net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #ifdef CONFIG_TIZEN_WIP
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #include <net/bluetooth/sco.h>
  38 #endif
  39 #include "hci_request.h"
  40 #include "smp.h"
  41
  42 #define MGMT_VERSION    1
  43 #define MGMT_REVISION   8
  44
  45 #ifdef CONFIG_TIZEN_WIP
  46 #ifndef U16_MAX
  47 #define U16_MAX         ((u16)~0U)
  48 #endif
  49 #endif
  50
  51 static const u16 mgmt_commands[] = {
  52         MGMT_OP_READ_INDEX_LIST,
  53         MGMT_OP_READ_INFO,
  54         MGMT_OP_SET_POWERED,
  55         MGMT_OP_SET_DISCOVERABLE,
  56         MGMT_OP_SET_CONNECTABLE,
  57         MGMT_OP_SET_FAST_CONNECTABLE,
  58         MGMT_OP_SET_BONDABLE,
  59         MGMT_OP_SET_LINK_SECURITY,
  60         MGMT_OP_SET_SSP,
  61         MGMT_OP_SET_HS,
  62         MGMT_OP_SET_LE,
  63         MGMT_OP_SET_DEV_CLASS,
  64         MGMT_OP_SET_LOCAL_NAME,
  65         MGMT_OP_ADD_UUID,
  66         MGMT_OP_REMOVE_UUID,
  67         MGMT_OP_LOAD_LINK_KEYS,
  68         MGMT_OP_LOAD_LONG_TERM_KEYS,
  69         MGMT_OP_DISCONNECT,
  70         MGMT_OP_GET_CONNECTIONS,
  71         MGMT_OP_PIN_CODE_REPLY,
  72         MGMT_OP_PIN_CODE_NEG_REPLY,
  73         MGMT_OP_SET_IO_CAPABILITY,
  74         MGMT_OP_PAIR_DEVICE,
  75         MGMT_OP_CANCEL_PAIR_DEVICE,
  76         MGMT_OP_UNPAIR_DEVICE,
  77         MGMT_OP_USER_CONFIRM_REPLY,
  78         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  79         MGMT_OP_USER_PASSKEY_REPLY,
  80         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  81         MGMT_OP_READ_LOCAL_OOB_DATA,
  82         MGMT_OP_ADD_REMOTE_OOB_DATA,
  83         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  84         MGMT_OP_START_DISCOVERY,
  85         MGMT_OP_STOP_DISCOVERY,
  86         MGMT_OP_CONFIRM_NAME,
  87         MGMT_OP_BLOCK_DEVICE,
  88         MGMT_OP_UNBLOCK_DEVICE,
  89         MGMT_OP_SET_DEVICE_ID,
  90         MGMT_OP_SET_ADVERTISING,
  91         MGMT_OP_SET_BREDR,
  92         MGMT_OP_SET_STATIC_ADDRESS,
  93         MGMT_OP_SET_SCAN_PARAMS,
  94         MGMT_OP_SET_SECURE_CONN,
  95         MGMT_OP_SET_DEBUG_KEYS,
  96         MGMT_OP_SET_PRIVACY,
  97         MGMT_OP_LOAD_IRKS,
  98         MGMT_OP_GET_CONN_INFO,
  99         MGMT_OP_GET_CLOCK_INFO,
 100         MGMT_OP_ADD_DEVICE,
 101         MGMT_OP_REMOVE_DEVICE,
 102         MGMT_OP_LOAD_CONN_PARAM,
 103         MGMT_OP_READ_UNCONF_INDEX_LIST,
 104         MGMT_OP_READ_CONFIG_INFO,
 105         MGMT_OP_SET_EXTERNAL_CONFIG,
 106         MGMT_OP_SET_PUBLIC_ADDRESS,
 107         MGMT_OP_START_SERVICE_DISCOVERY,
 108 };
 109
 110 static const u16 mgmt_events[] = {
 111         MGMT_EV_CONTROLLER_ERROR,
 112         MGMT_EV_INDEX_ADDED,
 113         MGMT_EV_INDEX_REMOVED,
 114         MGMT_EV_NEW_SETTINGS,
 115         MGMT_EV_CLASS_OF_DEV_CHANGED,
 116         MGMT_EV_LOCAL_NAME_CHANGED,
 117         MGMT_EV_NEW_LINK_KEY,
 118         MGMT_EV_NEW_LONG_TERM_KEY,
 119         MGMT_EV_DEVICE_CONNECTED,
 120         MGMT_EV_DEVICE_DISCONNECTED,
 121         MGMT_EV_CONNECT_FAILED,
 122         MGMT_EV_PIN_CODE_REQUEST,
 123         MGMT_EV_USER_CONFIRM_REQUEST,
 124         MGMT_EV_USER_PASSKEY_REQUEST,
 125         MGMT_EV_AUTH_FAILED,
 126         MGMT_EV_DEVICE_FOUND,
 127         MGMT_EV_DISCOVERING,
 128         MGMT_EV_DEVICE_BLOCKED,
 129         MGMT_EV_DEVICE_UNBLOCKED,
 130         MGMT_EV_DEVICE_UNPAIRED,
 131         MGMT_EV_PASSKEY_NOTIFY,
 132         MGMT_EV_NEW_IRK,
 133         MGMT_EV_NEW_CSRK,
 134         MGMT_EV_DEVICE_ADDED,
 135         MGMT_EV_DEVICE_REMOVED,
 136         MGMT_EV_NEW_CONN_PARAM,
 137         MGMT_EV_UNCONF_INDEX_ADDED,
 138         MGMT_EV_UNCONF_INDEX_REMOVED,
 139         MGMT_EV_NEW_CONFIG_OPTIONS,
 140 };
 141
 142 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 143
 144 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 145                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 146
 147 struct pending_cmd {
 148         struct list_head list;
 149         u16 opcode;
 150         int index;
 151         void *param;
 152         size_t param_len;
 153         struct sock *sk;
 154         void *user_data;
 155         int (*cmd_complete)(struct pending_cmd *cmd, u8 status);
 156 };
 157
 158 /* HCI to MGMT error code conversion table */
 159 static u8 mgmt_status_table[] = {
 160         MGMT_STATUS_SUCCESS,
 161         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 162         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 163         MGMT_STATUS_FAILED,             /* Hardware Failure */
 164         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 165         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 166         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 167         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 168         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 169         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 170         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 171         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 172         MGMT_STATUS_BUSY,               /* Command Disallowed */
