPORTED);
4915         }
4916
4917         if (changed) {
4918                 if (val)
4919                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4920                 else
4921                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4922         }
4923
4924         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4925                     val, changed);
4926
4927         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4928         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4929         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4930         err = mgmt_cmd_complete(sk, hdev->id,
4931                                 MGMT_OP_SET_EXP_FEATURE, 0,
4932                                 &rp, sizeof(rp));
4933
4934         if (changed)
4935                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4936
4937         return err;
4938 }
4939
4940 #ifdef CONFIG_BT_LE
4941 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4942                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4943 {
4944         struct mgmt_rp_set_exp_feature rp;
4945         bool val, changed = false;
4946         int err;
4947
4948         /* Command requires to use the non-controller index */
4949         if (hdev)
4950                 return mgmt_cmd_status(sk, hdev->id,
4951                                        MGMT_OP_SET_EXP_FEATURE,
4952                                        MGMT_STATUS_INVALID_INDEX);
4953
4954         /* Parameters are limited to a single octet */
4955         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4956                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4957                                        MGMT_OP_SET_EXP_FEATURE,
4958                                        MGMT_STATUS_INVALID_PARAMS);
4959
4960         /* Only boolean on/off is supported */
4961         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4962                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4963                                        MGMT_OP_SET_EXP_FEATURE,
4964                                        MGMT_STATUS_INVALID_PARAMS);
4965
4966         val = cp->param[0] ? true : false;
4967         if (val)
4968                 err = iso_init();
4969         else
4970                 err = iso_exit();
4971
4972         if (!err)
4973                 changed = true;
4974
4975         memcpy(rp.uuid, iso_socket_uuid, 16);
4976         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4977
4978         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4979
4980         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4981                                 MGMT_OP_SET_EXP_FEATURE, 0,
4982                                 &rp, sizeof(rp));
4983
4984         if (changed)
4985                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4986
4987         return err;
4988 }
4989 #endif
4990
4991 static const struct mgmt_exp_feature {
4992         const u8 *uuid;
4993         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4994                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4995 } exp_features[] = {
4996         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4997 #ifdef CONFIG_BT_FEATURE_DEBUG
4998         EXP_FEAT(debug_uuid, set_debug_func),
4999 #endif
5000         EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
5001         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
5002         EXP_FEAT(quality_report_uuid, set_quality_report_func),
5003         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
5004         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
5005 #ifdef CONFIG_BT_LE
5006         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
5007 #endif
5008
5009         /* end with a null feature */
5010         EXP_FEAT(NULL, NULL)
5011 };
5012
5013 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5014                            void *data, u16 data_len)
5015 {
5016         struct mgmt_cp_set_exp_feature *cp = data;
5017         size_t i = 0;
5018
5019         bt_dev_dbg(hdev, "sock %p", sk);
5020
5021         for (i = 0; exp_features[i].uuid; i++) {
5022                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5023                         return exp_features[i].set_func(sk, hdev, cp, data_len);
5024         }
5025
5026         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5027                                MGMT_OP_SET_EXP_FEATURE,
5028                                MGMT_STATUS_NOT_SUPPORTED);
5029 }
5030
5031 static u32 get_params_flags(struct hci_dev *hdev,
5032                             struct hci_conn_params *params)
5033 {
5034         u32 flags = hdev->conn_flags;
5035
5036         /* Devices using RPAs can only be programmed in the acceptlist if
5037          * LL Privacy has been enable otherwise they cannot mark
5038          * HCI_CONN_FLAG_REMOTE_WAKEUP.
5039          */
5040         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
5041             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
5042                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
5043
5044         return flags;
5045 }
5046
5047 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5048                             u16 data_len)
5049 {
5050         struct mgmt_cp_get_device_flags *cp = data;
5051         struct mgmt_rp_get_device_flags rp;
5052         struct bdaddr_list_with_flags *br_params;
5053         struct hci_conn_params *params;
5054         u32 supported_flags;
5055         u32 current_flags = 0;
5056         u8 status = MGMT_STATUS_INVALID_PARAMS;
5057
5058         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5059                    &cp->addr.bdaddr, cp->addr.type);
5060
5061         hci_dev_lock(hdev);
5062
5063         supported_flags = hdev->conn_flags;
5064
5065         memset(&rp, 0, sizeof(rp));
5066
5067         if (cp->addr.type == BDADDR_BREDR) {
5068                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5069                                                               &cp->addr.bdaddr,
5070                                                               cp->addr.type);
5071                 if (!br_params)
5072                         goto done;
5073
5074                 current_flags = br_params->flags;
5075         } else {
5076                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5077                                                 le_addr_type(cp->addr.type));
5078                 if (!params)
5079                         goto done;
5080
5081                 supported_flags = get_params_flags(hdev, params);
5082                 current_flags = params->flags;
5083         }
5084
5085         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5086         rp.addr.type = cp->addr.type;
5087         rp.supported_flags = cpu_to_le32(supported_flags);
5088         rp.current_flags = cpu_to_le32(current_flags);
5089
5090         status = MGMT_STATUS_SUCCESS;
5091
5092 done:
5093         hci_dev_unlock(hdev);
5094
5095         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5096                                 &rp, sizeof(rp));
5097 }
5098
5099 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5100                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5101                                  u32 supported_flags, u32 current_flags)
5102 {
5103         struct mgmt_ev_device_flags_changed ev;
5104
5105         bacpy(&ev.addr.bdaddr, bdaddr);
5106         ev.addr.type = bdaddr_type;
5107         ev.supported_flags = cpu_to_le32(supported_flags);
5108         ev.current_flags = cpu_to_le32(current_flags);
5109
5110         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5111 }
5112
5113 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5114                             u16 len)
5115 {
5116         struct mgmt_cp_set_device_flags *cp = data;
5117         struct bdaddr_list_with_flags *br_params;
5118         struct hci_conn_params *params;
5119         u8 status = MGMT_STATUS_INVALID_PARAMS;
5120         u32 supported_flags;
5121         u32 current_flags = __le32_to_cpu(cp->current_flags);
5122
5123         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5124                    &cp->addr.bdaddr, cp->addr.type, current_flags);
5125
5126         // We should take hci_dev_lock() early, I think.. conn_flags can change
5127         supported_flags = hdev->conn_flags;
5128
5129         if ((supported_flags | current_flags) != supported_flags) {
5130                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5131                             current_flags, supported_flags);
5132                 goto done;
5133         }
5134
5135         hci_dev_lock(hdev);
5136
5137         if (cp->addr.type == BDADDR_BREDR) {
5138                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5139                                                               &cp->addr.bdaddr,
5140                                                               cp->addr.type);
5141
5142                 if (br_params) {
5143                         br_params->flags = current_flags;
5144                         status = MGMT_STATUS_SUCCESS;
5145                 } else {
5146                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5147                                     &cp->addr.bdaddr, cp->addr.type);
5148                 }
5149
5150                 goto unlock;
5151         }
5152
5153         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5154                                         le_addr_type(cp->addr.type));
5155         if (!params) {
5156                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5157                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5158                 goto unlock;
5159         }
5160
5161         supported_flags = get_params_flags(hdev, params);
5162
5163         if ((supported_flags | current_flags) != supported_flags) {
5164                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5165                             current_flags, supported_flags);
5166                 goto unlock;
5167         }
5168
5169         WRITE_ONCE(params->flags, current_flags);
5170         status = MGMT_STATUS_SUCCESS;
5171
5172         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5173          * has been set.
5174          */
5175         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5176                 hci_update_passive_scan(hdev);
5177
5178 unlock:
5179         hci_dev_unlock(hdev);
5180
5181 done:
5182         if (status == MGMT_STATUS_SUCCESS)
5183                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5184                                      supported_flags, current_flags);
5185
5186         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5187                                  &cp->addr, sizeof(cp->addr));
5188 }
5189
5190 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5191                                    u16 handle)
5192 {
5193         struct mgmt_ev_adv_monitor_added ev;
5194
5195         ev.monitor_handle = cpu_to_le16(handle);
5196
5197         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5198 }
5199
5200 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
5201 {
5202         struct mgmt_ev_adv_monitor_removed ev;
5203         struct mgmt_pending_cmd *cmd;
5204         struct sock *sk_skip = NULL;
5205         struct mgmt_cp_remove_adv_monitor *cp;
5206
5207         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5208         if (cmd) {
5209                 cp = cmd->param;
5210
5211                 if (cp->monitor_handle)
5212                         sk_skip = cmd->sk;
5213         }
5214
5215         ev.monitor_handle = cpu_to_le16(handle);
5216
5217         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
5218 }
5219
5220 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5221                                  void *data, u16 len)
5222 {
5223         struct adv_monitor *monitor = NULL;
5224         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5225         int handle, err;
5226         size_t rp_size = 0;
5227         __u32 supported = 0;
5228         __u32 enabled = 0;
5229         __u16 num_handles = 0;
5230         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5231
5232         BT_DBG("request for %s", hdev->name);
5233
5234         hci_dev_lock(hdev);
5235
5236         if (msft_monitor_supported(hdev))
5237                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5238
5239         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5240                 handles[num_handles++] = monitor->handle;
5241
5242         hci_dev_unlock(hdev);
5243
5244         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5245         rp = kmalloc(rp_size, GFP_KERNEL);
5246         if (!rp)
5247                 return -ENOMEM;
5248
5249         /* All supported features are currently enabled */
5250         enabled = supported;
5251
5252         rp->supported_features = cpu_to_le32(supported);
5253         rp->enabled_features = cpu_to_le32(enabled);
5254         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5255         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5256         rp->num_handles = cpu_to_le16(num_handles);
5257         if (num_handles)
5258                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5259
5260         err = mgmt_cmd_complete(sk, hdev->id,
5261                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5262                                 MGMT_STATUS_SUCCESS, rp, rp_size);
5263
5264         kfree(rp);
5265
5266         return err;
5267 }
5268
5269 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5270                                                    void *data, int status)
5271 {
5272         struct mgmt_rp_add_adv_patterns_monitor rp;
5273         struct mgmt_pending_cmd *cmd = data;
5274         struct adv_monitor *monitor = cmd->user_data;
5275
5276         hci_dev_lock(hdev);
5277
5278         rp.monitor_handle = cpu_to_le16(monitor->handle);
5279
5280         if (!status) {
5281                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5282                 hdev->adv_monitors_cnt++;
5283                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5284                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
5285                 hci_update_passive_scan(hdev);
5286         }
5287
5288         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5289                           mgmt_status(status), &rp, sizeof(rp));
5290         mgmt_pending_remove(cmd);
5291
5292         hci_dev_unlock(hdev);
5293         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5294                    rp.monitor_handle, status);
5295 }
5296
5297 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5298 {
5299         struct mgmt_pending_cmd *cmd = data;
5300         struct adv_monitor *monitor = cmd->user_data;
5301
5302         return hci_add_adv_monitor(hdev, monitor);
5303 }
5304
5305 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5306                                       struct adv_monitor *m, u8 status,
5307                                       void *data, u16 len, u16 op)
5308 {
5309         struct mgmt_pending_cmd *cmd;
5310         int err;
5311
5312         hci_dev_lock(hdev);
5313
5314         if (status)
5315                 goto unlock;
5316
5317         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5318             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5319             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5320             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5321                 status = MGMT_STATUS_BUSY;
5322                 goto unlock;
5323         }
5324
5325         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5326         if (!cmd) {
5327                 status = MGMT_STATUS_NO_RESOURCES;
5328                 goto unlock;
5329         }
5330
5331         cmd->user_data = m;
5332         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5333                                  mgmt_add_adv_patterns_monitor_complete);
5334         if (err) {
5335                 if (err == -ENOMEM)
5336                         status = MGMT_STATUS_NO_RESOURCES;
5337                 else
5338                         status = MGMT_STATUS_FAILED;
5339
5340                 goto unlock;
5341         }
5342
5343         hci_dev_unlock(hdev);
5344
5345         return 0;
5346
5347 unlock:
5348         hci_free_adv_monitor(hdev, m);
5349         hci_dev_unlock(hdev);
5350         return mgmt_cmd_status(sk, hdev->id, op, status);
5351 }
5352
5353 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5354                                    struct mgmt_adv_rssi_thresholds *rssi)
5355 {
5356         if (rssi) {
5357                 m->rssi.low_threshold = rssi->low_threshold;
5358                 m->rssi.low_threshold_timeout =
5359                     __le16_to_cpu(rssi->low_threshold_timeout);
5360                 m->rssi.high_threshold = rssi->high_threshold;
5361                 m->rssi.high_threshold_timeout =
5362                     __le16_to_cpu(rssi->high_threshold_timeout);
5363                 m->rssi.sampling_period = rssi->sampling_period;
5364         } else {
5365                 /* Default values. These numbers are the least constricting
5366                  * parameters for MSFT API to work, so it behaves as if there
5367                  * are no rssi parameter to consider. May need to be changed
5368                  * if other API are to be supported.
5369                  */
5370                 m->rssi.low_threshold = -127;
5371                 m->rssi.low_threshold_timeout = 60;
5372                 m->rssi.high_threshold = -127;
5373                 m->rssi.high_threshold_timeout = 0;
5374                 m->rssi.sampling_period = 0;
5375         }
5376 }
5377
5378 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5379                                     struct mgmt_adv_pattern *patterns)
5380 {
5381         u8 offset = 0, length = 0;
5382         struct adv_pattern *p = NULL;
5383         int i;
5384
5385         for (i = 0; i < pattern_count; i++) {
5386                 offset = patterns[i].offset;
5387                 length = patterns[i].length;
5388                 if (offset >= HCI_MAX_EXT_AD_LENGTH ||
5389                     length > HCI_MAX_EXT_AD_LENGTH ||
5390                     (offset + length) > HCI_MAX_EXT_AD_LENGTH)
5391                         return MGMT_STATUS_INVALID_PARAMS;
5392
5393                 p = kmalloc(sizeof(*p), GFP_KERNEL);
5394                 if (!p)
5395                         return MGMT_STATUS_NO_RESOURCES;
5396
5397                 p->ad_type = patterns[i].ad_type;
5398                 p->offset = patterns[i].offset;
5399                 p->length = patterns[i].length;
5400                 memcpy(p->value, patterns[i].value, p->length);
5401
5402                 INIT_LIST_HEAD(&p->list);
5403                 list_add(&p->list, &m->patterns);
5404         }
5405
5406         return MGMT_STATUS_SUCCESS;
5407 }
5408
5409 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5410                                     void *data, u16 len)
5411 {
5412         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5413         struct adv_monitor *m = NULL;
5414         u8 status = MGMT_STATUS_SUCCESS;
5415         size_t expected_size = sizeof(*cp);
5416
5417         BT_DBG("request for %s", hdev->name);
5418
5419         if (len <= sizeof(*cp)) {
5420                 status = MGMT_STATUS_INVALID_PARAMS;
5421                 goto done;
5422         }
5423
5424         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5425         if (len != expected_size) {
5426                 status = MGMT_STATUS_INVALID_PARAMS;
5427                 goto done;
5428         }
5429
5430         m = kzalloc(sizeof(*m), GFP_KERNEL);
5431         if (!m) {
5432                 status = MGMT_STATUS_NO_RESOURCES;
5433                 goto done;
5434         }
5435
5436         INIT_LIST_HEAD(&m->patterns);
5437
5438         parse_adv_monitor_rssi(m, NULL);
5439         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5440
5441 done:
5442         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5443                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5444 }
5445
5446 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5447                                          void *data, u16 len)
5448 {
5449         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5450         struct adv_monitor *m = NULL;
5451         u8 status = MGMT_STATUS_SUCCESS;
5452         size_t expected_size = sizeof(*cp);
5453
5454         BT_DBG("request for %s", hdev->name);
5455
5456         if (len <= sizeof(*cp)) {
5457                 status = MGMT_STATUS_INVALID_PARAMS;
5458                 goto done;
5459         }
5460
5461         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5462         if (len != expected_size) {
5463                 status = MGMT_STATUS_INVALID_PARAMS;
5464                 goto done;
5465         }
5466
5467         m = kzalloc(sizeof(*m), GFP_KERNEL);
5468         if (!m) {
5469                 status = MGMT_STATUS_NO_RESOURCES;
5470                 goto done;
5471         }
5472
5473         INIT_LIST_HEAD(&m->patterns);
5474
5475         parse_adv_monitor_rssi(m, &cp->rssi);
5476         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5477
5478 done:
5479         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5480                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5481 }
5482
5483 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5484                                              void *data, int status)
5485 {
5486         struct mgmt_rp_remove_adv_monitor rp;
5487         struct mgmt_pending_cmd *cmd = data;
5488         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5489
5490         hci_dev_lock(hdev);
5491
5492         rp.monitor_handle = cp->monitor_handle;
5493
5494         if (!status)
5495                 hci_update_passive_scan(hdev);
5496
5497         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5498                           mgmt_status(status), &rp, sizeof(rp));
5499         mgmt_pending_remove(cmd);
5500
5501         hci_dev_unlock(hdev);
5502         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5503                    rp.monitor_handle, status);
5504 }
5505
5506 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5507 {
5508         struct mgmt_pending_cmd *cmd = data;
5509         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5510         u16 handle = __le16_to_cpu(cp->monitor_handle);
5511
5512         if (!handle)
5513                 return hci_remove_all_adv_monitor(hdev);
5514
5515         return hci_remove_single_adv_monitor(hdev, handle);
5516 }
5517
5518 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5519                               void *data, u16 len)
5520 {
5521         struct mgmt_pending_cmd *cmd;
5522         int err, status;
5523
5524         hci_dev_lock(hdev);
5525
5526         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5527             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5528             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5529             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5530                 status = MGMT_STATUS_BUSY;
5531                 goto unlock;
5532         }
5533
5534         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5535         if (!cmd) {
5536                 status = MGMT_STATUS_NO_RESOURCES;
5537                 goto unlock;
5538         }
5539
5540         err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
5541                                  mgmt_remove_adv_monitor_complete);
5542
5543         if (err) {
5544                 mgmt_pending_remove(cmd);
5545
5546                 if (err == -ENOMEM)
5547                         status = MGMT_STATUS_NO_RESOURCES;
5548                 else
5549                         status = MGMT_STATUS_FAILED;
5550
5551                 goto unlock;
5552         }
5553
5554         hci_dev_unlock(hdev);
5555
5556         return 0;
5557
5558 unlock:
5559         hci_dev_unlock(hdev);
5560         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5561                                status);
5562 }
5563
5564 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5565 {
5566         struct mgmt_rp_read_local_oob_data mgmt_rp;
5567         size_t rp_size = sizeof(mgmt_rp);
5568         struct mgmt_pending_cmd *cmd = data;
5569         struct sk_buff *skb = cmd->skb;
5570         u8 status = mgmt_status(err);
5571
5572         if (!status) {
5573                 if (!skb)
5574                         status = MGMT_STATUS_FAILED;
5575                 else if (IS_ERR(skb))
5576                         status = mgmt_status(PTR_ERR(skb));
5577                 else
5578                         status = mgmt_status(skb->data[0]);
5579         }
5580
5581         bt_dev_dbg(hdev, "status %d", status);
5582
5583         if (status) {
5584                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5585                 goto remove;
5586         }
5587
5588         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5589
5590         if (!bredr_sc_enabled(hdev)) {
5591                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5592
5593                 if (skb->len < sizeof(*rp)) {
5594                         mgmt_cmd_status(cmd->sk, hdev->id,
5595                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5596                                         MGMT_STATUS_FAILED);
5597                         goto remove;
5598                 }
5599
5600                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5601                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5602
5603                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5604         } else {
5605                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5606
5607                 if (skb->len < sizeof(*rp)) {
5608                         mgmt_cmd_status(cmd->sk, hdev->id,
5609                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5610                                         MGMT_STATUS_FAILED);
5611                         goto remove;
5612                 }
5613
5614                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5615                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5616
5617                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5618                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5619         }
5620
5621         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5622                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5623
5624 remove:
5625         if (skb && !IS_ERR(skb))
5626                 kfree_skb(skb);
5627
5628         mgmt_pending_free(cmd);
5629 }
5630
5631 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5632 {
5633         struct mgmt_pending_cmd *cmd = data;
5634
5635         if (bredr_sc_enabled(hdev))
5636                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5637         else
5638                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5639
5640         if (IS_ERR(cmd->skb))
5641                 return PTR_ERR(cmd->skb);
5642         else
5643                 return 0;
5644 }
5645
5646 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5647                                void *data, u16 data_len)
5648 {
5649         struct mgmt_pending_cmd *cmd;
5650         int err;
5651
5652         bt_dev_dbg(hdev, "sock %p", sk);
5653
5654         hci_dev_lock(hdev);
5655
5656         if (!hdev_is_powered(hdev)) {
5657                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5658                                       MGMT_STATUS_NOT_POWERED);
5659                 goto unlock;
5660         }
5661
5662         if (!lmp_ssp_capable(hdev)) {
5663                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5664                                       MGMT_STATUS_NOT_SUPPORTED);
5665                 goto unlock;
5666         }
5667
5668         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5669         if (!cmd)
5670                 err = -ENOMEM;
5671         else
5672                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5673                                          read_local_oob_data_complete);
5674
5675         if (err < 0) {
5676                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5677                                       MGMT_STATUS_FAILED);
5678
5679                 if (cmd)
5680                         mgmt_pending_free(cmd);
5681         }
5682
5683 unlock:
5684         hci_dev_unlock(hdev);
5685         return err;
5686 }
5687
5688 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5689                                void *data, u16 len)
5690 {
5691         struct mgmt_addr_info *addr = data;
5692         int err;
5693
5694         bt_dev_dbg(hdev, "sock %p", sk);
5695
5696         if (!bdaddr_type_is_valid(addr->type))
5697                 return mgmt_cmd_complete(sk, hdev->id,
5698                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5699                                          MGMT_STATUS_INVALID_PARAMS,
5700                                          addr, sizeof(*addr));
5701
5702         hci_dev_lock(hdev);
5703
5704         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5705                 struct mgmt_cp_add_remote_oob_data *cp = data;
5706                 u8 status;
5707
5708                 if (cp->addr.type != BDADDR_BREDR) {
5709                         err = mgmt_cmd_complete(sk, hdev->id,
5710                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5711                                                 MGMT_STATUS_INVALID_PARAMS,
5712                                                 &cp->addr, sizeof(cp->addr));
5713                         goto unlock;
5714                 }
5715
5716                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5717                                               cp->addr.type, cp->hash,
5718                                               cp->rand, NULL, NULL);
5719                 if (err < 0)
5720                         status = MGMT_STATUS_FAILED;
5721                 else
5722                         status = MGMT_STATUS_SUCCESS;
5723
5724                 err = mgmt_cmd_complete(sk, hdev->id,
5725                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5726                                         &cp->addr, sizeof(cp->addr));
5727         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5728                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5729                 u8 *rand192, *hash192, *rand256, *hash256;
5730                 u8 status;
5731
5732                 if (bdaddr_type_is_le(cp->addr.type)) {
5733                         /* Enforce zero-valued 192-bit parameters as
5734                          * long as legacy SMP OOB isn't implemented.
5735                          */
5736                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5737                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5738                                 err = mgmt_cmd_complete(sk, hdev->id,
5739                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5740                                                         MGMT_STATUS_INVALID_PARAMS,
5741                                                         addr, sizeof(*addr));
5742                                 goto unlock;
5743                         }
5744
5745                         rand192 = NULL;
5746                         hash192 = NULL;
5747                 } else {
5748                         /* In case one of the P-192 values is set to zero,
5749                          * then just disable OOB data for P-192.
5750                          */
5751                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5752                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5753                                 rand192 = NULL;
5754                                 hash192 = NULL;
5755                         } else {
5756                                 rand192 = cp->rand192;
5757                                 hash192 = cp->hash192;
5758                         }
5759                 }
5760
5761                 /* In case one of the P-256 values is set to zero, then just
5762                  * disable OOB data for P-256.
5763                  */
5764                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5765                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5766                         rand256 = NULL;
5767                         hash256 = NULL;
5768                 } else {
5769                         rand256 = cp->rand256;
5770                         hash256 = cp->hash256;
5771                 }
5772
5773                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5774                                               cp->addr.type, hash192, rand192,
5775                                               hash256, rand256);
5776                 if (err < 0)
5777                         status = MGMT_STATUS_FAILED;
5778                 else
5779                         status = MGMT_STATUS_SUCCESS;
5780
5781                 err = mgmt_cmd_complete(sk, hdev->id,
5782                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5783                                         status, &cp->addr, sizeof(cp->addr));
5784         } else {
5785                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5786                            len);
5787                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5788                                       MGMT_STATUS_INVALID_PARAMS);
5789         }
5790
5791 unlock:
5792         hci_dev_unlock(hdev);
5793         return err;
5794 }
5795
5796 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5797                                   void *data, u16 len)
5798 {
5799         struct mgmt_cp_remove_remote_oob_data *cp = data;
5800         u8 status;
5801         int err;
5802
5803         bt_dev_dbg(hdev, "sock %p", sk);
5804
5805         if (cp->addr.type != BDADDR_BREDR)
5806                 return mgmt_cmd_complete(sk, hdev->id,
5807                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5808                                          MGMT_STATUS_INVALID_PARAMS,
5809                                          &cp->addr, sizeof(cp->addr));
5810
5811         hci_dev_lock(hdev);
5812
5813         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5814                 hci_remote_oob_data_clear(hdev);
5815                 status = MGMT_STATUS_SUCCESS;
5816                 goto done;
5817         }
5818
5819         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5820         if (err < 0)
5821                 status = MGMT_STATUS_INVALID_PARAMS;
5822         else
5823                 status = MGMT_STATUS_SUCCESS;
5824
5825 done:
5826         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5827                                 status, &cp->addr, sizeof(cp->addr));
5828
5829         hci_dev_unlock(hdev);
5830         return err;
5831 }
5832
5833 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5834 {
5835         struct mgmt_pending_cmd *cmd;
5836
5837         bt_dev_dbg(hdev, "status %u", status);
5838
5839         hci_dev_lock(hdev);
5840
5841         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5842         if (!cmd)
5843                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5844
5845         if (!cmd)
5846                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5847
5848         if (cmd) {
5849                 cmd->cmd_complete(cmd, mgmt_status(status));
5850                 mgmt_pending_remove(cmd);
5851         }
5852
5853         hci_dev_unlock(hdev);
5854 }
5855
5856 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5857                                     uint8_t *mgmt_status)
5858 {
5859         switch (type) {
5860         case DISCOV_TYPE_LE:
5861                 *mgmt_status = mgmt_le_support(hdev);
5862                 if (*mgmt_status)
5863                         return false;
5864                 break;
5865         case DISCOV_TYPE_INTERLEAVED:
5866                 *mgmt_status = mgmt_le_support(hdev);
5867                 if (*mgmt_status)
5868                         return false;
5869                 fallthrough;
5870         case DISCOV_TYPE_BREDR:
5871                 *mgmt_status = mgmt_bredr_support(hdev);
5872                 if (*mgmt_status)
5873                         return false;
5874                 break;
5875         default:
5876                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5877                 return false;
5878         }
5879
5880         return true;
5881 }
5882
5883 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5884 {
5885         struct mgmt_pending_cmd *cmd = data;
5886
5887         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5888             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5889             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5890                 return;
5891
5892         bt_dev_dbg(hdev, "err %d", err);
5893
5894         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5895                           cmd->param, 1);
5896         mgmt_pending_remove(cmd);
5897
5898         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5899                                 DISCOVERY_FINDING);
5900 }
5901
5902 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5903 {
5904         return hci_start_discovery_sync(hdev);
5905 }
5906
5907 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5908                                     u16 op, void *data, u16 len)
5909 {
5910         struct mgmt_cp_start_discovery *cp = data;
5911         struct mgmt_pending_cmd *cmd;
5912         u8 status;
5913         int err;
5914
5915         bt_dev_dbg(hdev, "sock %p", sk);
5916
5917         hci_dev_lock(hdev);
5918
5919         if (!hdev_is_powered(hdev)) {
5920                 err = mgmt_cmd_complete(sk, hdev->id, op,
5921                                         MGMT_STATUS_NOT_POWERED,
5922                                         &cp->type, sizeof(cp->type));
5923                 goto failed;
5924         }
5925
5926         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5927             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5928                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5929                                         &cp->type, sizeof(cp->type));
5930                 goto failed;
5931         }
5932
5933         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5934                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5935                                         &cp->type, sizeof(cp->type));
5936                 goto failed;
5937         }
5938
5939         /* Can't start discovery when it is paused */
5940         if (hdev->discovery_paused) {
5941                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5942                                         &cp->type, sizeof(cp->type));
5943                 goto failed;
5944         }
5945
5946         /* Clear the discovery filter first to free any previously
5947          * allocated memory for the UUID list.
5948          */
5949         hci_discovery_filter_clear(hdev);
5950
5951         hdev->discovery.type = cp->type;
5952         hdev->discovery.report_invalid_rssi = false;
5953         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5954                 hdev->discovery.limited = true;
5955         else
5956                 hdev->discovery.limited = false;
5957
5958         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5959         if (!cmd) {
5960                 err = -ENOMEM;
5961                 goto failed;
5962         }
5963
5964         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5965                                  start_discovery_complete);
5966         if (err < 0) {
5967                 mgmt_pending_remove(cmd);
5968                 goto failed;
5969         }
5970
5971         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5972
5973 failed:
5974         hci_dev_unlock(hdev);
5975         return err;
5976 }
5977
5978 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5979                            void *data, u16 len)
5980 {
5981         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5982                                         data, len);
5983 }
5984
5985 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5986                                    void *data, u16 len)
5987 {
5988         return start_discovery_internal(sk, hdev,
5989                                         MGMT_OP_START_LIMITED_DISCOVERY,
5990                                         data, len);
5991 }
5992
5993 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5994                                    void *data, u16 len)
5995 {
5996         struct mgmt_cp_start_service_discovery *cp = data;
5997         struct mgmt_pending_cmd *cmd;
5998         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5999         u16 uuid_count, expected_len;
6000         u8 status;
6001         int err;
6002
6003         bt_dev_dbg(hdev, "sock %p", sk);
6004
6005         hci_dev_lock(hdev);
6006
6007         if (!hdev_is_powered(hdev)) {
6008                 err = mgmt_cmd_complete(sk, hdev->id,
6009                                         MGMT_OP_START_SERVICE_DISCOVERY,
6010                                         MGMT_STATUS_NOT_POWERED,
6011                                         &cp->type, sizeof(cp->type));
6012                 goto failed;
6013         }
6014
6015         if (hdev->discovery.state != DISCOVERY_STOPPED ||
6016             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6017                 err = mgmt_cmd_complete(sk, hdev->id,
6018                                         MGMT_OP_START_SERVICE_DISCOVERY,
6019                                         MGMT_STATUS_BUSY, &cp->type,
6020                                         sizeof(cp->type));
6021                 goto failed;
6022         }
6023
6024         if (hdev->discovery_paused) {
6025                 err = mgmt_cmd_complete(sk, hdev->id,
6026                                         MGMT_OP_START_SERVICE_DISCOVERY,
6027                                         MGMT_STATUS_BUSY, &cp->type,
6028                                         sizeof(cp->type));
6029                 goto failed;
6030         }
6031
6032         uuid_count = __le16_to_cpu(cp->uuid_count);
6033         if (uuid_count > max_uuid_count) {
6034                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6035                            uuid_count);
6036                 err = mgmt_cmd_complete(sk, hdev->id,
6037                                         MGMT_OP_START_SERVICE_DISCOVERY,
6038                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6039                                         sizeof(cp->type));
6040                 goto failed;
6041         }
6042
6043         expected_len = sizeof(*cp) + uuid_count * 16;
6044         if (expected_len != len) {
6045                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6046                            expected_len, len);
6047                 err = mgmt_cmd_complete(sk, hdev->id,
6048                                         MGMT_OP_START_SERVICE_DISCOVERY,
6049                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6050                                         sizeof(cp->type));
6051                 goto failed;
6052         }
6053
6054         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6055                 err = mgmt_cmd_complete(sk, hdev->id,
6056                                         MGMT_OP_START_SERVICE_DISCOVERY,
6057                                         status, &cp->type, sizeof(cp->type));
6058                 goto failed;
6059         }
6060
6061         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6062                                hdev, data, len);
6063         if (!cmd) {
6064                 err = -ENOMEM;
6065                 goto failed;
6066         }
6067
6068         /* Clear the discovery filter first to free any previously
6069          * allocated memory for the UUID list.
6070          */
6071         hci_discovery_filter_clear(hdev);
6072
6073         hdev->discovery.result_filtering = true;
6074         hdev->discovery.type = cp->type;
6075         hdev->discovery.rssi = cp->rssi;
6076         hdev->discovery.uuid_count = uuid_count;
6077
6078         if (uuid_count > 0) {
6079                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6080                                                 GFP_KERNEL);
6081                 if (!hdev->discovery.uuids) {
6082                         err = mgmt_cmd_complete(sk, hdev->id,
6083                                                 MGMT_OP_START_SERVICE_DISCOVERY,
6084                                                 MGMT_STATUS_FAILED,
6085                                                 &cp->type, sizeof(cp->type));
6086                         mgmt_pending_remove(cmd);
6087                         goto failed;
6088                 }
6089         }
6090
6091         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6092                                  start_discovery_complete);
6093         if (err < 0) {
6094                 mgmt_pending_remove(cmd);
6095                 goto failed;
6096         }
6097
6098         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6099
6100 failed:
6101         hci_dev_unlock(hdev);
6102         return err;
6103 }
6104
6105 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
6106 {
6107         struct mgmt_pending_cmd *cmd;
6108
6109         bt_dev_dbg(hdev, "status %u", status);
6110
6111         hci_dev_lock(hdev);
6112
6113         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6114         if (cmd) {
6115                 cmd->cmd_complete(cmd, mgmt_status(status));
6116                 mgmt_pending_remove(cmd);
6117         }
6118
6119         hci_dev_unlock(hdev);
6120 }
6121
6122 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6123 {
6124         struct mgmt_pending_cmd *cmd = data;
6125
6126         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6127                 return;
6128
6129         bt_dev_dbg(hdev, "err %d", err);
6130
6131         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6132                           cmd->param, 1);
6133         mgmt_pending_remove(cmd);
6134
6135         if (!err)
6136                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6137 }
6138
6139 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6140 {
6141         return hci_stop_discovery_sync(hdev);
6142 }
6143
6144 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6145                           u16 len)
6146 {
6147         struct mgmt_cp_stop_discovery *mgmt_cp = data;
6148         struct mgmt_pending_cmd *cmd;
6149         int err;
6150
6151         bt_dev_dbg(hdev, "sock %p", sk);
6152
6153         hci_dev_lock(hdev);
6154
6155         if (!hci_discovery_active(hdev)) {
6156                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6157                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6158                                         sizeof(mgmt_cp->type));
6159                 goto unlock;
6160         }
6161
6162         if (hdev->discovery.type != mgmt_cp->type) {
6163                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6164                                         MGMT_STATUS_INVALID_PARAMS,
6165                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6166                 goto unlock;
6167         }
6168
6169         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6170         if (!cmd) {
6171                 err = -ENOMEM;
6172                 goto unlock;
6173         }
6174
6175         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6176                                  stop_discovery_complete);
6177         if (err < 0) {
6178                 mgmt_pending_remove(cmd);
6179                 goto unlock;
6180         }
6181
6182         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6183
6184 unlock:
6185         hci_dev_unlock(hdev);
6186         return err;
6187 }
6188
6189 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6190                         u16 len)
6191 {
6192         struct mgmt_cp_confirm_name *cp = data;
6193         struct inquiry_entry *e;
6194         int err;
6195
6196         bt_dev_dbg(hdev, "sock %p", sk);
6197
6198         hci_dev_lock(hdev);
6199
6200         if (!hci_discovery_active(hdev)) {
6201                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6202                                         MGMT_STATUS_FAILED, &cp->addr,
6203                                         sizeof(cp->addr));
6204                 goto failed;
6205         }
6206
6207         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6208         if (!e) {
6209                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6210                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6211                                         sizeof(cp->addr));
6212                 goto failed;
6213         }
6214
6215         if (cp->name_known) {
6216                 e->name_state = NAME_KNOWN;
6217                 list_del(&e->list);
6218         } else {
6219                 e->name_state = NAME_NEEDED;
6220                 hci_inquiry_cache_update_resolve(hdev, e);
6221         }
6222
6223         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6224                                 &cp->addr, sizeof(cp->addr));
6225
6226 failed:
6227         hci_dev_unlock(hdev);
6228         return err;
6229 }
6230
6231 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6232                         u16 len)
6233 {
6234         struct mgmt_cp_block_device *cp = data;
6235         u8 status;
6236         int err;
6237
6238         bt_dev_dbg(hdev, "sock %p", sk);
6239
6240         if (!bdaddr_type_is_valid(cp->addr.type))
6241                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6242                                          MGMT_STATUS_INVALID_PARAMS,
6243                                          &cp->addr, sizeof(cp->addr));
6244
6245         hci_dev_lock(hdev);
6246
6247         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6248                                   cp->addr.type);
6249         if (err < 0) {
6250                 status = MGMT_STATUS_FAILED;
6251                 goto done;
6252         }
6253
6254         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6255                    sk);
6256         status = MGMT_STATUS_SUCCESS;
6257
6258 done:
6259         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6260                                 &cp->addr, sizeof(cp->addr));
6261
6262         hci_dev_unlock(hdev);
6263
6264         return err;
6265 }
6266
6267 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6268                           u16 len)
6269 {
6270         struct mgmt_cp_unblock_device *cp = data;
6271         u8 status;
6272         int err;
6273
6274         bt_dev_dbg(hdev, "sock %p", sk);
6275
6276         if (!bdaddr_type_is_valid(cp->addr.type))
6277                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6278                                          MGMT_STATUS_INVALID_PARAMS,
6279                                          &cp->addr, sizeof(cp->addr));
6280
6281         hci_dev_lock(hdev);
6282
6283         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6284                                   cp->addr.type);
6285         if (err < 0) {
6286                 status = MGMT_STATUS_INVALID_PARAMS;
6287                 goto done;
6288         }
6289
6290         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6291                    sk);
6292         status = MGMT_STATUS_SUCCESS;
6293
6294 done:
6295         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6296                                 &cp->addr, sizeof(cp->addr));
6297
6298         hci_dev_unlock(hdev);
6299
6300         return err;
6301 }
6302
6303 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6304 {
6305         return hci_update_eir_sync(hdev);
6306 }
6307
6308 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6309                          u16 len)
6310 {
6311         struct mgmt_cp_set_device_id *cp = data;
6312         int err;
6313         __u16 source;
6314
6315         bt_dev_dbg(hdev, "sock %p", sk);
6316
6317         source = __le16_to_cpu(cp->source);
6318
6319         if (source > 0x0002)
6320                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6321                                        MGMT_STATUS_INVALID_PARAMS);
6322
6323         hci_dev_lock(hdev);
6324
6325         hdev->devid_source = source;
6326         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6327         hdev->devid_product = __le16_to_cpu(cp->product);
6328         hdev->devid_version = __le16_to_cpu(cp->version);
6329
6330         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6331                                 NULL, 0);
6332
6333         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6334
6335         hci_dev_unlock(hdev);
6336
6337         return err;
6338 }
6339
6340 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6341 {
6342         if (err)
6343                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6344         else
6345                 bt_dev_dbg(hdev, "status %d", err);
6346 }
6347
6348 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6349 {
6350         struct cmd_lookup match = { NULL, hdev };
6351         u8 instance;
6352         struct adv_info *adv_instance;
6353         u8 status = mgmt_status(err);
6354
6355         if (status) {
6356                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
6357                                      cmd_status_rsp, &status);
6358                 return;
6359         }
6360
6361         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6362                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6363         else
6364                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6365
6366         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6367                              &match);
6368
6369         new_settings(hdev, match.sk);
6370
6371         if (match.sk)
6372                 sock_put(match.sk);
6373
6374         /* If "Set Advertising" was just disabled and instance advertising was
6375          * set up earlier, then re-enable multi-instance advertising.
6376          */
6377         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6378             list_empty(&hdev->adv_instances))
6379                 return;
6380
6381         instance = hdev->cur_adv_instance;
6382         if (!instance) {
6383                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6384                                                         struct adv_info, list);
6385                 if (!adv_instance)
6386                         return;
6387
6388                 instance = adv_instance->instance;
6389         }
6390
6391         err = hci_schedule_adv_instance_sync(hdev, instance, true);
6392
6393         enable_advertising_instance(hdev, err);
6394 }
6395
6396 static int set_adv_sync(struct hci_dev *hdev, void *data)
6397 {
6398         struct mgmt_pending_cmd *cmd = data;
6399         struct mgmt_mode *cp = cmd->param;
6400         u8 val = !!cp->val;
6401
6402         if (cp->val == 0x02)
6403                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6404         else
6405                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6406
6407         cancel_adv_timeout(hdev);
6408
6409         if (val) {
6410                 /* Switch to instance "0" for the Set Advertising setting.
6411                  * We cannot use update_[adv|scan_rsp]_data() here as the
6412                  * HCI_ADVERTISING flag is not yet set.
6413                  */
6414                 hdev->cur_adv_instance = 0x00;
6415
6416                 if (ext_adv_capable(hdev)) {
6417                         hci_start_ext_adv_sync(hdev, 0x00);
6418                 } else {
6419                         hci_update_adv_data_sync(hdev, 0x00);
6420                         hci_update_scan_rsp_data_sync(hdev, 0x00);
6421                         hci_enable_advertising_sync(hdev);
6422                 }
6423         } else {
6424                 hci_disable_advertising_sync(hdev);
6425         }
6426
6427         return 0;
6428 }
6429
6430 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6431                            u16 len)
6432 {
6433         struct mgmt_mode *cp = data;
6434         struct mgmt_pending_cmd *cmd;
6435         u8 val, status;
6436         int err;
6437
6438         bt_dev_dbg(hdev, "sock %p", sk);
6439
6440         status = mgmt_le_support(hdev);
6441         if (status)
6442                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6443                                        status);
6444
6445         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6446                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6447                                        MGMT_STATUS_INVALID_PARAMS);
6448
6449         if (hdev->advertising_paused)
6450                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6451                                        MGMT_STATUS_BUSY);
6452
6453         hci_dev_lock(hdev);
6454
6455         val = !!cp->val;
6456
6457         /* The following conditions are ones which mean that we should
6458          * not do any HCI communication but directly send a mgmt
6459          * response to user space (after toggling the flag if
6460          * necessary).
6461          */
6462         if (!hdev_is_powered(hdev) ||
6463             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6464              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6465             hci_dev_test_flag(hdev, HCI_MESH) ||
6466             hci_conn_num(hdev, LE_LINK) > 0 ||
6467             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6468              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6469                 bool changed;
6470
6471                 if (cp->val) {
6472                         hdev->cur_adv_instance = 0x00;
6473                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6474                         if (cp->val == 0x02)
6475                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6476                         else
6477                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6478                 } else {
6479                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6480                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6481                 }
6482
6483                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6484                 if (err < 0)
6485                         goto unlock;
6486
6487                 if (changed)
6488                         err = new_settings(hdev, sk);
6489
6490                 goto unlock;
6491         }
6492
6493         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6494             pending_find(MGMT_OP_SET_LE, hdev)) {
6495                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6496                                       MGMT_STATUS_BUSY);
6497                 goto unlock;
6498         }
6499
6500         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6501         if (!cmd)
6502                 err = -ENOMEM;
6503         else
6504                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6505                                          set_advertising_complete);
6506
6507         if (err < 0 && cmd)
6508                 mgmt_pending_remove(cmd);
6509
6510 unlock:
6511         hci_dev_unlock(hdev);
6512         return err;
6513 }
6514
6515 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6516                               void *data, u16 len)
6517 {
6518         struct mgmt_cp_set_static_address *cp = data;
6519         int err;
6520
6521         bt_dev_dbg(hdev, "sock %p", sk);
6522
6523         if (!lmp_le_capable(hdev))
6524                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6525                                        MGMT_STATUS_NOT_SUPPORTED);
6526
6527         if (hdev_is_powered(hdev))
6528                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6529                                        MGMT_STATUS_REJECTED);
6530
6531         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6532                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6533                         return mgmt_cmd_status(sk, hdev->id,
6534                                                MGMT_OP_SET_STATIC_ADDRESS,
6535                                                MGMT_STATUS_INVALID_PARAMS);
6536
6537                 /* Two most significant bits shall be set */
6538                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6539                         return mgmt_cmd_status(sk, hdev->id,
6540                                                MGMT_OP_SET_STATIC_ADDRESS,
6541                                                MGMT_STATUS_INVALID_PARAMS);
6542         }
6543
6544         hci_dev_lock(hdev);
6545
6546         bacpy(&hdev->static_addr, &cp->bdaddr);
6547
6548         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6549         if (err < 0)
6550                 goto unlock;
6551
6552         err = new_settings(hdev, sk);
6553
6554 unlock:
6555         hci_dev_unlock(hdev);
6556         return err;
6557 }
6558
6559 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6560                            void *data, u16 len)
6561 {
6562         struct mgmt_cp_set_scan_params *cp = data;
6563         __u16 interval, window;
6564         int err;
6565
6566         bt_dev_dbg(hdev, "sock %p", sk);
6567
6568         if (!lmp_le_capable(hdev))
6569                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6570                                        MGMT_STATUS_NOT_SUPPORTED);
6571
6572         interval = __le16_to_cpu(cp->interval);
6573
6574         if (interval < 0x0004 || interval > 0x4000)
6575                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6576                                        MGMT_STATUS_INVALID_PARAMS);
6577
6578         window = __le16_to_cpu(cp->window);
6579
6580         if (window < 0x0004 || window > 0x4000)
6581                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6582                                        MGMT_STATUS_INVALID_PARAMS);
6583
6584         if (window > interval)
6585                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6586                                        MGMT_STATUS_INVALID_PARAMS);
6587
6588         hci_dev_lock(hdev);
6589
6590         hdev->le_scan_interval = interval;
6591         hdev->le_scan_window = window;
6592
6593         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6594                                 NULL, 0);
6595
6596         /* If background scan is running, restart it so new parameters are
6597          * loaded.
6598          */
6599         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6600             hdev->discovery.state == DISCOVERY_STOPPED)
6601                 hci_update_passive_scan(hdev);
6602
6603         hci_dev_unlock(hdev);
6604
6605         return err;
6606 }
6607
6608 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6609 {
6610         struct mgmt_pending_cmd *cmd = data;
6611
6612         bt_dev_dbg(hdev, "err %d", err);
6613
6614         if (err) {
6615                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6616                                 mgmt_status(err));
6617         } else {
6618                 struct mgmt_mode *cp = cmd->param;
6619
6620                 if (cp->val)
6621                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6622                 else
6623                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6624
6625                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6626                 new_settings(hdev, cmd->sk);
6627         }
6628
6629         mgmt_pending_free(cmd);
6630 }
6631
6632 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6633 {
6634         struct mgmt_pending_cmd *cmd = data;
6635         struct mgmt_mode *cp = cmd->param;
6636
6637         return hci_write_fast_connectable_sync(hdev, cp->val);
6638 }
6639
6640 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6641                                 void *data, u16 len)
6642 {
6643         struct mgmt_mode *cp = data;
6644         struct mgmt_pending_cmd *cmd;
6645         int err;
6646
6647         bt_dev_dbg(hdev, "sock %p", sk);
6648
6649         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6650             hdev->hci_ver < BLUETOOTH_VER_1_2)
6651                 return mgmt_cmd_status(sk, hdev->id,
6652                                        MGMT_OP_SET_FAST_CONNECTABLE,
6653                                        MGMT_STATUS_NOT_SUPPORTED);
6654
6655         if (cp->val != 0x00 && cp->val != 0x01)
6656                 return mgmt_cmd_status(sk, hdev->id,
6657                                        MGMT_OP_SET_FAST_CONNECTABLE,
6658                                        MGMT_STATUS_INVALID_PARAMS);
6659
6660         hci_dev_lock(hdev);
6661
6662         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6663                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6664                 goto unlock;
6665         }
6666
6667         if (!hdev_is_powered(hdev)) {
6668                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6669                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6670                 new_settings(hdev, sk);
6671                 goto unlock;
6672         }
6673
6674         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6675                                len);
6676         if (!cmd)
6677                 err = -ENOMEM;
6678         else
6679                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6680                                          fast_connectable_complete);
6681
6682         if (err < 0) {
6683                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6684                                 MGMT_STATUS_FAILED);
6685
6686                 if (cmd)
6687                         mgmt_pending_free(cmd);
6688         }
6689
6690 unlock:
6691         hci_dev_unlock(hdev);
6692
6693         return err;
6694 }
6695
6696 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6697 {
6698         struct mgmt_pending_cmd *cmd = data;
6699
6700         bt_dev_dbg(hdev, "err %d", err);
6701
6702         if (err) {
6703                 u8 mgmt_err = mgmt_status(err);
6704
6705                 /* We need to restore the flag if related HCI commands
6706                  * failed.
6707                  */
6708                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6709
6710                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6711         } else {
6712                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6713                 new_settings(hdev, cmd->sk);
6714         }
6715
6716         mgmt_pending_free(cmd);
6717 }
6718
6719 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6720 {
6721         int status;
6722
6723         status = hci_write_fast_connectable_sync(hdev, false);
6724
6725         if (!status)
6726                 status = hci_update_scan_sync(hdev);
6727
6728         /* Since only the advertising data flags will change, there
6729          * is no need to update the scan response data.