 173         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 174         MGMT_STATUS_REJECTED,           /* Rejected Security */
 175         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 176         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 177         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 179         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 180         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 181         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 182         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 183         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 184         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 185         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 187         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 188         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 189         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 191         MGMT_STATUS_FAILED,             /* Unspecified Error */
 192         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 193         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 194         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 195         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 196         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 197         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 198         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 199         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 200         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 201         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 202         MGMT_STATUS_FAILED,             /* Transaction Collision */
 203         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 204         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 205         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 206         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 207         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 208         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 209         MGMT_STATUS_FAILED,             /* Slot Violation */
 210         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 211         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 212         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 213         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 214         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 215         MGMT_STATUS_BUSY,               /* Controller Busy */
 216         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 217         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 218         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 219         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 220         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 221 };
 222
 223 static u8 mgmt_status(u8 hci_status)
 224 {
 225         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 226                 return mgmt_status_table[hci_status];
 227
 228         return MGMT_STATUS_FAILED;
 229 }
 230
 231 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 232                       struct sock *skip_sk)
 233 {
 234         struct sk_buff *skb;
 235         struct mgmt_hdr *hdr;
 236
 237         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 238         if (!skb)
 239                 return -ENOMEM;
 240
 241         hdr = (void *) skb_put(skb, sizeof(*hdr));
 242         hdr->opcode = cpu_to_le16(event);
 243         if (hdev)
 244                 hdr->index = cpu_to_le16(hdev->id);
 245         else
 246                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 247         hdr->len = cpu_to_le16(data_len);
 248
 249         if (data)
 250                 memcpy(skb_put(skb, data_len), data, data_len);
 251
 252         /* Time stamp */
 253         __net_timestamp(skb);
 254
 255         hci_send_to_control(skb, skip_sk);
 256         kfree_skb(skb);
 257
 258         return 0;
 259 }
 260
 261 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 262 {
 263         struct sk_buff *skb;
 264         struct mgmt_hdr *hdr;
 265         struct mgmt_ev_cmd_status *ev;
 266         int err;
 267
 268         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 269
 270         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 271         if (!skb)
 272                 return -ENOMEM;
 273
 274         hdr = (void *) skb_put(skb, sizeof(*hdr));
 275
 276         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 277         hdr->index = cpu_to_le16(index);
 278         hdr->len = cpu_to_le16(sizeof(*ev));
 279