6730          */
6731         if (!status)
6732                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6733
6734         return status;
6735 }
6736
6737 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6738 {
6739         struct mgmt_mode *cp = data;
6740         struct mgmt_pending_cmd *cmd;
6741         int err;
6742
6743         bt_dev_dbg(hdev, "sock %p", sk);
6744
6745         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6746                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6747                                        MGMT_STATUS_NOT_SUPPORTED);
6748
6749         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6750                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6751                                        MGMT_STATUS_REJECTED);
6752
6753         if (cp->val != 0x00 && cp->val != 0x01)
6754                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6755                                        MGMT_STATUS_INVALID_PARAMS);
6756
6757         hci_dev_lock(hdev);
6758
6759         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6760                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6761                 goto unlock;
6762         }
6763
6764         if (!hdev_is_powered(hdev)) {
6765                 if (!cp->val) {
6766                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6767                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6768                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6769                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6770                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
6771                 }
6772
6773                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6774
6775                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6776                 if (err < 0)
6777                         goto unlock;
6778
6779                 err = new_settings(hdev, sk);
6780                 goto unlock;
6781         }
6782
6783         /* Reject disabling when powered on */
6784         if (!cp->val) {
6785                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6786                                       MGMT_STATUS_REJECTED);
6787                 goto unlock;
6788         } else {
6789                 /* When configuring a dual-mode controller to operate
6790                  * with LE only and using a static address, then switching
6791                  * BR/EDR back on is not allowed.
6792                  *
6793                  * Dual-mode controllers shall operate with the public
6794                  * address as its identity address for BR/EDR and LE. So
6795                  * reject the attempt to create an invalid configuration.
6796                  *
6797                  * The same restrictions applies when secure connections
6798                  * has been enabled. For BR/EDR this is a controller feature
6799                  * while for LE it is a host stack feature. This means that
6800                  * switching BR/EDR back on when secure connections has been
6801                  * enabled is not a supported transaction.
6802                  */
6803                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6804                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6805                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6806                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6807                                               MGMT_STATUS_REJECTED);
6808                         goto unlock;
6809                 }
6810         }
6811
6812         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6813         if (!cmd)
6814                 err = -ENOMEM;
6815         else
6816                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6817                                          set_bredr_complete);
6818
6819         if (err < 0) {
6820                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6821                                 MGMT_STATUS_FAILED);
6822                 if (cmd)
6823                         mgmt_pending_free(cmd);
6824
6825                 goto unlock;
6826         }
6827
6828         /* We need to flip the bit already here so that
6829          * hci_req_update_adv_data generates the correct flags.
6830          */
6831         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6832
6833 unlock:
6834         hci_dev_unlock(hdev);
6835         return err;
6836 }
6837
6838 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6839 {
6840         struct mgmt_pending_cmd *cmd = data;
6841         struct mgmt_mode *cp;
6842
6843         bt_dev_dbg(hdev, "err %d", err);
6844
6845         if (err) {
6846                 u8 mgmt_err = mgmt_status(err);
6847
6848                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6849                 goto done;
6850         }
6851
6852         cp = cmd->param;
6853
6854         switch (cp->val) {
6855         case 0x00:
6856                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6857                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6858                 break;
6859         case 0x01:
6860                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6861                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6862                 break;
6863         case 0x02:
6864                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6865                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6866                 break;
6867         }
6868
6869         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6870         new_settings(hdev, cmd->sk);
6871
6872 done:
6873         mgmt_pending_free(cmd);
6874 }
6875
6876 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6877 {
6878         struct mgmt_pending_cmd *cmd = data;
6879         struct mgmt_mode *cp = cmd->param;
6880         u8 val = !!cp->val;
6881
6882         /* Force write of val */
6883         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6884
6885         return hci_write_sc_support_sync(hdev, val);
6886 }
6887
6888 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6889                            void *data, u16 len)
6890 {
6891         struct mgmt_mode *cp = data;
6892         struct mgmt_pending_cmd *cmd;
6893         u8 val;
6894         int err;
6895
6896         bt_dev_dbg(hdev, "sock %p", sk);
6897
6898         if (!lmp_sc_capable(hdev) &&
6899             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6900                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6901                                        MGMT_STATUS_NOT_SUPPORTED);
6902
6903         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6904             lmp_sc_capable(hdev) &&
6905             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6906                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6907                                        MGMT_STATUS_REJECTED);
6908
6909         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6910                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6911                                        MGMT_STATUS_INVALID_PARAMS);
6912
6913         hci_dev_lock(hdev);
6914
6915         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6916             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6917                 bool changed;
6918
6919                 if (cp->val) {
6920                         changed = !hci_dev_test_and_set_flag(hdev,
6921                                                              HCI_SC_ENABLED);
6922                         if (cp->val == 0x02)
6923                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6924                         else
6925                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6926                 } else {
6927                         changed = hci_dev_test_and_clear_flag(hdev,
6928                                                               HCI_SC_ENABLED);
6929                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6930                 }
6931
6932                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6933                 if (err < 0)
6934                         goto failed;
6935
6936                 if (changed)
6937                         err = new_settings(hdev, sk);
6938
6939                 goto failed;
6940         }
6941
6942         val = !!cp->val;
6943
6944         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6945             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6946                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6947                 goto failed;
6948         }
6949
6950         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6951         if (!cmd)
6952                 err = -ENOMEM;
6953         else
6954                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6955                                          set_secure_conn_complete);
6956
6957         if (err < 0) {
6958                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6959                                 MGMT_STATUS_FAILED);
6960                 if (cmd)
6961                         mgmt_pending_free(cmd);
6962         }
6963
6964 failed:
6965         hci_dev_unlock(hdev);
6966         return err;
6967 }
6968
6969 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6970                           void *data, u16 len)
6971 {
6972         struct mgmt_mode *cp = data;
6973         bool changed, use_changed;
6974         int err;
6975
6976         bt_dev_dbg(hdev, "sock %p", sk);
6977
6978         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6979                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6980                                        MGMT_STATUS_INVALID_PARAMS);
6981
6982         hci_dev_lock(hdev);
6983
6984         if (cp->val)
6985                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6986         else
6987                 changed = hci_dev_test_and_clear_flag(hdev,
6988                                                       HCI_KEEP_DEBUG_KEYS);
6989
6990         if (cp->val == 0x02)
6991                 use_changed = !hci_dev_test_and_set_flag(hdev,
6992                                                          HCI_USE_DEBUG_KEYS);
6993         else
6994                 use_changed = hci_dev_test_and_clear_flag(hdev,
6995                                                           HCI_USE_DEBUG_KEYS);
6996
6997         if (hdev_is_powered(hdev) && use_changed &&
6998             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6999                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
7000                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
7001                              sizeof(mode), &mode);
7002         }
7003
7004         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
7005         if (err < 0)
7006                 goto unlock;
7007
7008         if (changed)
7009                 err = new_settings(hdev, sk);
7010
7011 unlock:
7012         hci_dev_unlock(hdev);
7013         return err;
7014 }
7015
7016 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7017                        u16 len)
7018 {
7019         struct mgmt_cp_set_privacy *cp = cp_data;
7020         bool changed;
7021         int err;
7022
7023         bt_dev_dbg(hdev, "sock %p", sk);
7024
7025         if (!lmp_le_capable(hdev))
7026                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7027                                        MGMT_STATUS_NOT_SUPPORTED);
7028
7029         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7030                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7031                                        MGMT_STATUS_INVALID_PARAMS);
7032
7033         if (hdev_is_powered(hdev))
7034                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7035                                        MGMT_STATUS_REJECTED);
7036
7037         hci_dev_lock(hdev);
7038
7039         /* If user space supports this command it is also expected to
7040          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7041          */
7042         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7043
7044         if (cp->privacy) {
7045                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7046                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7047                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7048                 hci_adv_instances_set_rpa_expired(hdev, true);
7049                 if (cp->privacy == 0x02)
7050                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7051                 else
7052                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7053         } else {
7054                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7055                 memset(hdev->irk, 0, sizeof(hdev->irk));
7056                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7057                 hci_adv_instances_set_rpa_expired(hdev, false);
7058                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7059         }
7060
7061         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7062         if (err < 0)
7063                 goto unlock;
7064
7065         if (changed)
7066                 err = new_settings(hdev, sk);
7067
7068 unlock:
7069         hci_dev_unlock(hdev);
7070         return err;
7071 }
7072
7073 static bool irk_is_valid(struct mgmt_irk_info *irk)
7074 {
7075         switch (irk->addr.type) {
7076         case BDADDR_LE_PUBLIC:
7077                 return true;
7078
7079         case BDADDR_LE_RANDOM:
7080                 /* Two most significant bits shall be set */
7081                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7082                         return false;
7083                 return true;
7084         }
7085
7086         return false;
7087 }
7088
7089 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7090                      u16 len)
7091 {
7092         struct mgmt_cp_load_irks *cp = cp_data;
7093         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7094                                    sizeof(struct mgmt_irk_info));
7095         u16 irk_count, expected_len;
7096         int i, err;
7097
7098         bt_dev_dbg(hdev, "sock %p", sk);
7099
7100         if (!lmp_le_capable(hdev))
7101                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7102                                        MGMT_STATUS_NOT_SUPPORTED);
7103
7104         irk_count = __le16_to_cpu(cp->irk_count);
7105         if (irk_count > max_irk_count) {
7106                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7107                            irk_count);
7108                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7109                                        MGMT_STATUS_INVALID_PARAMS);
7110         }
7111
7112         expected_len = struct_size(cp, irks, irk_count);
7113         if (expected_len != len) {
7114                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7115                            expected_len, len);
7116                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7117                                        MGMT_STATUS_INVALID_PARAMS);
7118         }
7119
7120         bt_dev_dbg(hdev, "irk_count %u", irk_count);
7121
7122         for (i = 0; i < irk_count; i++) {
7123                 struct mgmt_irk_info *key = &cp->irks[i];
7124
7125                 if (!irk_is_valid(key))
7126                         return mgmt_cmd_status(sk, hdev->id,
7127                                                MGMT_OP_LOAD_IRKS,
7128                                                MGMT_STATUS_INVALID_PARAMS);
7129         }
7130
7131         hci_dev_lock(hdev);
7132
7133         hci_smp_irks_clear(hdev);
7134
7135         for (i = 0; i < irk_count; i++) {
7136                 struct mgmt_irk_info *irk = &cp->irks[i];
7137                 u8 addr_type = le_addr_type(irk->addr.type);
7138
7139                 if (hci_is_blocked_key(hdev,
7140                                        HCI_BLOCKED_KEY_TYPE_IRK,
7141                                        irk->val)) {
7142                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7143                                     &irk->addr.bdaddr);
7144                         continue;
7145                 }
7146
7147                 /* When using SMP over BR/EDR, the addr type should be set to BREDR */
7148                 if (irk->addr.type == BDADDR_BREDR)
7149                         addr_type = BDADDR_BREDR;
7150
7151                 hci_add_irk(hdev, &irk->addr.bdaddr,
7152                             addr_type, irk->val,
7153                             BDADDR_ANY);
7154         }
7155
7156         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7157
7158         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7159
7160         hci_dev_unlock(hdev);
7161
7162         return err;
7163 }
7164
7165 #ifdef TIZEN_BT
7166 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
7167                         void *data, u16 len)
7168 {
7169         struct mgmt_cp_set_advertising_params *cp = data;
7170         __u16 min_interval;
7171         __u16 max_interval;
7172         int err;
7173
7174         BT_DBG("%s", hdev->name);
7175
7176         if (!lmp_le_capable(hdev))
7177                 return mgmt_cmd_status(sk, hdev->id,
7178                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7179                                 MGMT_STATUS_NOT_SUPPORTED);
7180
7181         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7182                 return mgmt_cmd_status(sk, hdev->id,
7183                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7184                                 MGMT_STATUS_BUSY);
7185
7186         min_interval = __le16_to_cpu(cp->interval_min);
7187         max_interval = __le16_to_cpu(cp->interval_max);
7188
7189         if (min_interval > max_interval ||
7190             min_interval < 0x0020 || max_interval > 0x4000)
7191                 return mgmt_cmd_status(sk, hdev->id,
7192                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7193                                 MGMT_STATUS_INVALID_PARAMS);
7194
7195         hci_dev_lock(hdev);
7196
7197         hdev->le_adv_min_interval = min_interval;
7198         hdev->le_adv_max_interval = max_interval;
7199         hdev->adv_filter_policy = cp->filter_policy;
7200         hdev->adv_type = cp->type;
7201
7202         err = mgmt_cmd_complete(sk, hdev->id,
7203                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
7204
7205         hci_dev_unlock(hdev);
7206
7207         return err;
7208 }
7209
7210 static void set_advertising_data_complete(struct hci_dev *hdev,
7211                         u8 status, u16 opcode)
7212 {
7213         struct mgmt_cp_set_advertising_data *cp;
7214         struct mgmt_pending_cmd *cmd;
7215
7216         BT_DBG("status 0x%02x", status);
7217
7218         hci_dev_lock(hdev);
7219
7220         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
7221         if (!cmd)
7222                 goto unlock;
7223
7224         cp = cmd->param;
7225
7226         if (status)
7227                 mgmt_cmd_status(cmd->sk, hdev->id,
7228                                 MGMT_OP_SET_ADVERTISING_DATA,
7229                                 mgmt_status(status));
7230         else
7231                 mgmt_cmd_complete(cmd->sk, hdev->id,
7232                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
7233                                 cp, sizeof(*cp));
7234
7235         mgmt_pending_remove(cmd);
7236
7237 unlock:
7238         hci_dev_unlock(hdev);
7239 }
7240
7241 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
7242                         void *data, u16 len)
7243 {
7244         struct mgmt_pending_cmd *cmd;
7245         struct hci_request req;
7246         struct mgmt_cp_set_advertising_data *cp = data;
7247         struct hci_cp_le_set_adv_data adv;
7248         int err;
7249
7250         BT_DBG("%s", hdev->name);
7251
7252         if (!lmp_le_capable(hdev)) {
7253                 return mgmt_cmd_status(sk, hdev->id,
7254                                 MGMT_OP_SET_ADVERTISING_DATA,
7255                                 MGMT_STATUS_NOT_SUPPORTED);
7256         }
7257
7258         hci_dev_lock(hdev);
7259
7260         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
7261                 err = mgmt_cmd_status(sk, hdev->id,
7262                                 MGMT_OP_SET_ADVERTISING_DATA,
7263                                 MGMT_STATUS_BUSY);
7264                 goto unlocked;
7265         }
7266
7267         if (len > HCI_MAX_AD_LENGTH) {
7268                 err = mgmt_cmd_status(sk, hdev->id,
7269                                 MGMT_OP_SET_ADVERTISING_DATA,
7270                                 MGMT_STATUS_INVALID_PARAMS);
7271                 goto unlocked;
7272         }
7273
7274         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
7275                                hdev, data, len);
7276         if (!cmd) {
7277                 err = -ENOMEM;
7278                 goto unlocked;
7279         }
7280
7281         hci_req_init(&req, hdev);
7282
7283         memset(&adv, 0, sizeof(adv));
7284         memcpy(adv.data, cp->data, len);
7285         adv.length = len;
7286
7287         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
7288
7289         err = hci_req_run(&req, set_advertising_data_complete);
7290         if (err < 0)
7291                 mgmt_pending_remove(cmd);
7292
7293 unlocked:
7294         hci_dev_unlock(hdev);
7295
7296         return err;
7297 }
7298
7299 /* Adv White List feature */
7300 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7301 {
7302         struct mgmt_cp_add_dev_white_list *cp;
7303         struct mgmt_pending_cmd *cmd;
7304
7305         BT_DBG("status 0x%02x", status);
7306
7307         hci_dev_lock(hdev);
7308
7309         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
7310         if (!cmd)
7311                 goto unlock;
7312
7313         cp = cmd->param;
7314
7315         if (status)
7316                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7317                            mgmt_status(status));
7318         else
7319                 mgmt_cmd_complete(cmd->sk, hdev->id,
7320                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
7321
7322         mgmt_pending_remove(cmd);
7323
7324 unlock:
7325         hci_dev_unlock(hdev);
7326 }
7327
7328 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
7329                            void *data, u16 len)
7330 {
7331         struct mgmt_pending_cmd *cmd;
7332         struct mgmt_cp_add_dev_white_list *cp = data;
7333         struct hci_request req;
7334         int err;
7335
7336         BT_DBG("%s", hdev->name);
7337
7338         if (!lmp_le_capable(hdev))
7339                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7340                                   MGMT_STATUS_NOT_SUPPORTED);
7341
7342         if (!hdev_is_powered(hdev))
7343                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7344                                   MGMT_STATUS_REJECTED);
7345
7346         hci_dev_lock(hdev);
7347
7348         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
7349                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7350                                 MGMT_STATUS_BUSY);
7351                 goto unlocked;
7352         }
7353
7354         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
7355         if (!cmd) {
7356                 err = -ENOMEM;
7357                 goto unlocked;
7358         }
7359
7360         hci_req_init(&req, hdev);
7361
7362         hci_req_add(&req, HCI_OP_LE_ADD_TO_ACCEPT_LIST, sizeof(*cp), cp);
7363
7364         err = hci_req_run(&req, add_white_list_complete);
7365         if (err < 0) {
7366                 mgmt_pending_remove(cmd);
7367                 goto unlocked;
7368         }
7369
7370 unlocked:
7371         hci_dev_unlock(hdev);
7372
7373         return err;
7374 }
7375
7376 static void remove_from_white_list_complete(struct hci_dev *hdev,
7377                         u8 status, u16 opcode)
7378 {
7379         struct mgmt_cp_remove_dev_from_white_list *cp;
7380         struct mgmt_pending_cmd *cmd;
7381
7382         BT_DBG("status 0x%02x", status);
7383
7384         hci_dev_lock(hdev);
7385
7386         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
7387         if (!cmd)
7388                 goto unlock;
7389
7390         cp = cmd->param;
7391
7392         if (status)
7393                 mgmt_cmd_status(cmd->sk, hdev->id,
7394                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7395                         mgmt_status(status));
7396         else
7397                 mgmt_cmd_complete(cmd->sk, hdev->id,
7398                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
7399                         cp, sizeof(*cp));
7400
7401         mgmt_pending_remove(cmd);
7402
7403 unlock:
7404         hci_dev_unlock(hdev);
7405 }
7406
7407 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
7408                            void *data, u16 len)
7409 {
7410         struct mgmt_pending_cmd *cmd;
7411         struct mgmt_cp_remove_dev_from_white_list *cp = data;
7412         struct hci_request req;
7413         int err;
7414
7415         BT_DBG("%s", hdev->name);
7416
7417         if (!lmp_le_capable(hdev))
7418                 return mgmt_cmd_status(sk, hdev->id,
7419                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7420                                 MGMT_STATUS_NOT_SUPPORTED);
7421
7422         if (!hdev_is_powered(hdev))
7423                 return mgmt_cmd_status(sk, hdev->id,
7424                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7425                                 MGMT_STATUS_REJECTED);
7426
7427         hci_dev_lock(hdev);
7428
7429         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
7430                 err = mgmt_cmd_status(sk, hdev->id,
7431                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7432                                 MGMT_STATUS_BUSY);
7433                 goto unlocked;
7434         }
7435
7436         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7437                                 hdev, data, len);
7438         if (!cmd) {
7439                 err = -ENOMEM;
7440                 goto unlocked;
7441         }
7442
7443         hci_req_init(&req, hdev);
7444
7445         hci_req_add(&req, HCI_OP_LE_DEL_FROM_ACCEPT_LIST, sizeof(*cp), cp);
7446
7447         err = hci_req_run(&req, remove_from_white_list_complete);
7448         if (err < 0) {
7449                 mgmt_pending_remove(cmd);
7450                 goto unlocked;
7451         }
7452
7453 unlocked:
7454         hci_dev_unlock(hdev);
7455
7456         return err;
7457 }
7458
7459 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
7460                         u16 opcode)
7461 {
7462         struct mgmt_pending_cmd *cmd;
7463
7464         BT_DBG("status 0x%02x", status);
7465
7466         hci_dev_lock(hdev);
7467
7468         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
7469         if (!cmd)
7470                 goto unlock;
7471
7472         if (status)
7473                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7474                            mgmt_status(status));
7475         else
7476                 mgmt_cmd_complete(cmd->sk, hdev->id,
7477                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7478                                 0, NULL, 0);
7479
7480         mgmt_pending_remove(cmd);
7481
7482 unlock:
7483         hci_dev_unlock(hdev);
7484 }
7485
7486 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
7487                            void *data, u16 len)
7488 {
7489         struct mgmt_pending_cmd *cmd;
7490         struct hci_request req;
7491         int err;
7492
7493         BT_DBG("%s", hdev->name);
7494
7495         if (!lmp_le_capable(hdev))
7496                 return mgmt_cmd_status(sk, hdev->id,
7497                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7498                                 MGMT_STATUS_NOT_SUPPORTED);
7499
7500         if (!hdev_is_powered(hdev))
7501                 return mgmt_cmd_status(sk, hdev->id,
7502                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7503                                 MGMT_STATUS_REJECTED);
7504
7505         hci_dev_lock(hdev);
7506
7507         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
7508                 err = mgmt_cmd_status(sk, hdev->id,
7509                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7510                                 MGMT_STATUS_BUSY);
7511                 goto unlocked;
7512         }
7513
7514         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7515                                 hdev, NULL, 0);
7516         if (!cmd) {
7517                 err = -ENOMEM;
7518                 goto unlocked;
7519         }
7520
7521         hci_req_init(&req, hdev);
7522
7523         hci_req_add(&req, HCI_OP_LE_CLEAR_ACCEPT_LIST, 0, NULL);
7524
7525         err = hci_req_run(&req, clear_white_list_complete);
7526         if (err < 0) {
7527                 mgmt_pending_remove(cmd);
7528                 goto unlocked;
7529         }
7530
7531 unlocked:
7532         hci_dev_unlock(hdev);
7533
7534         return err;
7535 }
7536
7537 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
7538                         u16 opcode)
7539 {
7540         struct mgmt_cp_set_scan_rsp_data *cp;
7541         struct mgmt_pending_cmd *cmd;
7542
7543         BT_DBG("status 0x%02x", status);
7544
7545         hci_dev_lock(hdev);
7546
7547         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
7548         if (!cmd)
7549                 goto unlock;
7550
7551         cp = cmd->param;
7552
7553         if (status)
7554                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7555                                 mgmt_status(status));
7556         else
7557                 mgmt_cmd_complete(cmd->sk, hdev->id,
7558                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
7559                                 cp, sizeof(*cp));
7560
7561         mgmt_pending_remove(cmd);
7562
7563 unlock:
7564         hci_dev_unlock(hdev);
7565 }
7566
7567 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
7568                         u16 len)
7569 {
7570         struct mgmt_pending_cmd *cmd;
7571         struct hci_request req;
7572         struct mgmt_cp_set_scan_rsp_data *cp = data;
7573         struct hci_cp_le_set_scan_rsp_data rsp;
7574         int err;
7575
7576         BT_DBG("%s", hdev->name);
7577
7578         if (!lmp_le_capable(hdev))
7579                 return mgmt_cmd_status(sk, hdev->id,
7580                                 MGMT_OP_SET_SCAN_RSP_DATA,
7581                                 MGMT_STATUS_NOT_SUPPORTED);
7582
7583         hci_dev_lock(hdev);
7584
7585         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
7586                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7587                                 MGMT_STATUS_BUSY);
7588                 goto unlocked;
7589         }
7590
7591         if (len > HCI_MAX_AD_LENGTH) {
7592                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7593                                 MGMT_STATUS_INVALID_PARAMS);
7594                 goto unlocked;
7595         }
7596
7597         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
7598         if (!cmd) {
7599                 err = -ENOMEM;
7600                 goto unlocked;
7601         }
7602
7603         hci_req_init(&req, hdev);
7604
7605         memset(&rsp, 0, sizeof(rsp));
7606         memcpy(rsp.data, cp->data, len);
7607         rsp.length = len;
7608
7609         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
7610
7611         err = hci_req_run(&req, set_scan_rsp_data_complete);
7612         if (err < 0)
7613                 mgmt_pending_remove(cmd);
7614
7615 unlocked:
7616         hci_dev_unlock(hdev);
7617
7618         return err;
7619 }
7620
7621 static void set_rssi_threshold_complete(struct hci_dev *hdev,
7622                         u8 status, u16 opcode)
7623 {
7624         struct mgmt_pending_cmd *cmd;
7625
7626         BT_DBG("status 0x%02x", status);
7627
7628         hci_dev_lock(hdev);
7629
7630         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7631         if (!cmd)
7632                 goto unlock;
7633
7634         if (status)
7635                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7636                                 mgmt_status(status));
7637         else
7638                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7639                                 NULL, 0);
7640
7641         mgmt_pending_remove(cmd);
7642
7643 unlock:
7644         hci_dev_unlock(hdev);
7645 }
7646
7647 static void set_rssi_disable_complete(struct hci_dev *hdev,
7648                         u8 status, u16 opcode)
7649 {
7650         struct mgmt_pending_cmd *cmd;
7651
7652         BT_DBG("status 0x%02x", status);
7653
7654         hci_dev_lock(hdev);
7655
7656         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7657         if (!cmd)
7658                 goto unlock;
7659
7660         if (status)
7661                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7662                                 mgmt_status(status));
7663         else
7664                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7665                                 0, NULL, 0);
7666
7667         mgmt_pending_remove(cmd);
7668
7669 unlock:
7670         hci_dev_unlock(hdev);
7671 }
7672
7673 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
7674                 void *data, u16 len)
7675 {
7676         int err = 0;
7677         struct hci_cp_set_rssi_threshold th = { 0, };
7678         struct mgmt_cp_set_enable_rssi *cp = data;
7679         struct hci_conn *conn;
7680         struct mgmt_pending_cmd *cmd;
7681         struct hci_request req;
7682         __u8 dest_type;
7683
7684         hci_dev_lock(hdev);
7685
7686         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7687         if (!cmd) {
7688                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7689                                 MGMT_STATUS_FAILED);
7690                 goto unlocked;
7691         }
7692
7693         if (!lmp_le_capable(hdev)) {
7694                 mgmt_pending_remove(cmd);
7695                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7696                                 MGMT_STATUS_NOT_SUPPORTED);
7697                 goto unlocked;
7698         }
7699
7700         if (!hdev_is_powered(hdev)) {
7701                 BT_DBG("%s", hdev->name);
7702                 mgmt_pending_remove(cmd);
7703                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7704                                 MGMT_STATUS_NOT_POWERED);
7705                 goto unlocked;
7706         }
7707
7708         if (cp->link_type == 0x01)
7709                 dest_type = LE_LINK;
7710         else
7711                 dest_type = ACL_LINK;
7712
7713         /* Get LE/ACL link handle info */
7714         conn = hci_conn_hash_lookup_ba(hdev,
7715                         dest_type, &cp->bdaddr);
7716
7717         if (!conn) {
7718                 err = mgmt_cmd_complete(sk, hdev->id,
7719                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
7720                 mgmt_pending_remove(cmd);
7721                 goto unlocked;
7722         }
7723
7724         hci_req_init(&req, hdev);
7725
7726         th.hci_le_ext_opcode = 0x0B;
7727         th.mode = 0x01;
7728         th.conn_handle = conn->handle;
7729         th.alert_mask = 0x07;
7730         th.low_th = cp->low_th;
7731         th.in_range_th = cp->in_range_th;
7732         th.high_th = cp->high_th;
7733
7734         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7735         err = hci_req_run(&req, set_rssi_threshold_complete);
7736
7737         if (err < 0) {
7738                 mgmt_pending_remove(cmd);
7739                 BT_ERR("Error in requesting hci_req_run");
7740                 goto unlocked;
7741         }
7742
7743 unlocked:
7744         hci_dev_unlock(hdev);
7745         return err;
7746 }
7747
7748 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
7749                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7750 {
7751         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
7752         struct mgmt_cp_set_enable_rssi *cp = data;
7753         struct mgmt_pending_cmd *cmd;
7754
7755         if (!cp || !rp)
7756                 goto remove_cmd;
7757
7758         mgmt_rp.status = rp->status;
7759         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7760         mgmt_rp.bt_address = cp->bdaddr;
7761         mgmt_rp.link_type = cp->link_type;
7762
7763         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7764                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7765                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7766
7767         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
7768                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7769
7770         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
7771         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7772                         &mgmt_rp.bt_address, true);
7773
7774 remove_cmd:
7775         hci_dev_lock(hdev);
7776         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7777         if (cmd)
7778                 mgmt_pending_remove(cmd);
7779
7780         hci_dev_unlock(hdev);
7781 }
7782
7783 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
7784                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7785 {
7786         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
7787         struct mgmt_cp_disable_rssi *cp = data;
7788         struct mgmt_pending_cmd *cmd;
7789
7790         if (!cp || !rp)
7791                 goto remove_cmd;
7792
7793         mgmt_rp.status = rp->status;
7794         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7795         mgmt_rp.bt_address = cp->bdaddr;
7796         mgmt_rp.link_type = cp->link_type;
7797
7798         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7799                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7800                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7801
7802         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
7803                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7804
7805         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7806                         &mgmt_rp.bt_address, false);
7807
7808 remove_cmd:
7809         hci_dev_lock(hdev);
7810         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7811         if (cmd)
7812                 mgmt_pending_remove(cmd);
7813
7814         hci_dev_unlock(hdev);
7815 }
7816
7817 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
7818                 void *data, u16 len)
7819 {
7820         struct mgmt_pending_cmd *cmd;
7821         struct hci_request req;
7822         struct hci_cp_set_enable_rssi cp_en = { 0, };
7823         int err;
7824
7825         BT_DBG("Set Disable RSSI.");
7826
7827         cp_en.hci_le_ext_opcode = 0x01;
7828         cp_en.le_enable_cs_Features = 0x00;
7829         cp_en.data[0] = 0x00;
7830         cp_en.data[1] = 0x00;
7831         cp_en.data[2] = 0x00;
7832
7833         hci_dev_lock(hdev);
7834
7835         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7836         if (!cmd) {
7837                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7838                                 MGMT_STATUS_FAILED);
7839                 goto unlocked;
7840         }
7841
7842         if (!lmp_le_capable(hdev)) {
7843                 mgmt_pending_remove(cmd);
7844                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7845                                 MGMT_STATUS_NOT_SUPPORTED);
7846                 goto unlocked;
7847         }
7848
7849         if (!hdev_is_powered(hdev)) {
7850                 BT_DBG("%s", hdev->name);
7851                 mgmt_pending_remove(cmd);
7852                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7853                                 MGMT_STATUS_NOT_POWERED);
7854                 goto unlocked;
7855         }
7856
7857         hci_req_init(&req, hdev);
7858
7859         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7860                         sizeof(struct hci_cp_set_enable_rssi),
7861                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7862                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7863
7864         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7865         err = hci_req_run(&req, set_rssi_disable_complete);
7866
7867         if (err < 0) {
7868                 mgmt_pending_remove(cmd);
7869                 BT_ERR("Error in requesting hci_req_run");
7870                 goto unlocked;
7871         }
7872
7873 unlocked:
7874         hci_dev_unlock(hdev);
7875         return err;
7876 }
7877
7878 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
7879 {
7880         struct hci_cc_rsp_enable_rssi *rp = response;
7881         struct mgmt_pending_cmd *cmd_enable = NULL;
7882         struct mgmt_pending_cmd *cmd_disable = NULL;
7883         struct mgmt_cp_set_enable_rssi *cp_en;
7884         struct mgmt_cp_disable_rssi *cp_dis;
7885
7886         hci_dev_lock(hdev);
7887         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7888         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7889         hci_dev_unlock(hdev);
7890
7891         if (cmd_enable)
7892                 BT_DBG("Enable Request");
7893
7894         if (cmd_disable)
7895                 BT_DBG("Disable Request");
7896
7897         if (cmd_enable) {
7898                 cp_en = cmd_enable->param;
7899
7900                 if (status != 0x00)
7901                         return;
7902
7903                 switch (rp->le_ext_opcode) {
7904                 case 0x01:
7905                         BT_DBG("RSSI enabled.. Setting Threshold...");
7906                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
7907                                         cp_en, sizeof(*cp_en));
7908                         break;
7909
7910                 case 0x0B:
7911                         BT_DBG("Sending RSSI enable success");
7912                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
7913                                         cp_en, rp, rp->status);
7914                         break;
7915                 }
7916
7917         } else if (cmd_disable) {
7918                 cp_dis = cmd_disable->param;
7919
7920                 if (status != 0x00)
7921                         return;
7922
7923                 switch (rp->le_ext_opcode) {
7924                 case 0x01:
7925                         BT_DBG("Sending RSSI disable success");
7926                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7927                                         cp_dis, rp, rp->status);
7928                         break;
7929
7930                 case 0x0B:
7931                         /*
7932                          * Only unset RSSI Threshold values for the Link if
7933                          * RSSI is monitored for other BREDR or LE Links
7934                          */
7935                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
7936                                 BT_DBG("Unset Threshold. Other links being monitored");
7937                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7938                                                 cp_dis, rp, rp->status);
7939                         } else {
7940                                 BT_DBG("Unset Threshold. Disabling...");
7941                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
7942                                                 cp_dis, sizeof(*cp_dis));
7943                         }
7944                         break;
7945                 }
7946         }
7947 }
7948
7949 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
7950                 u16 opcode)
7951 {
7952         struct mgmt_pending_cmd *cmd;
7953
7954         BT_DBG("status 0x%02x", status);
7955
7956         hci_dev_lock(hdev);
7957
7958         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7959         if (!cmd)
7960                 goto unlock;
7961
7962         if (status)
7963                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7964                                 mgmt_status(status));
7965         else
7966                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7967                                 NULL, 0);
7968
7969         mgmt_pending_remove(cmd);
7970
7971 unlock:
7972         hci_dev_unlock(hdev);
7973 }
7974
7975 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7976                 void *data, u16 len)
7977 {
7978         struct mgmt_pending_cmd *cmd;
7979         struct hci_request req;
7980         struct mgmt_cp_set_enable_rssi *cp = data;
7981         struct hci_cp_set_enable_rssi cp_en = { 0, };
7982         int err;
7983
7984         BT_DBG("Set Enable RSSI.");
7985
7986         cp_en.hci_le_ext_opcode = 0x01;
7987         cp_en.le_enable_cs_Features = 0x04;
7988         cp_en.data[0] = 0x00;
7989         cp_en.data[1] = 0x00;
7990         cp_en.data[2] = 0x00;
7991
7992         hci_dev_lock(hdev);
7993
7994         if (!lmp_le_capable(hdev)) {
7995                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7996                                 MGMT_STATUS_NOT_SUPPORTED);
7997                 goto unlocked;
7998         }
7999
8000         if (!hdev_is_powered(hdev)) {
8001                 BT_DBG("%s", hdev->name);
8002                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
8003                                 MGMT_STATUS_NOT_POWERED);
8004                 goto unlocked;
8005         }
8006
8007         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
8008                 BT_DBG("%s", hdev->name);
8009                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
8010                                 MGMT_STATUS_BUSY);
8011                 goto unlocked;
8012         }
8013
8014         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
8015                         sizeof(*cp));
8016         if (!cmd) {
8017                 BT_DBG("%s", hdev->name);
8018                 err = -ENOMEM;
8019                 goto unlocked;
8020         }
8021
8022         /* If RSSI is already enabled directly set Threshold values */
8023         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
8024                 hci_dev_unlock(hdev);
8025                 BT_DBG("RSSI Enabled. Directly set Threshold");
8026                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
8027                 return err;
8028         }
8029
8030         hci_req_init(&req, hdev);
8031
8032         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
8033                         sizeof(struct hci_cp_set_enable_rssi),
8034                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
8035                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
8036
8037         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
8038         err = hci_req_run(&req, set_rssi_enable_complete);
8039
8040         if (err < 0) {
8041                 mgmt_pending_remove(cmd);
8042                 BT_ERR("Error in requesting hci_req_run");
8043                 goto unlocked;
8044         }
8045
8046 unlocked:
8047         hci_dev_unlock(hdev);
8048
8049         return err;
8050 }
8051
8052 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8053 {
8054         struct mgmt_pending_cmd *cmd;
8055
8056         BT_DBG("status 0x%02x", status);
8057
8058         hci_dev_lock(hdev);
8059
8060         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
8061         if (!cmd)
8062                 goto unlock;
8063
8064         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8065                         MGMT_STATUS_SUCCESS, &status, 1);
8066
8067         mgmt_pending_remove(cmd);
8068
8069 unlock:
8070         hci_dev_unlock(hdev);
8071 }
8072
8073 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
8074                         u16 len)
8075 {
8076         struct mgmt_pending_cmd *cmd;
8077         struct hci_request req;
8078         struct mgmt_cp_get_raw_rssi *cp = data;
8079         struct hci_cp_get_raw_rssi hci_cp;
8080
8081         struct hci_conn *conn;
8082         int err;
8083         __u8 dest_type;
8084
8085         BT_DBG("Get Raw RSSI.");
8086
8087         hci_dev_lock(hdev);
8088
8089         if (!lmp_le_capable(hdev)) {
8090                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8091                                 MGMT_STATUS_NOT_SUPPORTED);
8092                 goto unlocked;
8093         }
8094
8095         if (cp->link_type == 0x01)
8096                 dest_type = LE_LINK;
8097         else
8098                 dest_type = ACL_LINK;
8099
8100         /* Get LE/BREDR link handle info */
8101         conn = hci_conn_hash_lookup_ba(hdev,
8102                         dest_type, &cp->bt_address);
8103         if (!conn) {
8104                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8105                                                    MGMT_STATUS_NOT_CONNECTED);
8106                 goto unlocked;
8107         }
8108         hci_cp.conn_handle = conn->handle;
8109
8110         if (!hdev_is_powered(hdev)) {
8111                 BT_DBG("%s", hdev->name);
8112                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8113                                 MGMT_STATUS_NOT_POWERED);
8114                 goto unlocked;
8115         }
8116
8117         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
8118                 BT_DBG("%s", hdev->name);
8119                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8120                                 MGMT_STATUS_BUSY);
8121                 goto unlocked;
8122         }
8123
8124         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
8125         if (!cmd) {
8126                 BT_DBG("%s", hdev->name);
8127                 err = -ENOMEM;
8128                 goto unlocked;
8129         }
8130
8131         hci_req_init(&req, hdev);
8132
8133         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
8134         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
8135         err = hci_req_run(&req, get_raw_rssi_complete);
8136
8137         if (err < 0) {
8138                 mgmt_pending_remove(cmd);
8139                 BT_ERR("Error in requesting hci_req_run");
8140         }
8141
8142 unlocked:
8143         hci_dev_unlock(hdev);
8144
8145         return err;
8146 }
8147
8148 void mgmt_raw_rssi_response(struct hci_dev *hdev,
8149                 struct hci_cc_rp_get_raw_rssi *rp, int success)
8150 {
8151         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
8152         struct hci_conn *conn;
8153
8154         mgmt_rp.status = rp->status;
8155         mgmt_rp.rssi_dbm = rp->rssi_dbm;
8156
8157         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
8158         if (!conn)
8159                 return;
8160
8161         bacpy(&mgmt_rp.bt_address, &conn->dst);
8162         if (conn->type == LE_LINK)
8163                 mgmt_rp.link_type = 0x01;
8164         else
8165                 mgmt_rp.link_type = 0x00;
8166
8167         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
8168                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
8169 }
8170
8171 static void set_disable_threshold_complete(struct hci_dev *hdev,
8172                         u8 status, u16 opcode)
8173 {
8174         struct mgmt_pending_cmd *cmd;
8175
8176         BT_DBG("status 0x%02x", status);
8177
8178         hci_dev_lock(hdev);
8179
8180         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
8181         if (!cmd)
8182                 goto unlock;
8183
8184         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8185                         MGMT_STATUS_SUCCESS, &status, 1);
8186
8187         mgmt_pending_remove(cmd);
8188
8189 unlock:
8190         hci_dev_unlock(hdev);
8191 }
8192
8193 /** Removes monitoring for a link*/
8194 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
8195                 void *data, u16 len)
8196 {
8197         int err = 0;
8198         struct hci_cp_set_rssi_threshold th = { 0, };
8199         struct mgmt_cp_disable_rssi *cp = data;
8200         struct hci_conn *conn;
8201         struct mgmt_pending_cmd *cmd;
8202         struct hci_request req;
8203         __u8 dest_type;
8204
8205         BT_DBG("Set Disable RSSI.");
8206
8207         hci_dev_lock(hdev);
8208
8209         if (!lmp_le_capable(hdev)) {
8210                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8211                                 MGMT_STATUS_NOT_SUPPORTED);
8212                 goto unlocked;
8213         }
8214
8215         /* Get LE/ACL link handle info*/
8216         if (cp->link_type == 0x01)
8217                 dest_type = LE_LINK;
8218         else
8219                 dest_type = ACL_LINK;
8220
8221         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
8222         if (!conn) {
8223                 err = mgmt_cmd_complete(sk, hdev->id,
8224                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
8225                 goto unlocked;
8226         }
8227
8228         th.hci_le_ext_opcode = 0x0B;
8229         th.mode = 0x01;
8230         th.conn_handle = conn->handle;
8231         th.alert_mask = 0x00;
8232         th.low_th = 0x00;
8233         th.in_range_th = 0x00;
8234         th.high_th = 0x00;
8235
8236         if (!hdev_is_powered(hdev)) {
8237                 BT_DBG("%s", hdev->name);
8238                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8239                                 0, data, len);
8240                 goto unlocked;
8241         }
8242
8243         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
8244                 BT_DBG("%s", hdev->name);
8245                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8246                                 MGMT_STATUS_BUSY);
8247                 goto unlocked;
8248         }
8249
8250         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
8251                         sizeof(*cp));
8252         if (!cmd) {
8253                 BT_DBG("%s", hdev->name);
8254                 err = -ENOMEM;
8255                 goto unlocked;
8256         }
8257
8258         hci_req_init(&req, hdev);
8259
8260         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
8261         err = hci_req_run(&req, set_disable_threshold_complete);
8262         if (err < 0) {
8263                 mgmt_pending_remove(cmd);
8264                 BT_ERR("Error in requesting hci_req_run");
8265                 goto unlocked;
8266         }
8267
8268 unlocked:
8269         hci_dev_unlock(hdev);
8270
8271         return err;
8272 }
8273
8274 void mgmt_rssi_alert_evt(struct hci_dev *hdev, struct sk_buff *skb)
8275 {
8276         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
8277         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
8278         struct hci_conn *conn;
8279
8280         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
8281                         ev->conn_handle, ev->alert_type, ev->rssi_dbm);
8282
8283         conn = hci_conn_hash_lookup_handle(hdev, ev->conn_handle);
8284
8285         if (!conn) {
8286                 BT_ERR("RSSI alert Error: Device not found for handle");
8287                 return;
8288         }
8289         bacpy(&mgmt_ev.bdaddr, &conn->dst);
8290
8291         if (conn->type == LE_LINK)
8292                 mgmt_ev.link_type = 0x01;
8293         else
8294                 mgmt_ev.link_type = 0x00;
8295
8296         mgmt_ev.alert_type = ev->alert_type;
8297         mgmt_ev.rssi_dbm = ev->rssi_dbm;
8298
8299         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
8300                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
8301                         NULL);
8302 }
8303
8304 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
8305 {
8306         struct mgmt_pending_cmd *cmd;
8307         u8 type;
8308         int err;
8309
8310         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
8311
8312         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
8313         if (!cmd)
8314                 return -ENOENT;
8315
8316         type = hdev->le_discovery.type;
8317
8318         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
8319                                 mgmt_status(status), &type, sizeof(type));
8320         mgmt_pending_remove(cmd);
8321
8322         return err;
8323 }
8324
8325 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
8326                 u16 opcode)
8327 {
8328         unsigned long timeout = 0;
8329
8330         BT_DBG("status %d", status);
8331
8332         if (status) {
8333                 hci_dev_lock(hdev);
8334                 mgmt_start_le_discovery_failed(hdev, status);
8335                 hci_dev_unlock(hdev);
8336                 return;
8337         }
8338
8339         hci_dev_lock(hdev);
8340         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
8341         hci_dev_unlock(hdev);
8342
8343         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
8344                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
8345
8346         if (!timeout)
8347                 return;
8348
8349         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
8350 }
8351
8352 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
8353                 void *data, u16 len)
8354 {
8355         struct mgmt_cp_start_le_discovery *cp = data;
8356         struct mgmt_pending_cmd *cmd;
8357         struct hci_cp_le_set_scan_param param_cp;
8358         struct hci_cp_le_set_scan_enable enable_cp;
8359         struct hci_request req;
8360         u8 status, own_addr_type;
8361         int err;
8362
8363         BT_DBG("%s", hdev->name);
8364
8365         if (!hdev_is_powered(hdev)) {
8366                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8367                                 MGMT_STATUS_NOT_POWERED);
8368                 goto unlock;
8369         }
8370
8371         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
8372                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8373                                 MGMT_STATUS_BUSY);
8374                 goto unlock;
8375         }
8376
8377         if (cp->type != DISCOV_TYPE_LE) {
8378                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8379                                 MGMT_STATUS_INVALID_PARAMS);
8380                 goto unlock;
8381         }
8382
8383         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
8384         if (!cmd) {
8385                 err = -ENOMEM;
8386                 goto unlock;
8387         }
8388
8389         hdev->le_discovery.type = cp->type;
8390
8391         hci_req_init(&req, hdev);
8392
8393         status = mgmt_le_support(hdev);
8394         if (status) {
8395                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8396                                 status);
8397                 mgmt_pending_remove(cmd);
8398                 goto unlock;
8399         }
8400
8401         /* If controller is scanning, it means the background scanning
8402          * is running. Thus, we should temporarily stop it in order to
8403          * set the discovery scanning parameters.
8404          */
8405         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
8406                 hci_req_add_le_scan_disable(&req, false);
8407
8408         memset(&param_cp, 0, sizeof(param_cp));
8409
8410         /* All active scans will be done with either a resolvable
8411          * private address (when privacy feature has been enabled)
8412          * or unresolvable private address.
8413          */
8414         err = hci_update_random_address_sync(hdev, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
8415         if (err < 0) {
8416                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8417                                 MGMT_STATUS_FAILED);
8418                 mgmt_pending_remove(cmd);
8419                 goto unlock;
8420         }
8421
8422         param_cp.type = hdev->le_scan_type;
8423         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
8424         param_cp.window = cpu_to_le16(hdev->le_scan_window);
8425         param_cp.own_address_type = own_addr_type;
8426         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
8427                     &param_cp);
8428
8429         memset(&enable_cp, 0, sizeof(enable_cp));
8430         enable_cp.enable = LE_SCAN_ENABLE;
8431         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
8432
8433         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
8434                     &enable_cp);
8435
8436         err = hci_req_run(&req, start_le_discovery_complete);
8437         if (err < 0)
8438                 mgmt_pending_remove(cmd);
8439         else
8440                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
8441
8442 unlock:
8443         return err;
8444 }
8445
8446 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
8447 {
8448         struct mgmt_pending_cmd *cmd;
8449         int err;
8450
8451         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
8452         if (!cmd)
8453                 return -ENOENT;
8454
8455         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
8456                                 mgmt_status(status), &hdev->le_discovery.type,
8457                                 sizeof(hdev->le_discovery.type));
8458         mgmt_pending_remove(cmd);
8459
8460         return err;
8461 }
8462
8463 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
8464                 u16 opcode)
8465 {
8466         BT_DBG("status %d", status);
8467
8468         hci_dev_lock(hdev);
8469
8470         if (status) {
8471                 mgmt_stop_le_discovery_failed(hdev, status);
8472                 goto unlock;
8473         }
8474
8475         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
8476
8477 unlock:
8478         hci_dev_unlock(hdev);
8479 }
8480
8481 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
8482                 void *data, u16 len)
8483 {
8484         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
8485         struct mgmt_pending_cmd *cmd;
8486         struct hci_request req;
8487         int err;
8488
8489         BT_DBG("%s", hdev->name);
8490
8491         hci_dev_lock(hdev);
8492
8493         if (!hci_le_discovery_active(hdev)) {
8494                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8495                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
8496                                         sizeof(mgmt_cp->type));
8497                 goto unlock;
8498         }
8499
8500         if (hdev->le_discovery.type != mgmt_cp->type) {
8501                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8502                                         MGMT_STATUS_INVALID_PARAMS,
8503                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
8504                 goto unlock;
8505         }
8506
8507         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
8508         if (!cmd) {
8509                 err = -ENOMEM;
8510                 goto unlock;
8511         }
8512
8513         hci_req_init(&req, hdev);
8514
8515         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
8516                 BT_DBG("unknown le discovery state %u",
8517                                         hdev->le_discovery.state);
8518
8519                 mgmt_pending_remove(cmd);
8520                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8521                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
8522                                         sizeof(mgmt_cp->type));
8523                 goto unlock;
8524         }
8525
8526         cancel_delayed_work(&hdev->le_scan_disable);
8527         hci_req_add_le_scan_disable(&req, false);
8528
8529         err = hci_req_run(&req, stop_le_discovery_complete);
8530         if (err < 0)
8531                 mgmt_pending_remove(cmd);
8532         else
8533                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
8534
8535 unlock:
8536         hci_dev_unlock(hdev);
8537         return err;
8538 }
8539
8540 /* Separate LE discovery */
8541 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
8542 {
8543         struct mgmt_ev_discovering ev;
8544         struct mgmt_pending_cmd *cmd;
8545
8546         BT_DBG("%s le discovering %u", hdev->name, discovering);
8547
8548         if (discovering)
8549                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
8550         else
8551                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
8552
8553         if (cmd) {
8554                 u8 type = hdev->le_discovery.type;
8555
8556                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
8557                                   sizeof(type));
8558                 mgmt_pending_remove(cmd);
8559         }
8560
8561         memset(&ev, 0, sizeof(ev));
8562         ev.type = hdev->le_discovery.type;
8563         ev.discovering = discovering;
8564
8565         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8566 }
8567
8568 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
8569                         void *data, u16 len)
8570 {
8571         int err;
8572
8573         BT_DBG("%s", hdev->name);
8574
8575         hci_dev_lock(hdev);
8576
8577         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
8578         if (err < 0)
8579                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
8580
8581         hci_dev_unlock(hdev);
8582
8583         return err;
8584 }
8585 #endif /* TIZEN_BT */
8586
8587 static bool ltk_is_valid(struct mgmt_ltk_info *key)
8588 {
8589         if (key->initiator != 0x00 && key->initiator != 0x01)
8590                 return false;
8591
8592         switch (key->addr.type) {
8593         case BDADDR_LE_PUBLIC:
8594                 return true;
8595
8596         case BDADDR_LE_RANDOM:
8597                 /* Two most significant bits shall be set */
8598                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
8599                         return false;
8600                 return true;
8601         }
8602
8603         return false;
8604 }
8605
8606 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
8607                                void *cp_data, u16 len)
8608 {
8609         struct mgmt_cp_load_long_term_keys *cp = cp_data;
8610         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
8611                                    sizeof(struct mgmt_ltk_info));
8612         u16 key_count, expected_len;
8613         int i, err;
8614
8615         bt_dev_dbg(hdev, "sock %p", sk);
8616
8617         if (!lmp_le_capable(hdev))
8618                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8619                                        MGMT_STATUS_NOT_SUPPORTED);
8620
8621         key_count = __le16_to_cpu(cp->key_count);
8622         if (key_count > max_key_count) {
8623                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
8624                            key_count);
8625                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8626                                        MGMT_STATUS_INVALID_PARAMS);
8627         }
8628
8629         expected_len = struct_size(cp, keys, key_count);
8630         if (expected_len != len) {
8631                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
8632                            expected_len, len);
8633                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
8634                                        MGMT_STATUS_INVALID_PARAMS);
8635         }
8636
8637         bt_dev_dbg(hdev, "key_count %u", key_count);
8638
8639         for (i = 0; i < key_count; i++) {
8640                 struct mgmt_ltk_info *key = &cp->keys[i];
8641
8642                 if (!ltk_is_valid(key))
8643                         return mgmt_cmd_status(sk, hdev->id,
8644                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
8645                                                MGMT_STATUS_INVALID_PARAMS);
8646         }
8647
8648         hci_dev_lock(hdev);
8649
8650         hci_smp_ltks_clear(hdev);
8651
8652         for (i = 0; i < key_count; i++) {
8653                 struct mgmt_ltk_info *key = &cp->keys[i];
8654                 u8 type, authenticated;
8655                 u8 addr_type = le_addr_type(key->addr.type);
8656
8657                 if (hci_is_blocked_key(hdev,
8658                                        HCI_BLOCKED_KEY_TYPE_LTK,
8659                                        key->val)) {
8660                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
8661                                     &key->addr.bdaddr);
8662                         continue;
8663                 }
8664
8665                 switch (key->type) {
8666                 case MGMT_LTK_UNAUTHENTICATED:
8667                         authenticated = 0x00;
8668                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8669                         break;
8670                 case MGMT_LTK_AUTHENTICATED:
8671                         authenticated = 0x01;
8672                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
8673                         break;
8674                 case MGMT_LTK_P256_UNAUTH:
8675                         authenticated = 0x00;
8676                         type = SMP_LTK_P256;
8677                         break;
8678                 case MGMT_LTK_P256_AUTH:
8679                         authenticated = 0x01;
8680                         type = SMP_LTK_P256;
8681                         break;
8682                 case MGMT_LTK_P256_DEBUG:
8683                         authenticated = 0x00;
8684                         type = SMP_LTK_P256_DEBUG;
8685                         fallthrough;
8686                 default:
8687                         continue;
8688                 }
8689
8690                 /* When using SMP over BR/EDR, the addr type should be set to BREDR */
8691                 if (key->addr.type == BDADDR_BREDR)
8692                         addr_type = BDADDR_BREDR;
8693
8694                 hci_add_ltk(hdev, &key->addr.bdaddr,
8695                             addr_type, type, authenticated,
8696                             key->val, key->enc_size, key->ediv, key->rand);
8697         }
8698
8699         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
8700                            NULL, 0);
8701
8702         hci_dev_unlock(hdev);
8703
8704         return err;
8705 }
8706
8707 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
8708 {
8709         struct mgmt_pending_cmd *cmd = data;
8710         struct hci_conn *conn = cmd->user_data;
8711         struct mgmt_cp_get_conn_info *cp = cmd->param;
8712         struct mgmt_rp_get_conn_info rp;
8713         u8 status;
8714
8715         bt_dev_dbg(hdev, "err %d", err);
8716
8717         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
8718
8719         status = mgmt_status(err);
8720         if (status == MGMT_STATUS_SUCCESS) {
8721                 rp.rssi = conn->rssi;
8722                 rp.tx_power = conn->tx_power;
8723                 rp.max_tx_power = conn->max_tx_power;
8724         } else {
8725                 rp.rssi = HCI_RSSI_INVALID;
8726                 rp.tx_power = HCI_TX_POWER_INVALID;
8727                 rp.max_tx_power = HCI_TX_POWER_INVALID;
8728         }
8729
8730         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
8731                           &rp, sizeof(rp));
8732
8733         mgmt_pending_free(cmd);
8734 }
8735
8736 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
8737 {
8738         struct mgmt_pending_cmd *cmd = data;
8739         struct mgmt_cp_get_conn_info *cp = cmd->param;
8740         struct hci_conn *conn;
8741         int err;
8742         __le16   handle;
8743
8744         /* Make sure we are still connected */
8745         if (cp->addr.type == BDADDR_BREDR)
8746                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8747                                                &cp->addr.bdaddr);
8748         else
8749                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8750
8751         if (!conn || conn->state != BT_CONNECTED)
8752                 return MGMT_STATUS_NOT_CONNECTED;
8753
8754         cmd->user_data = conn;
8755         handle = cpu_to_le16(conn->handle);
8756
8757         /* Refresh RSSI each time */
8758         err = hci_read_rssi_sync(hdev, handle);
8759
8760         /* For LE links TX power does not change thus we don't need to
8761          * query for it once value is known.
8762          */
8763         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
8764                      conn->tx_power == HCI_TX_POWER_INVALID))
8765                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
8766
8767         /* Max TX power needs to be read only once per connection */
8768         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
8769                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
8770
8771         return err;
8772 }
8773
8774 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
8775                          u16 len)
8776 {
8777         struct mgmt_cp_get_conn_info *cp = data;
8778         struct mgmt_rp_get_conn_info rp;
8779         struct hci_conn *conn;
8780         unsigned long conn_info_age;
8781         int err = 0;
8782
8783         bt_dev_dbg(hdev, "sock %p", sk);
8784
8785         memset(&rp, 0, sizeof(rp));
8786         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8787         rp.addr.type = cp->addr.type;
8788
8789         if (!bdaddr_type_is_valid(cp->addr.type))
8790                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8791                                          MGMT_STATUS_INVALID_PARAMS,
8792                                          &rp, sizeof(rp));
8793
8794         hci_dev_lock(hdev);
8795
8796         if (!hdev_is_powered(hdev)) {
8797                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8798                                         MGMT_STATUS_NOT_POWERED, &rp,
8799                                         sizeof(rp));
8800                 goto unlock;
8801         }
8802
8803         if (cp->addr.type == BDADDR_BREDR)
8804                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8805                                                &cp->addr.bdaddr);
8806         else
8807                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8808
8809         if (!conn || conn->state != BT_CONNECTED) {
8810                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8811                                         MGMT_STATUS_NOT_CONNECTED, &rp,
8812                                         sizeof(rp));
8813                 goto unlock;
8814         }
8815
8816         /* To avoid client trying to guess when to poll again for information we
8817          * calculate conn info age as random value between min/max set in hdev.
8818          */
8819         conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age,
8820                                                  hdev->conn_info_max_age - 1);
8821
8822         /* Query controller to refresh cached values if they are too old or were
8823          * never read.
8824          */
8825         if (time_after(jiffies, conn->conn_info_timestamp +
8826                        msecs_to_jiffies(conn_info_age)) ||
8827             !conn->conn_info_timestamp) {
8828                 struct mgmt_pending_cmd *cmd;
8829
8830                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
8831                                        len);
8832                 if (!cmd) {
8833                         err = -ENOMEM;
8834                 } else {
8835                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
8836                                                  cmd, get_conn_info_complete);
8837                 }
8838
8839                 if (err < 0) {
8840                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8841                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
8842
8843                         if (cmd)
8844                                 mgmt_pending_free(cmd);
8845
8846                         goto unlock;
8847                 }
8848
8849                 conn->conn_info_timestamp = jiffies;
8850         } else {
8851                 /* Cache is valid, just reply with values cached in hci_conn */
8852                 rp.rssi = conn->rssi;
8853                 rp.tx_power = conn->tx_power;
8854                 rp.max_tx_power = conn->max_tx_power;
8855
8856                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8857                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8858         }
8859
8860 unlock:
8861         hci_dev_unlock(hdev);
8862         return err;
8863 }
8864
8865 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
8866 {
8867         struct mgmt_pending_cmd *cmd = data;
8868         struct mgmt_cp_get_clock_info *cp = cmd->param;
8869         struct mgmt_rp_get_clock_info rp;
8870         struct hci_conn *conn = cmd->user_data;
8871         u8 status = mgmt_status(err);
8872
8873         bt_dev_dbg(hdev, "err %d", err);
8874
8875         memset(&rp, 0, sizeof(rp));
8876         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8877         rp.addr.type = cp->addr.type;
8878
8879         if (err)
8880                 goto complete;
8881
8882         rp.local_clock = cpu_to_le32(hdev->clock);
8883
8884         if (conn) {
8885                 rp.piconet_clock = cpu_to_le32(conn->clock);
8886                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
8887         }
8888
8889 complete:
8890         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
8891                           sizeof(rp));
8892
8893         mgmt_pending_free(cmd);
8894 }
8895
8896 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
8897 {
8898         struct mgmt_pending_cmd *cmd = data;
8899         struct mgmt_cp_get_clock_info *cp = cmd->param;
8900         struct hci_cp_read_clock hci_cp;
8901         struct hci_conn *conn;
8902
8903         memset(&hci_cp, 0, sizeof(hci_cp));
8904         hci_read_clock_sync(hdev, &hci_cp);
8905
8906         /* Make sure connection still exists */
8907         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
8908         if (!conn || conn->state != BT_CONNECTED)
8909                 return MGMT_STATUS_NOT_CONNECTED;
8910
8911         cmd->user_data = conn;
8912         hci_cp.handle = cpu_to_le16(conn->handle);
8913         hci_cp.which = 0x01; /* Piconet clock */
8914
8915         return hci_read_clock_sync(hdev, &hci_cp);
8916 }
8917
8918 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8919                                                                 u16 len)
8920 {
8921         struct mgmt_cp_get_clock_info *cp = data;
8922         struct mgmt_rp_get_clock_info rp;
8923         struct mgmt_pending_cmd *cmd;
8924         struct hci_conn *conn;
8925         int err;
8926
8927         bt_dev_dbg(hdev, "sock %p", sk);
8928
8929         memset(&rp, 0, sizeof(rp));
8930         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8931         rp.addr.type = cp->addr.type;
8932
8933         if (cp->addr.type != BDADDR_BREDR)
8934                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8935                                          MGMT_STATUS_INVALID_PARAMS,
8936                                          &rp, sizeof(rp));
8937
8938         hci_dev_lock(hdev);
8939
8940         if (!hdev_is_powered(hdev)) {
8941                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8942                                         MGMT_STATUS_NOT_POWERED, &rp,
8943                                         sizeof(rp));
8944                 goto unlock;
8945         }
8946
8947         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8948                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8949                                                &cp->addr.bdaddr);
8950                 if (!conn || conn->state != BT_CONNECTED) {
8951                         err = mgmt_cmd_complete(sk, hdev->id,
8952                                                 MGMT_OP_GET_CLOCK_INFO,
8953                                                 MGMT_STATUS_NOT_CONNECTED,
8954                                                 &rp, sizeof(rp));
8955                         goto unlock;
8956                 }
8957         } else {
8958                 conn = NULL;
8959         }
8960
8961         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8962         if (!cmd)
8963                 err = -ENOMEM;
8964         else
8965                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
8966                                          get_clock_info_complete);
8967
8968         if (err < 0) {
8969                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8970                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
8971
8972                 if (cmd)
8973                         mgmt_pending_free(cmd);
8974         }
8975
8976
8977 unlock:
8978         hci_dev_unlock(hdev);
8979         return err;
8980 }
8981
8982 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8983 {
8984         struct hci_conn *conn;
8985
8986         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8987         if (!conn)
8988                 return false;
8989
8990         if (conn->dst_type != type)
8991                 return false;
8992
8993         if (conn->state != BT_CONNECTED)
8994                 return false;
8995
8996         return true;
8997 }
8998
8999 /* This function requires the caller holds hdev->lock */
9000 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
9001                                u8 addr_type, u8 auto_connect)
9002 {
9003         struct hci_conn_params *params;
9004
9005         params = hci_conn_params_add(hdev, addr, addr_type);
9006         if (!params)
9007                 return -EIO;
9008
9009         if (params->auto_connect == auto_connect)
9010                 return 0;
9011
9012         hci_pend_le_list_del_init(params);
9013
9014         switch (auto_connect) {
9015         case HCI_AUTO_CONN_DISABLED:
9016         case HCI_AUTO_CONN_LINK_LOSS:
9017                 /* If auto connect is being disabled when we're trying to
9018                  * connect to device, keep connecting.
9019                  */
9020                 if (params->explicit_connect)
9021                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
9022                 break;
9023         case HCI_AUTO_CONN_REPORT:
9024                 if (params->explicit_connect)
9025                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
9026                 else
9027                         hci_pend_le_list_add(params, &hdev->pend_le_reports);
9028                 break;
9029         case HCI_AUTO_CONN_DIRECT:
9030         case HCI_AUTO_CONN_ALWAYS:
9031                 if (!is_connected(hdev, addr, addr_type))
9032                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
9033                 break;
9034         }
9035
9036         params->auto_connect = auto_connect;
9037
9038         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
9039                    addr, addr_type, auto_connect);
9040
9041         return 0;
9042 }
9043
9044 static void device_added(struct sock *sk, struct hci_dev *hdev,
9045                          bdaddr_t *bdaddr, u8 type, u8 action)
9046 {
9047         struct mgmt_ev_device_added ev;
9048
9049         bacpy(&ev.addr.bdaddr, bdaddr);
9050         ev.addr.type = type;
9051         ev.action = action;
9052
9053         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
9054 }
9055
9056 static int add_device_sync(struct hci_dev *hdev, void *data)
9057 {
9058         return hci_update_passive_scan_sync(hdev);
9059 }
9060
9061 static int add_device(struct sock *sk, struct hci_dev *hdev,
9062                       void *data, u16 len)
9063 {
9064         struct mgmt_cp_add_device *cp = data;
9065         u8 auto_conn, addr_type;
9066         struct hci_conn_params *params;
9067         int err;
9068         u32 current_flags = 0;
9069         u32 supported_flags;
9070
9071         bt_dev_dbg(hdev, "sock %p", sk);
9072
9073         if (!bdaddr_type_is_valid(cp->addr.type) ||
9074             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
9075                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9076                                          MGMT_STATUS_INVALID_PARAMS,
9077                                          &cp->addr, sizeof(cp->addr));
9078
9079         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
9080                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9081                                          MGMT_STATUS_INVALID_PARAMS,
9082                                          &cp->addr, sizeof(cp->addr));
9083
9084         hci_dev_lock(hdev);
9085
9086         if (cp->addr.type == BDADDR_BREDR) {
9087                 /* Only incoming connections action is supported for now */
9088                 if (cp->action != 0x01) {
9089                         err = mgmt_cmd_complete(sk, hdev->id,
9090                                                 MGMT_OP_ADD_DEVICE,
9091                                                 MGMT_STATUS_INVALID_PARAMS,
9092                                                 &cp->addr, sizeof(cp->addr));
9093                         goto unlock;
9094                 }
9095
9096                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
9097                                                      &cp->addr.bdaddr,
9098                                                      cp->addr.type, 0);
9099                 if (err)
9100                         goto unlock;
9101
9102                 hci_update_scan(hdev);
9103
9104                 goto added;
9105         }
9106
9107         addr_type = le_addr_type(cp->addr.type);
9108
9109         if (cp->action == 0x02)
9110                 auto_conn = HCI_AUTO_CONN_ALWAYS;
9111         else if (cp->action == 0x01)
9112                 auto_conn = HCI_AUTO_CONN_DIRECT;
9113         else
9114                 auto_conn = HCI_AUTO_CONN_REPORT;
9115
9116         /* Kernel internally uses conn_params with resolvable private
9117          * address, but Add Device allows only identity addresses.
9118          * Make sure it is enforced before calling
9119          * hci_conn_params_lookup.
9120          */
9121         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9122                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9123                                         MGMT_STATUS_INVALID_PARAMS,
9124                                         &cp->addr, sizeof(cp->addr));
9125                 goto unlock;
9126         }
9127
9128         /* If the connection parameters don't exist for this device,
9129          * they will be created and configured with defaults.
9130          */
9131         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
9132                                 auto_conn) < 0) {
9133                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9134                                         MGMT_STATUS_FAILED, &cp->addr,
9135                                         sizeof(cp->addr));
9136                 goto unlock;
9137         } else {
9138                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9139                                                 addr_type);
9140                 if (params)
9141                         current_flags = params->flags;
9142         }
9143
9144         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
9145         if (err < 0)
9146                 goto unlock;
9147
9148 added:
9149         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
9150         supported_flags = hdev->conn_flags;
9151         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
9152                              supported_flags, current_flags);
9153
9154         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9155                                 MGMT_STATUS_SUCCESS, &cp->addr,
9156                                 sizeof(cp->addr));
9157
9158 unlock:
9159         hci_dev_unlock(hdev);
9160         return err;
9161 }
9162
9163 static void device_removed(struct sock *sk, struct hci_dev *hdev,
9164                            bdaddr_t *bdaddr, u8 type)
9165 {
9166         struct mgmt_ev_device_removed ev;
9167
9168         bacpy(&ev.addr.bdaddr, bdaddr);
9169         ev.addr.type = type;
9170
9171         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
9172 }
9173
9174 static int remove_device_sync(struct hci_dev *hdev, void *data)
9175 {
9176         return hci_update_passive_scan_sync(hdev);
9177 }
9178
9179 static int remove_device(struct sock *sk, struct hci_dev *hdev,
9180                          void *data, u16 len)
9181 {
9182         struct mgmt_cp_remove_device *cp = data;
9183         int err;
9184
9185         bt_dev_dbg(hdev, "sock %p", sk);
9186
9187         hci_dev_lock(hdev);
9188
9189         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
9190                 struct hci_conn_params *params;
9191                 u8 addr_type;
9192
9193                 if (!bdaddr_type_is_valid(cp->addr.type)) {
9194                         err = mgmt_cmd_complete(sk, hdev->id,
9195                                                 MGMT_OP_REMOVE_DEVICE,
9196                                                 MGMT_STATUS_INVALID_PARAMS,
9197                                                 &cp->addr, sizeof(cp->addr));
9198                         goto unlock;
9199                 }
9200
9201                 if (cp->addr.type == BDADDR_BREDR) {
9202                         err = hci_bdaddr_list_del(&hdev->accept_list,
9203                                                   &cp->addr.bdaddr,
9204                                                   cp->addr.type);
9205                         if (err) {
9206                                 err = mgmt_cmd_complete(sk, hdev->id,
9207                                                         MGMT_OP_REMOVE_DEVICE,
9208                                                         MGMT_STATUS_INVALID_PARAMS,
9209                                                         &cp->addr,
9210                                                         sizeof(cp->addr));
9211                                 goto unlock;
9212                         }
9213
9214                         hci_update_scan(hdev);
9215
9216                         device_removed(sk, hdev, &cp->addr.bdaddr,
9217                                        cp->addr.type);
9218                         goto complete;
9219                 }
9220
9221                 addr_type = le_addr_type(cp->addr.type);
9222
9223                 /* Kernel internally uses conn_params with resolvable private
9224                  * address, but Remove Device allows only identity addresses.
9225                  * Make sure it is enforced before calling
9226                  * hci_conn_params_lookup.
9227                  */
9228                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9229                         err = mgmt_cmd_complete(sk, hdev->id,
9230                                                 MGMT_OP_REMOVE_DEVICE,
9231                                                 MGMT_STATUS_INVALID_PARAMS,
9232                                                 &cp->addr, sizeof(cp->addr));
9233                         goto unlock;
9234                 }
9235
9236                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9237                                                 addr_type);
9238                 if (!params) {
9239                         err = mgmt_cmd_complete(sk, hdev->id,
9240                                                 MGMT_OP_REMOVE_DEVICE,
9241                                                 MGMT_STATUS_INVALID_PARAMS,
9242                                                 &cp->addr, sizeof(cp->addr));
9243                         goto unlock;
9244                 }
9245
9246                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
9247                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
9248                         err = mgmt_cmd_complete(sk, hdev->id,
9249                                                 MGMT_OP_REMOVE_DEVICE,
9250                                                 MGMT_STATUS_INVALID_PARAMS,
9251                                                 &cp->addr, sizeof(cp->addr));
9252                         goto unlock;
9253                 }
9254
9255                 hci_conn_params_free(params);
9256
9257                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
9258         } else {
9259                 struct hci_conn_params *p, *tmp;
9260                 struct bdaddr_list *b, *btmp;
9261
9262                 if (cp->addr.type) {
9263                         err = mgmt_cmd_complete(sk, hdev->id,
9264                                                 MGMT_OP_REMOVE_DEVICE,
9265                                                 MGMT_STATUS_INVALID_PARAMS,
9266                                                 &cp->addr, sizeof(cp->addr));
9267                         goto unlock;
9268                 }
9269
9270                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
9271                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
9272                         list_del(&b->list);
9273                         kfree(b);
9274                 }
9275
9276                 hci_update_scan(hdev);
9277
9278                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
9279                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
9280                                 continue;
9281                         device_removed(sk, hdev, &p->addr, p->addr_type);
9282                         if (p->explicit_connect) {
9283                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
9284                                 continue;
9285                         }
9286                         hci_conn_params_free(p);
9287                 }
9288
9289                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
9290         }
9291
9292         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
9293
9294 complete:
9295         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
9296                                 MGMT_STATUS_SUCCESS, &cp->addr,
9297                                 sizeof(cp->addr));
9298 unlock:
9299         hci_dev_unlock(hdev);
9300         return err;
9301 }
9302
9303 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
9304                            u16 len)
9305 {
9306         struct mgmt_cp_load_conn_param *cp = data;
9307         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
9308                                      sizeof(struct mgmt_conn_param));
9309         u16 param_count, expected_len;
9310         int i;
9311
9312         if (!lmp_le_capable(hdev))
9313                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9314                                        MGMT_STATUS_NOT_SUPPORTED);
9315
9316         param_count = __le16_to_cpu(cp->param_count);
9317         if (param_count > max_param_count) {
9318                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
9319                            param_count);
9320                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9321                                        MGMT_STATUS_INVALID_PARAMS);
9322         }
9323
9324         expected_len = struct_size(cp, params, param_count);
9325         if (expected_len != len) {
9326                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
9327                            expected_len, len);
9328                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
9329                                        MGMT_STATUS_INVALID_PARAMS);
9330         }
9331
9332         bt_dev_dbg(hdev, "param_count %u", param_count);
9333
9334         hci_dev_lock(hdev);
9335
9336         hci_conn_params_clear_disabled(hdev);
9337
9338         for (i = 0; i < param_count; i++) {
9339                 struct mgmt_conn_param *param = &cp->params[i];
9340                 struct hci_conn_params *hci_param;
9341                 u16 min, max, latency, timeout;
9342                 u8 addr_type;
9343
9344                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
9345                            param->addr.type);
9346
9347                 if (param->addr.type == BDADDR_LE_PUBLIC) {
9348                         addr_type = ADDR_LE_DEV_PUBLIC;
9349                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
9350                         addr_type = ADDR_LE_DEV_RANDOM;
9351                 } else {
9352                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9353                         continue;
9354                 }
9355
9356                 min = le16_to_cpu(param->min_interval);
9357                 max = le16_to_cpu(param->max_interval);
9358                 latency = le16_to_cpu(param->latency);
9359                 timeout = le16_to_cpu(param->timeout);
9360
9361                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
9362                            min, max, latency, timeout);
9363
9364                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
9365                         bt_dev_err(hdev, "ignoring invalid connection parameters");
9366                         continue;
9367                 }
9368
9369                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
9370                                                 addr_type);
9371                 if (!hci_param) {
9372                         bt_dev_err(hdev, "failed to add connection parameters");
9373                         continue;
9374                 }
9375
9376                 hci_param->conn_min_interval = min;
9377                 hci_param->conn_max_interval = max;
9378                 hci_param->conn_latency = latency;
9379                 hci_param->supervision_timeout = timeout;
9380         }
9381
9382         hci_dev_unlock(hdev);
9383
9384         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
9385                                  NULL, 0);
9386 }
9387
9388 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
9389                                void *data, u16 len)
9390 {
9391         struct mgmt_cp_set_external_config *cp = data;
9392         bool changed;
9393         int err;
9394
9395         bt_dev_dbg(hdev, "sock %p", sk);
9396
9397         if (hdev_is_powered(hdev))
9398                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9399                                        MGMT_STATUS_REJECTED);
9400
9401         if (cp->config != 0x00 && cp->config != 0x01)
9402                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9403                                          MGMT_STATUS_INVALID_PARAMS);
9404
9405         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
9406                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
9407                                        MGMT_STATUS_NOT_SUPPORTED);
9408
9409         hci_dev_lock(hdev);
9410
9411         if (cp->config)
9412                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
9413         else
9414                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
9415
9416         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
9417         if (err < 0)
9418                 goto unlock;
9419
9420         if (!changed)
9421                 goto unlock;
9422
9423         err = new_options(hdev, sk);
9424
9425         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
9426                 mgmt_index_removed(hdev);
9427
9428                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
9429                         hci_dev_set_flag(hdev, HCI_CONFIG);
9430                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9431
9432                         queue_work(hdev->req_workqueue, &hdev->power_on);
9433                 } else {
9434                         set_bit(HCI_RAW, &hdev->flags);
9435                         mgmt_index_added(hdev);
9436                 }
9437         }
9438
9439 unlock:
9440         hci_dev_unlock(hdev);
9441         return err;
9442 }
9443
9444 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
9445                               void *data, u16 len)
9446 {
9447         struct mgmt_cp_set_public_address *cp = data;
9448         bool changed;
9449         int err;
9450
9451         bt_dev_dbg(hdev, "sock %p", sk);
9452
9453         if (hdev_is_powered(hdev))
9454                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9455                                        MGMT_STATUS_REJECTED);
9456
9457         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
9458                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9459                                        MGMT_STATUS_INVALID_PARAMS);
9460
9461         if (!hdev->set_bdaddr)
9462                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
9463                                        MGMT_STATUS_NOT_SUPPORTED);
9464
9465         hci_dev_lock(hdev);
9466
9467         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
9468         bacpy(&hdev->public_addr, &cp->bdaddr);
9469
9470         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
9471         if (err < 0)
9472                 goto unlock;
9473
9474         if (!changed)
9475                 goto unlock;
9476
9477         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9478                 err = new_options(hdev, sk);
9479
9480         if (is_configured(hdev)) {
9481                 mgmt_index_removed(hdev);
9482
9483                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9484
9485                 hci_dev_set_flag(hdev, HCI_CONFIG);
9486                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9487
9488                 queue_work(hdev->req_workqueue, &hdev->power_on);
9489         }
9490
9491 unlock:
9492         hci_dev_unlock(hdev);
9493         return err;
9494 }
9495
9496 #ifdef TIZEN_BT
9497 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
9498                             u8 name_len)
9499 {
9500         char buf[512];
9501         struct mgmt_ev_device_name_update *ev = (void *)buf;
9502         u16 eir_len = 0;
9503
9504         if (name_len <= 0)
9505                 return -EINVAL;
9506
9507         bacpy(&ev->addr.bdaddr, bdaddr);
9508         ev->addr.type = BDADDR_BREDR;
9509
9510         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9511                                   name_len);
9512
9513         ev->eir_len = cpu_to_le16(eir_len);
9514
9515         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
9516                           sizeof(*ev) + eir_len, NULL);
9517 }
9518 #endif
9519
9520 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
9521                                              int err)
9522 {
9523         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
9524         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
9525         u8 *h192, *r192, *h256, *r256;
9526         struct mgmt_pending_cmd *cmd = data;
9527         struct sk_buff *skb = cmd->skb;
9528         u8 status = mgmt_status(err);
9529         u16 eir_len;
9530
9531         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
9532                 return;
9533
9534         if (!status) {
9535                 if (!skb)
9536                         status = MGMT_STATUS_FAILED;
9537                 else if (IS_ERR(skb))
9538                         status = mgmt_status(PTR_ERR(skb));
9539                 else
9540                         status = mgmt_status(skb->data[0]);
9541         }
9542
9543         bt_dev_dbg(hdev, "status %u", status);
9544
9545         mgmt_cp = cmd->param;
9546
9547         if (status) {
9548                 status = mgmt_status(status);
9549                 eir_len = 0;
9550
9551                 h192 = NULL;
9552                 r192 = NULL;
9553                 h256 = NULL;
9554                 r256 = NULL;
9555         } else if (!bredr_sc_enabled(hdev)) {
9556                 struct hci_rp_read_local_oob_data *rp;
9557
9558                 if (skb->len != sizeof(*rp)) {
9559                         status = MGMT_STATUS_FAILED;
9560                         eir_len = 0;
9561                 } else {
9562                         status = MGMT_STATUS_SUCCESS;
9563                         rp = (void *)skb->data;
9564
9565                         eir_len = 5 + 18 + 18;
9566                         h192 = rp->hash;
9567                         r192 = rp->rand;
9568                         h256 = NULL;
9569                         r256 = NULL;
9570                 }
9571         } else {
9572                 struct hci_rp_read_local_oob_ext_data *rp;
9573
9574                 if (skb->len != sizeof(*rp)) {
9575                         status = MGMT_STATUS_FAILED;
9576                         eir_len = 0;
9577                 } else {
9578                         status = MGMT_STATUS_SUCCESS;
9579                         rp = (void *)skb->data;
9580
9581                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
9582                                 eir_len = 5 + 18 + 18;
9583                                 h192 = NULL;
9584                                 r192 = NULL;
9585                         } else {
9586                                 eir_len = 5 + 18 + 18 + 18 + 18;
9587                                 h192 = rp->hash192;
9588                                 r192 = rp->rand192;
9589                         }
9590
9591                         h256 = rp->hash256;
9592                         r256 = rp->rand256;
9593                 }
9594         }
9595
9596         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
9597         if (!mgmt_rp)
9598                 goto done;
9599
9600         if (eir_len == 0)
9601                 goto send_rsp;
9602
9603         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
9604                                   hdev->dev_class, 3);
9605
9606         if (h192 && r192) {
9607                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9608                                           EIR_SSP_HASH_C192, h192, 16);
9609                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9610                                           EIR_SSP_RAND_R192, r192, 16);
9611         }
9612
9613         if (h256 && r256) {
9614                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9615                                           EIR_SSP_HASH_C256, h256, 16);
9616                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9617                                           EIR_SSP_RAND_R256, r256, 16);
9618         }
9619
9620 send_rsp:
9621         mgmt_rp->type = mgmt_cp->type;
9622         mgmt_rp->eir_len = cpu_to_le16(eir_len);
9623
9624         err = mgmt_cmd_complete(cmd->sk, hdev->id,
9625                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
9626                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
9627         if (err < 0 || status)
9628                 goto done;
9629
9630         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
9631
9632         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9633                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
9634                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
9635 done:
9636         if (skb && !IS_ERR(skb))
9637                 kfree_skb(skb);
9638
9639         kfree(mgmt_rp);
9640         mgmt_pending_remove(cmd);
9641 }
9642
9643 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
9644                                   struct mgmt_cp_read_local_oob_ext_data *cp)
9645 {
9646         struct mgmt_pending_cmd *cmd;
9647         int err;
9648
9649         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
9650                                cp, sizeof(*cp));
9651         if (!cmd)
9652                 return -ENOMEM;
9653
9654         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
9655                                  read_local_oob_ext_data_complete);
9656
9657         if (err < 0) {
9658                 mgmt_pending_remove(cmd);
9659                 return err;
9660         }
9661
9662         return 0;
9663 }
9664
9665 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
9666                                    void *data, u16 data_len)
9667 {
9668         struct mgmt_cp_read_local_oob_ext_data *cp = data;
9669         struct mgmt_rp_read_local_oob_ext_data *rp;
9670         size_t rp_len;
9671         u16 eir_len;
9672         u8 status, flags, role, addr[7], hash[16], rand[16];
9673         int err;
9674
9675         bt_dev_dbg(hdev, "sock %p", sk);
9676
9677         if (hdev_is_powered(hdev)) {
9678                 switch (cp->type) {
9679                 case BIT(BDADDR_BREDR):
9680                         status = mgmt_bredr_support(hdev);
9681                         if (status)
9682                                 eir_len = 0;
9683                         else
9684                                 eir_len = 5;
9685                         break;
9686                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9687                         status = mgmt_le_support(hdev);
9688                         if (status)
9689                                 eir_len = 0;
9690                         else
9691                                 eir_len = 9 + 3 + 18 + 18 + 3;
9692                         break;
9693                 default:
9694                         status = MGMT_STATUS_INVALID_PARAMS;
9695                         eir_len = 0;
9696                         break;
9697                 }
9698         } else {
9699                 status = MGMT_STATUS_NOT_POWERED;
9700                 eir_len = 0;
9701         }
9702
9703         rp_len = sizeof(*rp) + eir_len;
9704         rp = kmalloc(rp_len, GFP_ATOMIC);
9705         if (!rp)
9706                 return -ENOMEM;
9707
9708         if (!status && !lmp_ssp_capable(hdev)) {
9709                 status = MGMT_STATUS_NOT_SUPPORTED;
9710                 eir_len = 0;
9711         }
9712
9713         if (status)
9714                 goto complete;
9715
9716         hci_dev_lock(hdev);
9717
9718         eir_len = 0;
9719         switch (cp->type) {
9720         case BIT(BDADDR_BREDR):
9721                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9722                         err = read_local_ssp_oob_req(hdev, sk, cp);
9723                         hci_dev_unlock(hdev);
9724                         if (!err)
9725                                 goto done;
9726
9727                         status = MGMT_STATUS_FAILED;
9728                         goto complete;
9729                 } else {
9730                         eir_len = eir_append_data(rp->eir, eir_len,
9731                                                   EIR_CLASS_OF_DEV,
9732                                                   hdev->dev_class, 3);
9733                 }
9734                 break;
9735         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9736                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
9737                     smp_generate_oob(hdev, hash, rand) < 0) {
9738                         hci_dev_unlock(hdev);
9739                         status = MGMT_STATUS_FAILED;
9740                         goto complete;
9741                 }
9742
9743                 /* This should return the active RPA, but since the RPA
9744                  * is only programmed on demand, it is really hard to fill
9745                  * this in at the moment. For now disallow retrieving
9746                  * local out-of-band data when privacy is in use.
9747                  *
9748                  * Returning the identity address will not help here since
9749                  * pairing happens before the identity resolving key is
9750                  * known and thus the connection establishment happens
9751                  * based on the RPA and not the identity address.
9752                  */
9753                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
9754                         hci_dev_unlock(hdev);
9755                         status = MGMT_STATUS_REJECTED;
9756                         goto complete;
9757                 }
9758
9759                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
9760                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
9761                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
9762                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
9763                         memcpy(addr, &hdev->static_addr, 6);
9764                         addr[6] = 0x01;
9765                 } else {
9766                         memcpy(addr, &hdev->bdaddr, 6);
9767                         addr[6] = 0x00;
9768                 }
9769
9770                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
9771                                           addr, sizeof(addr));
9772
9773                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
9774                         role = 0x02;
9775                 else
9776                         role = 0x01;
9777
9778                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
9779                                           &role, sizeof(role));
9780
9781                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
9782                         eir_len = eir_append_data(rp->eir, eir_len,
9783                                                   EIR_LE_SC_CONFIRM,
9784                                                   hash, sizeof(hash));
9785
9786                         eir_len = eir_append_data(rp->eir, eir_len,
9787                                                   EIR_LE_SC_RANDOM,
9788                                                   rand, sizeof(rand));
9789                 }
9790
9791                 flags = mgmt_get_adv_discov_flags(hdev);
9792
9793                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9794                         flags |= LE_AD_NO_BREDR;
9795
9796                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
9797                                           &flags, sizeof(flags));
9798                 break;
9799         }
9800
9801         hci_dev_unlock(hdev);
9802
9803         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
9804
9805         status = MGMT_STATUS_SUCCESS;
9806
9807 complete:
9808         rp->type = cp->type;
9809         rp->eir_len = cpu_to_le16(eir_len);
9810
9811         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
9812                                 status, rp, sizeof(*rp) + eir_len);
9813         if (err < 0 || status)
9814                 goto done;
9815
9816         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9817                                  rp, sizeof(*rp) + eir_len,
9818                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
9819
9820 done:
9821         kfree(rp);
9822
9823         return err;
9824 }
9825
9826 static u32 get_supported_adv_flags(struct hci_dev *hdev)
9827 {
9828         u32 flags = 0;
9829
9830         flags |= MGMT_ADV_FLAG_CONNECTABLE;
9831         flags |= MGMT_ADV_FLAG_DISCOV;
9832         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
9833         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
9834         flags |= MGMT_ADV_FLAG_APPEARANCE;
9835         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
9836         flags |= MGMT_ADV_PARAM_DURATION;
9837         flags |= MGMT_ADV_PARAM_TIMEOUT;
9838         flags |= MGMT_ADV_PARAM_INTERVALS;
9839         flags |= MGMT_ADV_PARAM_TX_POWER;
9840         flags |= MGMT_ADV_PARAM_SCAN_RSP;
9841
9842         /* In extended adv TX_POWER returned from Set Adv Param
9843          * will be always valid.
9844          */
9845         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
9846                 flags |= MGMT_ADV_FLAG_TX_POWER;
9847
9848         if (ext_adv_capable(hdev)) {
9849                 flags |= MGMT_ADV_FLAG_SEC_1M;
9850                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
9851                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
9852
9853                 if (le_2m_capable(hdev))
9854                         flags |= MGMT_ADV_FLAG_SEC_2M;
9855
9856                 if (le_coded_capable(hdev))
9857                         flags |= MGMT_ADV_FLAG_SEC_CODED;
9858         }
9859
9860         return flags;
9861 }
9862
9863 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
9864                              void *data, u16 data_len)
9865 {
9866         struct mgmt_rp_read_adv_features *rp;
9867         size_t rp_len;
9868         int err;
9869         struct adv_info *adv_instance;
9870         u32 supported_flags;
9871         u8 *instance;
9872
9873         bt_dev_dbg(hdev, "sock %p", sk);
9874
9875         if (!lmp_le_capable(hdev))
9876                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9877                                        MGMT_STATUS_REJECTED);
9878
9879         hci_dev_lock(hdev);
9880
9881         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
9882         rp = kmalloc(rp_len, GFP_ATOMIC);
9883         if (!rp) {
9884                 hci_dev_unlock(hdev);
9885                 return -ENOMEM;
9886         }
9887
9888         supported_flags = get_supported_adv_flags(hdev);
9889
9890         rp->supported_flags = cpu_to_le32(supported_flags);
9891         rp->max_adv_data_len = max_adv_len(hdev);
9892         rp->max_scan_rsp_len = max_adv_len(hdev);
9893         rp->max_instances = hdev->le_num_of_adv_sets;
9894         rp->num_instances = hdev->adv_instance_cnt;
9895
9896         instance = rp->instance;
9897         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9898                 /* Only instances 1-le_num_of_adv_sets are externally visible */
9899                 if (adv_instance->instance <= hdev->adv_instance_cnt) {
9900                         *instance = adv_instance->instance;
9901                         instance++;
9902                 } else {
9903                         rp->num_instances--;
9904                         rp_len--;
9905                 }
9906         }
9907
9908         hci_dev_unlock(hdev);
9909
9910         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9911                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9912
9913         kfree(rp);
9914
9915         return err;
9916 }
9917
9918 static u8 calculate_name_len(struct hci_dev *hdev)
9919 {
9920         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9921
9922         return eir_append_local_name(hdev, buf, 0);
9923 }
9924
9925 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9926                            bool is_adv_data)
9927 {
9928         u8 max_len = max_adv_len(hdev);
9929
9930         if (is_adv_data) {
9931                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9932                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9933                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9934                         max_len -= 3;
9935
9936                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9937                         max_len -= 3;
9938         } else {
9939                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9940                         max_len -= calculate_name_len(hdev);
9941
9942                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9943                         max_len -= 4;
9944         }
9945
9946         return max_len;
9947 }
9948
9949 static bool flags_managed(u32 adv_flags)
9950 {
9951         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
9952                             MGMT_ADV_FLAG_LIMITED_DISCOV |
9953                             MGMT_ADV_FLAG_MANAGED_FLAGS);
9954 }
9955
9956 static bool tx_power_managed(u32 adv_flags)
9957 {
9958         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
9959 }
9960
9961 static bool name_managed(u32 adv_flags)
9962 {
9963         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
9964 }
9965
9966 static bool appearance_managed(u32 adv_flags)
9967 {
9968         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
9969 }
9970
9971 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
9972                               u8 len, bool is_adv_data)
9973 {
9974         int i, cur_len;
9975         u8 max_len;
9976
9977         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
9978
9979         if (len > max_len)
9980                 return false;
9981
9982         /* Make sure that the data is correctly formatted. */
9983         for (i = 0; i < len; i += (cur_len + 1)) {
9984                 cur_len = data[i];
9985
9986                 if (!cur_len)
9987                         continue;
9988
9989                 if (data[i + 1] == EIR_FLAGS &&
9990                     (!is_adv_data || flags_managed(adv_flags)))
9991                         return false;
9992
9993                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
9994                         return false;
9995
9996                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
9997                         return false;
9998
9999                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
10000                         return false;
10001
10002                 if (data[i + 1] == EIR_APPEARANCE &&
10003                     appearance_managed(adv_flags))
10004                         return false;
10005
10006                 /* If the current field length would exceed the total data
10007                  * length, then it's invalid.
10008                  */
10009                 if (i + cur_len >= len)
10010                         return false;
10011         }
10012
10013         return true;
10014 }
10015
10016 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
10017 {
10018         u32 supported_flags, phy_flags;
10019
10020         /* The current implementation only supports a subset of the specified
10021          * flags. Also need to check mutual exclusiveness of sec flags.
10022          */
10023         supported_flags = get_supported_adv_flags(hdev);
10024         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
10025         if (adv_flags & ~supported_flags ||
10026             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
10027                 return false;
10028
10029         return true;
10030 }
10031
10032 static bool adv_busy(struct hci_dev *hdev)
10033 {
10034         return pending_find(MGMT_OP_SET_LE, hdev);
10035 }
10036
10037 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
10038                              int err)
10039 {
10040         struct adv_info *adv, *n;
10041
10042         bt_dev_dbg(hdev, "err %d", err);
10043
10044         hci_dev_lock(hdev);
10045
10046         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
10047                 u8 instance;
10048
10049                 if (!adv->pending)
10050                         continue;
10051
10052                 if (!err) {
10053                         adv->pending = false;
10054                         continue;
10055                 }
10056
10057                 instance = adv->instance;
10058
10059                 if (hdev->cur_adv_instance == instance)
10060                         cancel_adv_timeout(hdev);
10061
10062                 hci_remove_adv_instance(hdev, instance);
10063                 mgmt_advertising_removed(sk, hdev, instance);
10064         }
10065
10066         hci_dev_unlock(hdev);
10067 }
10068
10069 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
10070 {
10071         struct mgmt_pending_cmd *cmd = data;
10072         struct mgmt_cp_add_advertising *cp = cmd->param;
10073         struct mgmt_rp_add_advertising rp;
10074
10075         memset(&rp, 0, sizeof(rp));
10076
10077         rp.instance = cp->instance;
10078
10079         if (err)
10080                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10081                                 mgmt_status(err));
10082         else
10083                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10084                                   mgmt_status(err), &rp, sizeof(rp));
10085
10086         add_adv_complete(hdev, cmd->sk, cp->instance, err);
10087
10088         mgmt_pending_free(cmd);
10089 }
10090
10091 static int add_advertising_sync(struct hci_dev *hdev, void *data)
10092 {
10093         struct mgmt_pending_cmd *cmd = data;
10094         struct mgmt_cp_add_advertising *cp = cmd->param;
10095
10096         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
10097 }
10098
10099 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
10100                            void *data, u16 data_len)
10101 {
10102         struct mgmt_cp_add_advertising *cp = data;
10103         struct mgmt_rp_add_advertising rp;
10104         u32 flags;
10105         u8 status;
10106         u16 timeout, duration;
10107         unsigned int prev_instance_cnt;
10108         u8 schedule_instance = 0;
10109         struct adv_info *adv, *next_instance;
10110         int err;
10111         struct mgmt_pending_cmd *cmd;
10112
10113         bt_dev_dbg(hdev, "sock %p", sk);
10114
10115         status = mgmt_le_support(hdev);
10116         if (status)
10117                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10118                                        status);
10119
10120         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10121                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10122                                        MGMT_STATUS_INVALID_PARAMS);
10123
10124         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
10125                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10126                                        MGMT_STATUS_INVALID_PARAMS);
10127
10128         flags = __le32_to_cpu(cp->flags);
10129         timeout = __le16_to_cpu(cp->timeout);
10130         duration = __le16_to_cpu(cp->duration);
10131
10132         if (!requested_adv_flags_are_valid(hdev, flags))
10133                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10134                                        MGMT_STATUS_INVALID_PARAMS);
10135
10136         hci_dev_lock(hdev);
10137
10138         if (timeout && !hdev_is_powered(hdev)) {
10139                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10140                                       MGMT_STATUS_REJECTED);
10141                 goto unlock;
10142         }
10143
10144         if (adv_busy(hdev)) {
10145                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10146                                       MGMT_STATUS_BUSY);
10147                 goto unlock;
10148         }
10149
10150         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
10151             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
10152                                cp->scan_rsp_len, false)) {
10153                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10154                                       MGMT_STATUS_INVALID_PARAMS);
10155                 goto unlock;
10156         }
10157
10158         prev_instance_cnt = hdev->adv_instance_cnt;
10159
10160         adv = hci_add_adv_instance(hdev, cp->instance, flags,
10161                                    cp->adv_data_len, cp->data,
10162                                    cp->scan_rsp_len,
10163                                    cp->data + cp->adv_data_len,
10164                                    timeout, duration,
10165                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
10166                                    hdev->le_adv_min_interval,
10167                                    hdev->le_adv_max_interval, 0);
10168         if (IS_ERR(adv)) {
10169                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10170                                       MGMT_STATUS_FAILED);
10171                 goto unlock;
10172         }
10173
10174         /* Only trigger an advertising added event if a new instance was
10175          * actually added.
10176          */
10177         if (hdev->adv_instance_cnt > prev_instance_cnt)
10178                 mgmt_advertising_added(sk, hdev, cp->instance);
10179
10180         if (hdev->cur_adv_instance == cp->instance) {
10181                 /* If the currently advertised instance is being changed then
10182                  * cancel the current advertising and schedule the next
10183                  * instance. If there is only one instance then the overridden
10184                  * advertising data will be visible right away.
10185                  */
10186                 cancel_adv_timeout(hdev);
10187
10188                 next_instance = hci_get_next_instance(hdev, cp->instance);
10189                 if (next_instance)
10190                         schedule_instance = next_instance->instance;
10191         } else if (!hdev->adv_instance_timeout) {
10192                 /* Immediately advertise the new instance if no other
10193                  * instance is currently being advertised.
10194                  */
10195                 schedule_instance = cp->instance;
10196         }
10197
10198         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
10199          * there is no instance to be advertised then we have no HCI
10200          * communication to make. Simply return.
10201          */
10202         if (!hdev_is_powered(hdev) ||
10203             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
10204             !schedule_instance) {
10205                 rp.instance = cp->instance;
10206                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10207                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10208                 goto unlock;
10209         }
10210
10211         /* We're good to go, update advertising data, parameters, and start
10212          * advertising.
10213          */
10214         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
10215                                data_len);
10216         if (!cmd) {
10217                 err = -ENOMEM;
10218                 goto unlock;
10219         }
10220
10221         cp->instance = schedule_instance;
10222
10223         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
10224                                  add_advertising_complete);
10225         if (err < 0)
10226                 mgmt_pending_free(cmd);
10227
10228 unlock:
10229         hci_dev_unlock(hdev);
10230
10231         return err;
10232 }
10233
10234 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
10235                                         int err)
10236 {
10237         struct mgmt_pending_cmd *cmd = data;
10238         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
10239         struct mgmt_rp_add_ext_adv_params rp;
10240         struct adv_info *adv;
10241         u32 flags;
10242
10243         BT_DBG("%s", hdev->name);
10244
10245         hci_dev_lock(hdev);
10246
10247         adv = hci_find_adv_instance(hdev, cp->instance);
10248         if (!adv)
10249                 goto unlock;
10250
10251         rp.instance = cp->instance;
10252         rp.tx_power = adv->tx_power;
10253
10254         /* While we're at it, inform userspace of the available space for this
10255          * advertisement, given the flags that will be used.
10256          */
10257         flags = __le32_to_cpu(cp->flags);
10258         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10259         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10260
10261         if (err) {
10262                 /* If this advertisement was previously advertising and we
10263                  * failed to update it, we signal that it has been removed and
10264                  * delete its structure
10265                  */
10266                 if (!adv->pending)
10267                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
10268
10269                 hci_remove_adv_instance(hdev, cp->instance);
10270
10271                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10272                                 mgmt_status(err));
10273         } else {
10274                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10275                                   mgmt_status(err), &rp, sizeof(rp));
10276         }
10277
10278 unlock:
10279         if (cmd)
10280                 mgmt_pending_free(cmd);
10281
10282         hci_dev_unlock(hdev);
10283 }
10284
10285 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
10286 {
10287         struct mgmt_pending_cmd *cmd = data;
10288         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
10289
10290         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
10291 }
10292
10293 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
10294                               void *data, u16 data_len)
10295 {
10296         struct mgmt_cp_add_ext_adv_params *cp = data;
10297         struct mgmt_rp_add_ext_adv_params rp;
10298         struct mgmt_pending_cmd *cmd = NULL;
10299         struct adv_info *adv;
10300         u32 flags, min_interval, max_interval;
10301         u16 timeout, duration;
10302         u8 status;
10303         s8 tx_power;
10304         int err;
10305
10306         BT_DBG("%s", hdev->name);
10307
10308         status = mgmt_le_support(hdev);
10309         if (status)
10310                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10311                                        status);
10312
10313         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10314                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10315                                        MGMT_STATUS_INVALID_PARAMS);
10316
10317         /* The purpose of breaking add_advertising into two separate MGMT calls
10318          * for params and data is to allow more parameters to be added to this
10319          * structure in the future. For this reason, we verify that we have the
10320          * bare minimum structure we know of when the interface was defined. Any
10321          * extra parameters we don't know about will be ignored in this request.
10322          */
10323         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
10324                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10325                                        MGMT_STATUS_INVALID_PARAMS);
10326
10327         flags = __le32_to_cpu(cp->flags);
10328
10329         if (!requested_adv_flags_are_valid(hdev, flags))
10330                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10331                                        MGMT_STATUS_INVALID_PARAMS);
10332
10333         hci_dev_lock(hdev);
10334
10335         /* In new interface, we require that we are powered to register */
10336         if (!hdev_is_powered(hdev)) {
10337                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10338                                       MGMT_STATUS_REJECTED);
10339                 goto unlock;
10340         }
10341
10342         if (adv_busy(hdev)) {
10343                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10344                                       MGMT_STATUS_BUSY);
10345                 goto unlock;
10346         }
10347
10348         /* Parse defined parameters from request, use defaults otherwise */
10349         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
10350                   __le16_to_cpu(cp->timeout) : 0;
10351
10352         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
10353                    __le16_to_cpu(cp->duration) :
10354                    hdev->def_multi_adv_rotation_duration;
10355
10356         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10357                        __le32_to_cpu(cp->min_interval) :
10358                        hdev->le_adv_min_interval;
10359
10360         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
10361                        __le32_to_cpu(cp->max_interval) :
10362                        hdev->le_adv_max_interval;
10363
10364         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
10365                    cp->tx_power :
10366                    HCI_ADV_TX_POWER_NO_PREFERENCE;
10367
10368         /* Create advertising instance with no advertising or response data */
10369         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
10370                                    timeout, duration, tx_power, min_interval,
10371                                    max_interval, 0);
10372
10373         if (IS_ERR(adv)) {
10374                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
10375                                       MGMT_STATUS_FAILED);
10376                 goto unlock;
10377         }
10378
10379         /* Submit request for advertising params if ext adv available */
10380         if (ext_adv_capable(hdev)) {
10381                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
10382                                        data, data_len);
10383                 if (!cmd) {
10384                         err = -ENOMEM;
10385                         hci_remove_adv_instance(hdev, cp->instance);
10386                         goto unlock;
10387                 }
10388
10389                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
10390                                          add_ext_adv_params_complete);
10391                 if (err < 0)
10392                         mgmt_pending_free(cmd);
10393         } else {
10394                 rp.instance = cp->instance;
10395                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
10396                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10397                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10398                 err = mgmt_cmd_complete(sk, hdev->id,
10399                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
10400                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10401         }
10402
10403 unlock:
10404         hci_dev_unlock(hdev);
10405
10406         return err;
10407 }
10408
10409 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
10410 {
10411         struct mgmt_pending_cmd *cmd = data;
10412         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
10413         struct mgmt_rp_add_advertising rp;
10414
10415         add_adv_complete(hdev, cmd->sk, cp->instance, err);
10416
10417         memset(&rp, 0, sizeof(rp));
10418
10419         rp.instance = cp->instance;
10420
10421         if (err)
10422                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10423                                 mgmt_status(err));
10424         else
10425                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10426                                   mgmt_status(err), &rp, sizeof(rp));
10427
10428         mgmt_pending_free(cmd);
10429 }
10430
10431 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
10432 {
10433         struct mgmt_pending_cmd *cmd = data;
10434         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
10435         int err;
10436
10437         if (ext_adv_capable(hdev)) {
10438                 err = hci_update_adv_data_sync(hdev, cp->instance);
10439                 if (err)
10440                         return err;
10441
10442                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
10443                 if (err)
10444                         return err;
10445
10446                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
10447         }
10448
10449         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
10450 }
10451
10452 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
10453                             u16 data_len)
10454 {
10455         struct mgmt_cp_add_ext_adv_data *cp = data;
10456         struct mgmt_rp_add_ext_adv_data rp;
10457         u8 schedule_instance = 0;
10458         struct adv_info *next_instance;
10459         struct adv_info *adv_instance;
10460         int err = 0;
10461         struct mgmt_pending_cmd *cmd;
10462
10463         BT_DBG("%s", hdev->name);
10464
10465         hci_dev_lock(hdev);
10466
10467         adv_instance = hci_find_adv_instance(hdev, cp->instance);
10468
10469         if (!adv_instance) {
10470                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10471                                       MGMT_STATUS_INVALID_PARAMS);
10472                 goto unlock;
10473         }
10474
10475         /* In new interface, we require that we are powered to register */
10476         if (!hdev_is_powered(hdev)) {
10477                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10478                                       MGMT_STATUS_REJECTED);
10479                 goto clear_new_instance;
10480         }
10481
10482         if (adv_busy(hdev)) {
10483                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10484                                       MGMT_STATUS_BUSY);
10485                 goto clear_new_instance;
10486         }
10487
10488         /* Validate new data */
10489         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
10490                                cp->adv_data_len, true) ||
10491             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
10492                                cp->adv_data_len, cp->scan_rsp_len, false)) {
10493                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10494                                       MGMT_STATUS_INVALID_PARAMS);
10495                 goto clear_new_instance;
10496         }
10497
10498         /* Set the data in the advertising instance */
10499         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
10500                                   cp->data, cp->scan_rsp_len,
10501                                   cp->data + cp->adv_data_len);
10502
10503         /* If using software rotation, determine next instance to use */
10504         if (hdev->cur_adv_instance == cp->instance) {
10505                 /* If the currently advertised instance is being changed
10506                  * then cancel the current advertising and schedule the
10507                  * next instance. If there is only one instance then the
10508                  * overridden advertising data will be visible right
10509                  * away
10510                  */
10511                 cancel_adv_timeout(hdev);
10512
10513                 next_instance = hci_get_next_instance(hdev, cp->instance);
10514                 if (next_instance)
10515                         schedule_instance = next_instance->instance;
10516         } else if (!hdev->adv_instance_timeout) {
10517                 /* Immediately advertise the new instance if no other
10518                  * instance is currently being advertised.
10519                  */
10520                 schedule_instance = cp->instance;
10521         }
10522
10523         /* If the HCI_ADVERTISING flag is set or there is no instance to
10524          * be advertised then we have no HCI communication to make.
10525          * Simply return.
10526          */
10527         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
10528                 if (adv_instance->pending) {
10529                         mgmt_advertising_added(sk, hdev, cp->instance);
10530                         adv_instance->pending = false;
10531                 }
10532                 rp.instance = cp->instance;
10533                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
10534                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10535                 goto unlock;
10536         }
10537
10538         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
10539                                data_len);
10540         if (!cmd) {
10541                 err = -ENOMEM;
10542                 goto clear_new_instance;
10543         }
10544
10545         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
10546                                  add_ext_adv_data_complete);
10547         if (err < 0) {
10548                 mgmt_pending_free(cmd);
10549                 goto clear_new_instance;
10550         }
10551
10552         /* We were successful in updating data, so trigger advertising_added
10553          * event if this is an instance that wasn't previously advertising. If
10554          * a failure occurs in the requests we initiated, we will remove the
10555          * instance again in add_advertising_complete
10556          */
10557         if (adv_instance->pending)
10558                 mgmt_advertising_added(sk, hdev, cp->instance);
10559
10560         goto unlock;
10561
10562 clear_new_instance:
10563         hci_remove_adv_instance(hdev, cp->instance);
10564
10565 unlock:
10566         hci_dev_unlock(hdev);
10567
10568         return err;
10569 }
10570
10571 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
10572                                         int err)
10573 {
10574         struct mgmt_pending_cmd *cmd = data;
10575         struct mgmt_cp_remove_advertising *cp = cmd->param;
10576         struct mgmt_rp_remove_advertising rp;
10577
10578         bt_dev_dbg(hdev, "err %d", err);
10579
10580         memset(&rp, 0, sizeof(rp));
10581         rp.instance = cp->instance;
10582
10583         if (err)
10584                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10585                                 mgmt_status(err));
10586         else
10587                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10588                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10589
10590         mgmt_pending_free(cmd);
10591 }
10592
10593 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
10594 {
10595         struct mgmt_pending_cmd *cmd = data;
10596         struct mgmt_cp_remove_advertising *cp = cmd->param;
10597         int err;
10598
10599         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
10600         if (err)
10601                 return err;
10602
10603         if (list_empty(&hdev->adv_instances))
10604                 err = hci_disable_advertising_sync(hdev);
10605
10606         return err;
10607 }
10608
10609 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
10610                               void *data, u16 data_len)
10611 {
10612         struct mgmt_cp_remove_advertising *cp = data;
10613         struct mgmt_pending_cmd *cmd;
10614         int err;
10615
10616         bt_dev_dbg(hdev, "sock %p", sk);
10617
10618         hci_dev_lock(hdev);
10619
10620         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
10621                 err = mgmt_cmd_status(sk, hdev->id,
10622                                       MGMT_OP_REMOVE_ADVERTISING,
10623                                       MGMT_STATUS_INVALID_PARAMS);
10624                 goto unlock;
10625         }
10626
10627         if (pending_find(MGMT_OP_SET_LE, hdev)) {
10628                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10629                                       MGMT_STATUS_BUSY);
10630                 goto unlock;
10631         }
10632
10633         if (list_empty(&hdev->adv_instances)) {
10634                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10635                                       MGMT_STATUS_INVALID_PARAMS);
10636                 goto unlock;
10637         }
10638
10639         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
10640                                data_len);
10641         if (!cmd) {
10642                 err = -ENOMEM;
10643                 goto unlock;
10644         }
10645
10646         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
10647                                  remove_advertising_complete);
10648         if (err < 0)
10649                 mgmt_pending_free(cmd);
10650
10651 unlock:
10652         hci_dev_unlock(hdev);
10653
10654         return err;
10655 }
10656
10657 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
10658                              void *data, u16 data_len)
10659 {
10660         struct mgmt_cp_get_adv_size_info *cp = data;
10661         struct mgmt_rp_get_adv_size_info rp;
10662         u32 flags, supported_flags;
10663
10664         bt_dev_dbg(hdev, "sock %p", sk);
10665
10666         if (!lmp_le_capable(hdev))
10667                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10668                                        MGMT_STATUS_REJECTED);
10669
10670         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10671                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10672                                        MGMT_STATUS_INVALID_PARAMS);
10673
10674         flags = __le32_to_cpu(cp->flags);
10675
10676         /* The current implementation only supports a subset of the specified
10677          * flags.
10678          */
10679         supported_flags = get_supported_adv_flags(hdev);
10680         if (flags & ~supported_flags)
10681                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10682                                        MGMT_STATUS_INVALID_PARAMS);
10683
10684         rp.instance = cp->instance;
10685         rp.flags = cp->flags;
10686         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10687         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10688
10689         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10690                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10691 }
10692
10693 static const struct hci_mgmt_handler mgmt_handlers[] = {
10694         { NULL }, /* 0x0000 (no command) */
10695         { read_version,            MGMT_READ_VERSION_SIZE,
10696                                                 HCI_MGMT_NO_HDEV |
10697                                                 HCI_MGMT_UNTRUSTED },
10698         { read_commands,           MGMT_READ_COMMANDS_SIZE,
10699                                                 HCI_MGMT_NO_HDEV |
10700                                                 HCI_MGMT_UNTRUSTED },
10701         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
10702                                                 HCI_MGMT_NO_HDEV |
10703                                                 HCI_MGMT_UNTRUSTED },
10704         { read_controller_info,    MGMT_READ_INFO_SIZE,
10705                                                 HCI_MGMT_UNTRUSTED },
10706         { set_powered,             MGMT_SETTING_SIZE },
10707         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
10708         { set_connectable,         MGMT_SETTING_SIZE },
10709         { set_fast_connectable,    MGMT_SETTING_SIZE },
10710         { set_bondable,            MGMT_SETTING_SIZE },
10711         { set_link_security,       MGMT_SETTING_SIZE },
10712         { set_ssp,                 MGMT_SETTING_SIZE },
10713         { set_hs,                  MGMT_SETTING_SIZE },
10714         { set_le,                  MGMT_SETTING_SIZE },
10715         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
10716         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
10717         { add_uuid,                MGMT_ADD_UUID_SIZE },
10718         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
10719         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
10720                                                 HCI_MGMT_VAR_LEN },
10721         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
10722                                                 HCI_MGMT_VAR_LEN },
10723         { disconnect,              MGMT_DISCONNECT_SIZE },
10724         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
10725         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
10726         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
10727         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
10728         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
10729         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
10730         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
10731         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
10732         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
10733         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
10734         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
10735         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
10736         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
10737                                                 HCI_MGMT_VAR_LEN },
10738         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
10739         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
10740         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
10741         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
10742         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
10743         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
10744         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
10745         { set_advertising,         MGMT_SETTING_SIZE },
10746         { set_bredr,               MGMT_SETTING_SIZE },
10747         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
10748         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
10749         { set_secure_conn,         MGMT_SETTING_SIZE },
10750         { set_debug_keys,          MGMT_SETTING_SIZE },
10751         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
10752         { load_irks,               MGMT_LOAD_IRKS_SIZE,
10753                                                 HCI_MGMT_VAR_LEN },
10754         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
10755         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
10756         { add_device,              MGMT_ADD_DEVICE_SIZE },
10757         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
10758         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
10759                                                 HCI_MGMT_VAR_LEN },
10760         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
10761                                                 HCI_MGMT_NO_HDEV |
10762                                                 HCI_MGMT_UNTRUSTED },
10763         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
10764                                                 HCI_MGMT_UNCONFIGURED |
10765                                                 HCI_MGMT_UNTRUSTED },
10766         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
10767                                                 HCI_MGMT_UNCONFIGURED },
10768         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
10769                                                 HCI_MGMT_UNCONFIGURED },
10770         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
10771                                                 HCI_MGMT_VAR_LEN },
10772         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
10773         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
10774                                                 HCI_MGMT_NO_HDEV |
10775                                                 HCI_MGMT_UNTRUSTED },
10776         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
10777         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
10778                                                 HCI_MGMT_VAR_LEN },
10779         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
10780         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
10781         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
10782         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
10783                                                 HCI_MGMT_UNTRUSTED },
10784         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
10785         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
10786         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
10787         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
10788                                                 HCI_MGMT_VAR_LEN },
10789         { set_wideband_speech,     MGMT_SETTING_SIZE },
10790         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
10791                                                 HCI_MGMT_UNTRUSTED },
10792         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
10793                                                 HCI_MGMT_UNTRUSTED |
10794                                                 HCI_MGMT_HDEV_OPTIONAL },
10795         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
10796                                                 HCI_MGMT_VAR_LEN |
10797                                                 HCI_MGMT_HDEV_OPTIONAL },
10798         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
10799                                                 HCI_MGMT_UNTRUSTED },
10800         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
10801                                                 HCI_MGMT_VAR_LEN },
10802         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
10803                                                 HCI_MGMT_UNTRUSTED },
10804         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
10805                                                 HCI_MGMT_VAR_LEN },
10806         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
10807         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
10808         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
10809         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
10810                                                 HCI_MGMT_VAR_LEN },
10811         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
10812         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
10813                                                 HCI_MGMT_VAR_LEN },
10814         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
10815                                                 HCI_MGMT_VAR_LEN },
10816         { add_adv_patterns_monitor_rssi,
10817                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
10818                                                 HCI_MGMT_VAR_LEN },
10819         { set_mesh,                MGMT_SET_MESH_RECEIVER_SIZE,
10820                                                 HCI_MGMT_VAR_LEN },
10821         { mesh_features,           MGMT_MESH_READ_FEATURES_SIZE },
10822         { mesh_send,               MGMT_MESH_SEND_SIZE,
10823                                                 HCI_MGMT_VAR_LEN },
10824         { mesh_send_cancel,        MGMT_MESH_SEND_CANCEL_SIZE },
10825 };
10826
10827 #ifdef TIZEN_BT
10828 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
10829         { NULL }, /* 0x0000 (no command) */
10830         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
10831         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
10832                                                 HCI_MGMT_VAR_LEN },
10833         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
10834                                                 HCI_MGMT_VAR_LEN },
10835         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
10836         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
10837         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
10838         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
10839         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
10840         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
10841         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
10842         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
10843         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
10844 };
10845 #endif
10846
10847 void mgmt_index_added(struct hci_dev *hdev)
10848 {
10849         struct mgmt_ev_ext_index ev;
10850
10851         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10852                 return;
10853
10854         switch (hdev->dev_type) {
10855         case HCI_PRIMARY:
10856                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10857                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
10858                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10859                         ev.type = 0x01;
10860                 } else {
10861                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
10862                                          HCI_MGMT_INDEX_EVENTS);
10863                         ev.type = 0x00;
10864                 }
10865                 break;
10866         case HCI_AMP:
10867                 ev.type = 0x02;
10868                 break;
10869         default:
10870                 return;
10871         }
10872
10873         ev.bus = hdev->bus;
10874
10875         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
10876                          HCI_MGMT_EXT_INDEX_EVENTS);
10877 }
10878
10879 void mgmt_index_removed(struct hci_dev *hdev)
10880 {
10881         struct mgmt_ev_ext_index ev;
10882         u8 status = MGMT_STATUS_INVALID_INDEX;
10883
10884         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10885                 return;
10886
10887         switch (hdev->dev_type) {
10888         case HCI_PRIMARY:
10889                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10890
10891                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10892                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
10893                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10894                         ev.type = 0x01;
10895                 } else {
10896                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
10897                                          HCI_MGMT_INDEX_EVENTS);
10898                         ev.type = 0x00;
10899                 }
10900                 break;
10901         case HCI_AMP:
10902                 ev.type = 0x02;
10903                 break;
10904         default:
10905                 return;
10906         }
10907
10908         ev.bus = hdev->bus;
10909
10910         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
10911                          HCI_MGMT_EXT_INDEX_EVENTS);
10912
10913         /* Cancel any remaining timed work */
10914         if (!hci_dev_test_flag(hdev, HCI_MGMT))
10915                 return;
10916         cancel_delayed_work_sync(&hdev->discov_off);
10917         cancel_delayed_work_sync(&hdev->service_cache);
10918         cancel_delayed_work_sync(&hdev->rpa_expired);
10919 }
10920
10921 void mgmt_power_on(struct hci_dev *hdev, int err)
10922 {
10923         struct cmd_lookup match = { NULL, hdev };
10924
10925         bt_dev_dbg(hdev, "err %d", err);
10926
10927         hci_dev_lock(hdev);
10928
10929         if (!err) {
10930                 restart_le_actions(hdev);
10931                 hci_update_passive_scan(hdev);
10932         }
10933
10934         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10935
10936         new_settings(hdev, match.sk);
10937
10938         if (match.sk)
10939                 sock_put(match.sk);
10940
10941         hci_dev_unlock(hdev);
10942 }
10943
10944 void __mgmt_power_off(struct hci_dev *hdev)
10945 {
10946         struct cmd_lookup match = { NULL, hdev };
10947         u8 status, zero_cod[] = { 0, 0, 0 };
10948
10949         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10950
10951         /* If the power off is because of hdev unregistration let
10952          * use the appropriate INVALID_INDEX status. Otherwise use
10953          * NOT_POWERED. We cover both scenarios here since later in
10954          * mgmt_index_removed() any hci_conn callbacks will have already
10955          * been triggered, potentially causing misleading DISCONNECTED
10956          * status responses.
10957          */
10958         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
10959                 status = MGMT_STATUS_INVALID_INDEX;
10960         else
10961                 status = MGMT_STATUS_NOT_POWERED;
10962
10963         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10964
10965         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
10966                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
10967                                    zero_cod, sizeof(zero_cod),
10968                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10969                 ext_info_changed(hdev, NULL);
10970         }
10971
10972         new_settings(hdev, match.sk);
10973
10974         if (match.sk)
10975                 sock_put(match.sk);
10976 }
10977
10978 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
10979 {
10980         struct mgmt_pending_cmd *cmd;
10981         u8 status;
10982
10983         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10984         if (!cmd)
10985                 return;
10986
10987         if (err == -ERFKILL)
10988                 status = MGMT_STATUS_RFKILLED;
10989         else
10990                 status = MGMT_STATUS_FAILED;
10991
10992         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
10993
10994         mgmt_pending_remove(cmd);
10995 }
10996
10997 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
10998                        bool persistent)
10999 {
11000         struct mgmt_ev_new_link_key ev;
11001
11002         memset(&ev, 0, sizeof(ev));
11003
11004         ev.store_hint = persistent;
11005         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11006         ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
11007         ev.key.type = key->type;
11008         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
11009         ev.key.pin_len = key->pin_len;
11010
11011         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
11012 }
11013
11014 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
11015 {
11016         switch (ltk->type) {
11017         case SMP_LTK:
11018         case SMP_LTK_RESPONDER:
11019                 if (ltk->authenticated)
11020                         return MGMT_LTK_AUTHENTICATED;
11021                 return MGMT_LTK_UNAUTHENTICATED;
11022         case SMP_LTK_P256:
11023                 if (ltk->authenticated)
11024                         return MGMT_LTK_P256_AUTH;
11025                 return MGMT_LTK_P256_UNAUTH;
11026         case SMP_LTK_P256_DEBUG:
11027                 return MGMT_LTK_P256_DEBUG;
11028         }
11029
11030         return MGMT_LTK_UNAUTHENTICATED;
11031 }
11032
11033 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
11034 {
11035         struct mgmt_ev_new_long_term_key ev;
11036
11037         memset(&ev, 0, sizeof(ev));
11038
11039         /* Devices using resolvable or non-resolvable random addresses
11040          * without providing an identity resolving key don't require
11041          * to store long term keys. Their addresses will change the
11042          * next time around.
11043          *
11044          * Only when a remote device provides an identity address
11045          * make sure the long term key is stored. If the remote
11046          * identity is known, the long term keys are internally
11047          * mapped to the identity address. So allow static random
11048          * and public addresses here.
11049          */
11050         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11051             (key->bdaddr.b[5] & 0xc0) != 0xc0)
11052                 ev.store_hint = 0x00;
11053         else
11054                 ev.store_hint = persistent;
11055
11056         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11057         ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
11058         ev.key.type = mgmt_ltk_type(key);
11059         ev.key.enc_size = key->enc_size;
11060         ev.key.ediv = key->ediv;
11061         ev.key.rand = key->rand;
11062
11063         if (key->type == SMP_LTK)
11064                 ev.key.initiator = 1;
11065
11066         /* Make sure we copy only the significant bytes based on the
11067          * encryption key size, and set the rest of the value to zeroes.
11068          */
11069         memcpy(ev.key.val, key->val, key->enc_size);
11070         memset(ev.key.val + key->enc_size, 0,
11071                sizeof(ev.key.val) - key->enc_size);
11072
11073         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
11074 }
11075
11076 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
11077 {
11078         struct mgmt_ev_new_irk ev;
11079
11080         memset(&ev, 0, sizeof(ev));
11081
11082         ev.store_hint = persistent;
11083
11084         bacpy(&ev.rpa, &irk->rpa);
11085         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
11086         ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type);
11087         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
11088
11089         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
11090 }
11091
11092 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
11093                    bool persistent)
11094 {
11095         struct mgmt_ev_new_csrk ev;
11096
11097         memset(&ev, 0, sizeof(ev));
11098
11099         /* Devices using resolvable or non-resolvable random addresses
11100          * without providing an identity resolving key don't require
11101          * to store signature resolving keys. Their addresses will change
11102          * the next time around.
11103          *
11104          * Only when a remote device provides an identity address
11105          * make sure the signature resolving key is stored. So allow
11106          * static random and public addresses here.
11107          */
11108         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11109             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
11110                 ev.store_hint = 0x00;
11111         else
11112                 ev.store_hint = persistent;
11113
11114         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
11115         ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type);
11116         ev.key.type = csrk->type;
11117         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
11118
11119         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
11120 }
11121
11122 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
11123                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
11124                          u16 max_interval, u16 latency, u16 timeout)
11125 {
11126         struct mgmt_ev_new_conn_param ev;
11127
11128         if (!hci_is_identity_address(bdaddr, bdaddr_type))
11129                 return;
11130
11131         memset(&ev, 0, sizeof(ev));
11132         bacpy(&ev.addr.bdaddr, bdaddr);
11133         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
11134         ev.store_hint = store_hint;
11135         ev.min_interval = cpu_to_le16(min_interval);
11136         ev.max_interval = cpu_to_le16(max_interval);
11137         ev.latency = cpu_to_le16(latency);
11138         ev.timeout = cpu_to_le16(timeout);
11139
11140         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
11141 }
11142
11143 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
11144                            u8 *name, u8 name_len)
11145 {
11146         struct sk_buff *skb;
11147         struct mgmt_ev_device_connected *ev;
11148         u16 eir_len = 0;
11149         u32 flags = 0;
11150
11151         /* allocate buff for LE or BR/EDR adv */
11152         if (conn->le_adv_data_len > 0)
11153                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
11154                                      sizeof(*ev) + conn->le_adv_data_len);
11155         else
11156                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
11157                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
11158                                      eir_precalc_len(sizeof(conn->dev_class)));
11159
11160         ev = skb_put(skb, sizeof(*ev));
11161         bacpy(&ev->addr.bdaddr, &conn->dst);
11162         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11163
11164         if (conn->out)
11165                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
11166
11167         ev->flags = __cpu_to_le32(flags);
11168
11169         /* We must ensure that the EIR Data fields are ordered and
11170          * unique. Keep it simple for now and avoid the problem by not
11171          * adding any BR/EDR data to the LE adv.
11172          */
11173         if (conn->le_adv_data_len > 0) {
11174                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
11175                 eir_len = conn->le_adv_data_len;
11176         } else {
11177                 if (name)
11178                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
11179
11180                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
11181                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
11182                                                     conn->dev_class, sizeof(conn->dev_class));
11183         }
11184
11185         ev->eir_len = cpu_to_le16(eir_len);
11186
11187         mgmt_event_skb(skb, NULL);
11188 }
11189
11190 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
11191 {
11192         struct sock **sk = data;
11193
11194         cmd->cmd_complete(cmd, 0);
11195
11196         *sk = cmd->sk;
11197         sock_hold(*sk);
11198
11199         mgmt_pending_remove(cmd);
11200 }
11201
11202 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
11203 {
11204         struct hci_dev *hdev = data;
11205         struct mgmt_cp_unpair_device *cp = cmd->param;
11206
11207         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
11208
11209         cmd->cmd_complete(cmd, 0);
11210         mgmt_pending_remove(cmd);
11211 }
11212
11213 bool mgmt_powering_down(struct hci_dev *hdev)
11214 {
11215         struct mgmt_pending_cmd *cmd;
11216         struct mgmt_mode *cp;
11217
11218         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11219         if (!cmd)
11220                 return false;
11221
11222         cp = cmd->param;
11223         if (!cp->val)
11224                 return true;
11225
11226         return false;
11227 }
11228
11229 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
11230                               u8 link_type, u8 addr_type, u8 reason,
11231                               bool mgmt_connected)
11232 {
11233         struct mgmt_ev_device_disconnected ev;
11234         struct sock *sk = NULL;
11235
11236         /* The connection is still in hci_conn_hash so test for 1
11237          * instead of 0 to know if this is the last one.
11238          */
11239         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11240                 cancel_delayed_work(&hdev->power_off);
11241                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11242         }
11243
11244         if (!mgmt_connected)
11245                 return;
11246
11247         if (link_type != ACL_LINK && link_type != LE_LINK)
11248                 return;
11249
11250         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
11251
11252         bacpy(&ev.addr.bdaddr, bdaddr);
11253         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11254         ev.reason = reason;
11255
11256         /* Report disconnects due to suspend */
11257         if (hdev->suspended)
11258                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
11259
11260         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
11261
11262         if (sk)
11263                 sock_put(sk);
11264
11265         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11266                              hdev);
11267 }
11268
11269 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
11270                             u8 link_type, u8 addr_type, u8 status)
11271 {
11272         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
11273         struct mgmt_cp_disconnect *cp;
11274         struct mgmt_pending_cmd *cmd;
11275
11276         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
11277                              hdev);
11278
11279         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
11280         if (!cmd)
11281                 return;
11282
11283         cp = cmd->param;
11284
11285         if (bacmp(bdaddr, &cp->addr.bdaddr))
11286                 return;
11287
11288         if (cp->addr.type != bdaddr_type)
11289                 return;
11290
11291         cmd->cmd_complete(cmd, mgmt_status(status));
11292         mgmt_pending_remove(cmd);
11293 }
11294
11295 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11296                          u8 addr_type, u8 status)
11297 {
11298         struct mgmt_ev_connect_failed ev;
11299
11300         /* The connection is still in hci_conn_hash so test for 1
11301          * instead of 0 to know if this is the last one.
11302          */
11303         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
11304                 cancel_delayed_work(&hdev->power_off);
11305                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
11306         }
11307
11308         bacpy(&ev.addr.bdaddr, bdaddr);
11309         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11310         ev.status = mgmt_status(status);
11311
11312         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
11313 }
11314
11315 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
11316 {
11317         struct mgmt_ev_pin_code_request ev;
11318
11319         bacpy(&ev.addr.bdaddr, bdaddr);
11320         ev.addr.type = BDADDR_BREDR;
11321         ev.secure = secure;
11322
11323         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
11324 }
11325
11326 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11327                                   u8 status)
11328 {
11329         struct mgmt_pending_cmd *cmd;
11330
11331         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
11332         if (!cmd)
11333                 return;
11334
11335         cmd->cmd_complete(cmd, mgmt_status(status));
11336         mgmt_pending_remove(cmd);
11337 }
11338
11339 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11340                                       u8 status)
11341 {
11342         struct mgmt_pending_cmd *cmd;
11343
11344         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
11345         if (!cmd)
11346                 return;
11347
11348         cmd->cmd_complete(cmd, mgmt_status(status));
11349         mgmt_pending_remove(cmd);
11350 }
11351
11352 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11353                               u8 link_type, u8 addr_type, u32 value,
11354                               u8 confirm_hint)
11355 {
11356         struct mgmt_ev_user_confirm_request ev;
11357
11358         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11359
11360         bacpy(&ev.addr.bdaddr, bdaddr);
11361         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11362         ev.confirm_hint = confirm_hint;
11363         ev.value = cpu_to_le32(value);
11364
11365         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
11366                           NULL);
11367 }
11368
11369 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
11370                               u8 link_type, u8 addr_type)
11371 {
11372         struct mgmt_ev_user_passkey_request ev;
11373
11374         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11375
11376         bacpy(&ev.addr.bdaddr, bdaddr);
11377         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11378
11379         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
11380                           NULL);
11381 }
11382
11383 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11384                                       u8 link_type, u8 addr_type, u8 status,
11385                                       u8 opcode)
11386 {
11387         struct mgmt_pending_cmd *cmd;
11388
11389         cmd = pending_find(opcode, hdev);
11390         if (!cmd)
11391                 return -ENOENT;
11392
11393         cmd->cmd_complete(cmd, mgmt_status(status));
11394         mgmt_pending_remove(cmd);
11395
11396         return 0;
11397 }
11398
11399 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11400                                      u8 link_type, u8 addr_type, u8 status)
11401 {
11402         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11403                                           status, MGMT_OP_USER_CONFIRM_REPLY);
11404 }
11405
11406 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11407                                          u8 link_type, u8 addr_type, u8 status)
11408 {
11409         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11410                                           status,
11411                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
11412 }
11413
11414 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11415                                      u8 link_type, u8 addr_type, u8 status)
11416 {
11417         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11418                                           status, MGMT_OP_USER_PASSKEY_REPLY);
11419 }
11420
11421 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
11422                                          u8 link_type, u8 addr_type, u8 status)
11423 {
11424         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
11425                                           status,
11426                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
11427 }
11428
11429 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
11430                              u8 link_type, u8 addr_type, u32 passkey,
11431                              u8 entered)
11432 {
11433         struct mgmt_ev_passkey_notify ev;
11434
11435         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
11436
11437         bacpy(&ev.addr.bdaddr, bdaddr);
11438         ev.addr.type = link_to_bdaddr(link_type, addr_type);
11439         ev.passkey = __cpu_to_le32(passkey);
11440         ev.entered = entered;
11441
11442         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
11443 }
11444
11445 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
11446 {
11447         struct mgmt_ev_auth_failed ev;
11448         struct mgmt_pending_cmd *cmd;
11449         u8 status = mgmt_status(hci_status);
11450
11451         bacpy(&ev.addr.bdaddr, &conn->dst);
11452         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11453         ev.status = status;
11454
11455         cmd = find_pairing(conn);
11456
11457         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
11458                     cmd ? cmd->sk : NULL);
11459
11460         if (cmd) {
11461                 cmd->cmd_complete(cmd, status);
11462                 mgmt_pending_remove(cmd);
11463         }
11464 }
11465
11466 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
11467 {
11468         struct cmd_lookup match = { NULL, hdev };
11469         bool changed;
11470
11471         if (status) {
11472                 u8 mgmt_err = mgmt_status(status);
11473                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
11474                                      cmd_status_rsp, &mgmt_err);
11475                 return;
11476         }
11477
11478         if (test_bit(HCI_AUTH, &hdev->flags))
11479                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
11480         else
11481                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
11482
11483         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
11484                              &match);
11485
11486         if (changed)
11487                 new_settings(hdev, match.sk);
11488
11489         if (match.sk)
11490                 sock_put(match.sk);
11491 }
11492
11493 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
11494 {
11495         struct cmd_lookup *match = data;
11496
11497         if (match->sk == NULL) {
11498                 match->sk = cmd->sk;
11499                 sock_hold(match->sk);
11500         }
11501 }
11502
11503 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
11504                                     u8 status)
11505 {
11506         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
11507
11508         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
11509         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
11510         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
11511
11512         if (!status) {
11513                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
11514                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11515                 ext_info_changed(hdev, NULL);
11516         }
11517
11518         if (match.sk)
11519                 sock_put(match.sk);
11520 }
11521
11522 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
11523 {
11524         struct mgmt_cp_set_local_name ev;
11525         struct mgmt_pending_cmd *cmd;
11526
11527         if (status)
11528                 return;
11529
11530         memset(&ev, 0, sizeof(ev));
11531         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
11532         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
11533
11534         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
11535         if (!cmd) {
11536                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
11537
11538                 /* If this is a HCI command related to powering on the
11539                  * HCI dev don't send any mgmt signals.
11540                  */
11541                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
11542                         return;
11543         }
11544
11545         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
11546                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
11547         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
11548 }
11549
11550 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
11551 {
11552         int i;
11553
11554         for (i = 0; i < uuid_count; i++) {
11555                 if (!memcmp(uuid, uuids[i], 16))
11556                         return true;
11557         }
11558
11559         return false;
11560 }
11561
11562 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
11563 {
11564         u16 parsed = 0;
11565
11566         while (parsed < eir_len) {
11567                 u8 field_len = eir[0];
11568                 u8 uuid[16];
11569                 int i;
11570
11571                 if (field_len == 0)
11572                         break;
11573
11574                 if (eir_len - parsed < field_len + 1)
11575                         break;
11576
11577                 switch (eir[1]) {
11578                 case EIR_UUID16_ALL:
11579                 case EIR_UUID16_SOME:
11580                         for (i = 0; i + 3 <= field_len; i += 2) {
11581                                 memcpy(uuid, bluetooth_base_uuid, 16);
11582                                 uuid[13] = eir[i + 3];
11583                                 uuid[12] = eir[i + 2];
11584                                 if (has_uuid(uuid, uuid_count, uuids))
11585                                         return true;
11586                         }
11587                         break;
11588                 case EIR_UUID32_ALL:
11589                 case EIR_UUID32_SOME:
11590                         for (i = 0; i + 5 <= field_len; i += 4) {
11591                                 memcpy(uuid, bluetooth_base_uuid, 16);
11592                                 uuid[15] = eir[i + 5];
11593                                 uuid[14] = eir[i + 4];
11594                                 uuid[13] = eir[i + 3];
11595                                 uuid[12] = eir[i + 2];
11596                                 if (has_uuid(uuid, uuid_count, uuids))
11597                                         return true;
11598                         }
11599                         break;
11600                 case EIR_UUID128_ALL:
11601                 case EIR_UUID128_SOME:
11602                         for (i = 0; i + 17 <= field_len; i += 16) {
11603                                 memcpy(uuid, eir + i + 2, 16);
11604                                 if (has_uuid(uuid, uuid_count, uuids))
11605                                         return true;
11606                         }
11607                         break;
11608                 }
11609
11610                 parsed += field_len + 1;
11611                 eir += field_len + 1;
11612         }
11613
11614         return false;
11615 }
11616
11617 static void restart_le_scan(struct hci_dev *hdev)
11618 {
11619         /* If controller is not scanning we are done. */
11620         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
11621                 return;
11622
11623         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
11624                        hdev->discovery.scan_start +
11625                        hdev->discovery.scan_duration))
11626                 return;
11627
11628         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
11629                            DISCOV_LE_RESTART_DELAY);
11630 }
11631
11632 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
11633                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11634 {
11635         /* If a RSSI threshold has been specified, and
11636          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
11637          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
11638          * is set, let it through for further processing, as we might need to
11639          * restart the scan.
11640          *
11641          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
11642          * the results are also dropped.
11643          */
11644         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11645             (rssi == HCI_RSSI_INVALID ||
11646             (rssi < hdev->discovery.rssi &&
11647              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
11648                 return  false;
11649
11650         if (hdev->discovery.uuid_count != 0) {
11651                 /* If a list of UUIDs is provided in filter, results with no
11652                  * matching UUID should be dropped.
11653                  */
11654                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
11655                                    hdev->discovery.uuids) &&
11656                     !eir_has_uuids(scan_rsp, scan_rsp_len,
11657                                    hdev->discovery.uuid_count,
11658                                    hdev->discovery.uuids))
11659                         return false;
11660         }
11661
11662         /* If duplicate filtering does not report RSSI changes, then restart
11663          * scanning to ensure updated result with updated RSSI values.
11664          */
11665         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
11666                 restart_le_scan(hdev);
11667
11668                 /* Validate RSSI value against the RSSI threshold once more. */
11669                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11670                     rssi < hdev->discovery.rssi)
11671                         return false;
11672         }
11673
11674         return true;
11675 }
11676
11677 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
11678                                   bdaddr_t *bdaddr, u8 addr_type)
11679 {
11680         struct mgmt_ev_adv_monitor_device_lost ev;
11681
11682         ev.monitor_handle = cpu_to_le16(handle);
11683         bacpy(&ev.addr.bdaddr, bdaddr);
11684         ev.addr.type = addr_type;
11685
11686         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
11687                    NULL);
11688 }
11689
11690 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
11691                                                struct sk_buff *skb,
11692                                                struct sock *skip_sk,
11693                                                u16 handle)
11694 {
11695         struct sk_buff *advmon_skb;
11696         size_t advmon_skb_len;
11697         __le16 *monitor_handle;
11698
11699         if (!skb)
11700                 return;
11701
11702         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
11703                           sizeof(struct mgmt_ev_device_found)) + skb->len;
11704         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
11705                                     advmon_skb_len);
11706         if (!advmon_skb)
11707                 return;
11708
11709         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
11710          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
11711          * store monitor_handle of the matched monitor.
11712          */
11713         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
11714         *monitor_handle = cpu_to_le16(handle);
11715         skb_put_data(advmon_skb, skb->data, skb->len);
11716
11717         mgmt_event_skb(advmon_skb, skip_sk);
11718 }
11719
11720 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
11721                                           bdaddr_t *bdaddr, bool report_device,
11722                                           struct sk_buff *skb,
11723                                           struct sock *skip_sk)
11724 {
11725         struct monitored_device *dev, *tmp;
11726         bool matched = false;
11727         bool notified = false;
11728
11729         /* We have received the Advertisement Report because:
11730          * 1. the kernel has initiated active discovery
11731          * 2. if not, we have pend_le_reports > 0 in which case we are doing
11732          *    passive scanning
11733          * 3. if none of the above is true, we have one or more active
11734          *    Advertisement Monitor
11735          *
11736          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
11737          * and report ONLY one advertisement per device for the matched Monitor
11738          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
11739          *
11740          * For case 3, since we are not active scanning and all advertisements
11741          * received are due to a matched Advertisement Monitor, report all
11742          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
11743          */
11744         if (report_device && !hdev->advmon_pend_notify) {
11745                 mgmt_event_skb(skb, skip_sk);
11746                 return;
11747         }
11748
11749         hdev->advmon_pend_notify = false;
11750
11751         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
11752                 if (!bacmp(&dev->bdaddr, bdaddr)) {
11753                         matched = true;
11754
11755                         if (!dev->notified) {
11756                                 mgmt_send_adv_monitor_device_found(hdev, skb,
11757                                                                    skip_sk,
11758                                                                    dev->handle);
11759                                 notified = true;
11760                                 dev->notified = true;
11761                         }
11762                 }
11763
11764                 if (!dev->notified)
11765                         hdev->advmon_pend_notify = true;
11766         }
11767
11768         if (!report_device &&
11769             ((matched && !notified) || !msft_monitor_supported(hdev))) {
11770                 /* Handle 0 indicates that we are not active scanning and this
11771                  * is a subsequent advertisement report for an already matched
11772                  * Advertisement Monitor or the controller offloading support
11773                  * is not available.
11774                  */
11775                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
11776         }
11777
11778         if (report_device)
11779                 mgmt_event_skb(skb, skip_sk);
11780         else
11781                 kfree_skb(skb);
11782 }
11783
11784 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
11785                               u8 addr_type, s8 rssi, u32 flags, u8 *eir,
11786                               u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
11787                               u64 instant)
11788 {
11789         struct sk_buff *skb;
11790         struct mgmt_ev_mesh_device_found *ev;
11791         int i, j;
11792
11793         if (!hdev->mesh_ad_types[0])
11794                 goto accepted;
11795
11796         /* Scan for requested AD types */
11797         if (eir_len > 0) {
11798                 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
11799                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
11800                                 if (!hdev->mesh_ad_types[j])
11801                                         break;
11802
11803                                 if (hdev->mesh_ad_types[j] == eir[i + 1])
11804                                         goto accepted;
11805                         }
11806                 }
11807         }
11808
11809         if (scan_rsp_len > 0) {
11810                 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
11811                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
11812                                 if (!hdev->mesh_ad_types[j])
11813                                         break;
11814
11815                                 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
11816                                         goto accepted;
11817                         }
11818                 }
11819         }
11820
11821         return;
11822
11823 accepted:
11824         skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
11825                              sizeof(*ev) + eir_len + scan_rsp_len);
11826         if (!skb)
11827                 return;
11828
11829         ev = skb_put(skb, sizeof(*ev));
11830
11831         bacpy(&ev->addr.bdaddr, bdaddr);
11832         ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
11833         ev->rssi = rssi;
11834         ev->flags = cpu_to_le32(flags);
11835         ev->instant = cpu_to_le64(instant);
11836
11837         if (eir_len > 0)
11838                 /* Copy EIR or advertising data into event */
11839                 skb_put_data(skb, eir, eir_len);
11840
11841         if (scan_rsp_len > 0)
11842                 /* Append scan response data to event */
11843                 skb_put_data(skb, scan_rsp, scan_rsp_len);
11844
11845         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11846
11847         mgmt_event_skb(skb, NULL);
11848 }
11849
11850 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11851                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
11852                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
11853                        u64 instant)
11854 {
11855         struct sk_buff *skb;
11856         struct mgmt_ev_device_found *ev;
11857         bool report_device = hci_discovery_active(hdev);
11858
11859         if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
11860                 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
11861                                   eir, eir_len, scan_rsp, scan_rsp_len,
11862                                   instant);
11863
11864         /* Don't send events for a non-kernel initiated discovery. With
11865          * LE one exception is if we have pend_le_reports > 0 in which
11866          * case we're doing passive scanning and want these events.
11867          */
11868         if (!hci_discovery_active(hdev)) {
11869                 if (link_type == ACL_LINK)
11870                         return;
11871                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
11872                         report_device = true;
11873                 else if (!hci_is_adv_monitoring(hdev))
11874                         return;
11875         }
11876
11877         if (hdev->discovery.result_filtering) {
11878                 /* We are using service discovery */
11879                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
11880                                      scan_rsp_len))
11881                         return;
11882         }
11883
11884         if (hdev->discovery.limited) {
11885                 /* Check for limited discoverable bit */
11886                 if (dev_class) {
11887                         if (!(dev_class[1] & 0x20))
11888                                 return;
11889                 } else {
11890                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
11891                         if (!flags || !(flags[0] & LE_AD_LIMITED))
11892                                 return;
11893                 }
11894         }
11895
11896         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
11897         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
11898                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
11899         if (!skb)
11900                 return;
11901
11902         ev = skb_put(skb, sizeof(*ev));
11903
11904         /* In case of device discovery with BR/EDR devices (pre 1.2), the
11905          * RSSI value was reported as 0 when not available. This behavior
11906          * is kept when using device discovery. This is required for full
11907          * backwards compatibility with the API.
11908          *
11909          * However when using service discovery, the value 127 will be
11910          * returned when the RSSI is not available.
11911          */
11912         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
11913             link_type == ACL_LINK)
11914                 rssi = 0;
11915
11916         bacpy(&ev->addr.bdaddr, bdaddr);
11917         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11918         ev->rssi = rssi;
11919         ev->flags = cpu_to_le32(flags);
11920
11921         if (eir_len > 0)
11922                 /* Copy EIR or advertising data into event */
11923                 skb_put_data(skb, eir, eir_len);
11924
11925         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
11926                 u8 eir_cod[5];
11927
11928                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
11929                                            dev_class, 3);
11930                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
11931         }
11932
11933         if (scan_rsp_len > 0)
11934                 /* Append scan response data to event */
11935                 skb_put_data(skb, scan_rsp, scan_rsp_len);
11936
11937         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11938
11939         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
11940 }
11941
11942 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11943                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
11944 {
11945         struct sk_buff *skb;
11946         struct mgmt_ev_device_found *ev;
11947         u16 eir_len = 0;
11948         u32 flags = 0;
11949
11950         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
11951                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
11952
11953         ev = skb_put(skb, sizeof(*ev));
11954         bacpy(&ev->addr.bdaddr, bdaddr);
11955         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11956         ev->rssi = rssi;
11957
11958         if (name)
11959                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
11960         else
11961                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
11962
11963         ev->eir_len = cpu_to_le16(eir_len);
11964         ev->flags = cpu_to_le32(flags);
11965
11966         mgmt_event_skb(skb, NULL);
11967 }
11968
11969 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
11970 {
11971         struct mgmt_ev_discovering ev;
11972
11973         bt_dev_dbg(hdev, "discovering %u", discovering);
11974
11975         memset(&ev, 0, sizeof(ev));
11976         ev.type = hdev->discovery.type;
11977         ev.discovering = discovering;
11978
11979         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
11980 }
11981
11982 void mgmt_suspending(struct hci_dev *hdev, u8 state)
11983 {
11984         struct mgmt_ev_controller_suspend ev;
11985
11986         ev.suspend_state = state;
11987         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
11988 }
11989
11990 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
11991                    u8 addr_type)
11992 {
11993         struct mgmt_ev_controller_resume ev;
11994
11995         ev.wake_reason = reason;
11996         if (bdaddr) {
11997                 bacpy(&ev.addr.bdaddr, bdaddr);
11998                 ev.addr.type = addr_type;
11999         } else {
12000                 memset(&ev.addr, 0, sizeof(ev.addr));
12001         }
12002
12003         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
12004 }
12005
12006 static struct hci_mgmt_chan chan = {
12007         .channel        = HCI_CHANNEL_CONTROL,
12008         .handler_count  = ARRAY_SIZE(mgmt_handlers),
12009         .handlers       = mgmt_handlers,
12010 #ifdef TIZEN_BT
12011         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
12012         .tizen_handlers = tizen_mgmt_handlers,
12013 #endif
12014         .hdev_init      = mgmt_init_hdev,
12015 };
12016
12017 int mgmt_init(void)
12018 {
12019         return hci_mgmt_chan_register(&chan);
12020 }
12021
12022 void mgmt_exit(void)
12023 {
12024         hci_mgmt_chan_unregister(&chan);
12025 }
12026
12027 void mgmt_cleanup(struct sock *sk)
12028 {
12029         struct mgmt_mesh_tx *mesh_tx;
12030         struct hci_dev *hdev;
12031
12032         read_lock(&hci_dev_list_lock);
12033
12034         list_for_each_entry(hdev, &hci_dev_list, list) {
12035                 do {
12036                         mesh_tx = mgmt_mesh_next(hdev, sk);
12037
12038                         if (mesh_tx)
12039                                 mesh_send_complete(hdev, mesh_tx, true);
12040                 } while (mesh_tx);
12041         }
12042
12043         read_unlock(&hci_dev_list_lock);
12044 }