 280         ev = (void *) skb_put(skb, sizeof(*ev));
 281         ev->status = status;
 282         ev->opcode = cpu_to_le16(cmd);
 283
 284         err = sock_queue_rcv_skb(sk, skb);
 285         if (err < 0)
 286                 kfree_skb(skb);
 287
 288         return err;
 289 }
 290
 291 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 292                         void *rp, size_t rp_len)
 293 {
 294         struct sk_buff *skb;
 295         struct mgmt_hdr *hdr;
 296         struct mgmt_ev_cmd_complete *ev;
 297         int err;
 298
 299         BT_DBG("sock %p", sk);
 300
 301         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 302         if (!skb)
 303                 return -ENOMEM;
 304
 305         hdr = (void *) skb_put(skb, sizeof(*hdr));
 306
 307         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 308         hdr->index = cpu_to_le16(index);
 309         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 310
 311         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 312         ev->opcode = cpu_to_le16(cmd);
 313         ev->status = status;
 314
 315         if (rp)
 316                 memcpy(ev->data, rp, rp_len);
 317
 318         err = sock_queue_rcv_skb(sk, skb);
 319         if (err < 0)
 320                 kfree_skb(skb);
 321
 322         return err;
 323 }
 324
 325 #ifdef CONFIG_TIZEN_WIP
 326 /* BEGIN TIZEN_Bluetooth :: check for le connection update params */
 327 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
 328                                         u16 to_multiplier)
 329 {
 330         u16 max_latency;
 331
 332         if (min > max || min < 6 || max > 3200)
 333                 return -EINVAL;
 334
 335         if (to_multiplier < 10 || to_multiplier > 3200)
 336                 return -EINVAL;
 337
 338         if (max >= to_multiplier * 8)
 339                 return -EINVAL;
 340
 341         max_latency = (to_multiplier * 8 / max) - 1;
 342
 343         if (latency > 499 || latency > max_latency)
 344                 return -EINVAL;
 345
 346         return 0;
 347 }
 348 /* END TIZEN_Bluetooth */
 349 #endif
 350
 351 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 352                         u16 data_len)
 353 {
 354         struct mgmt_rp_read_version rp;
 355
 356         BT_DBG("sock %p", sk);
 357
 358         rp.version = MGMT_VERSION;
 359         rp.revision = cpu_to_le16(MGMT_REVISION);
 360
 361         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 362                             sizeof(rp));
 363 }
 364
 365 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 366                          u16 data_len)
 367 {
 368         struct mgmt_rp_read_commands *rp;
 369         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 370         const u16 num_events = ARRAY_SIZE(mgmt_events);
 371         __le16 *opcode;
 372         size_t rp_size;
 373         int i, err;
 374
 375         BT_DBG("sock %p", sk);
 376
 377         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 378
 379         rp = kmalloc(rp_size, GFP_KERNEL);
 380         if (!rp)
 381                 return -ENOMEM;
 382
 383         rp->num_commands = cpu_to_le16(num_commands);
 384         rp->num_events = cpu_to_le16(num_events);
 385
 386         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 387                 put_unaligned_le16(mgmt_commands[i], opcode);
 388
 389         for (i = 0; i < num_events; i++, opcode++)
 390                 put_unaligned_le16(mgmt_events[i], opcode);
 391
 392         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 393                            rp_size);
 394         kfree(rp);
 395
 396         return err;
 397 }
 398
 399 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 400                            u16 data_len)
 401 {
 402         struct mgmt_rp_read_index_list *rp;
 403         struct hci_dev *d;
 404         size_t rp_len;
 405         u16 count;
 406         int err;
 407
 408         BT_DBG("sock %p", sk);
 409
 410         read_lock(&hci_dev_list_lock);
 411
 412         count = 0;
 413         list_for_each_entry(d, &hci_dev_list, list) {
 414                 if (d->dev_type == HCI_BREDR &&
 415                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 416                         count++;
 417         }
 418
 419         rp_len = sizeof(*rp) + (2 * count);
 420         rp = kmalloc(rp_len, GFP_ATOMIC);
 421         if (!rp) {
 422                 read_unlock(&hci_dev_list_lock);
 423                 return -ENOMEM;
 424         }
 425
 426         count = 0;
 427         list_for_each_entry(d, &hci_dev_list, list) {
 428                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 429                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 430                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 431                         continue;
 432
 433                 /* Devices marked as raw-only are neither configured
 434                  * nor unconfigured controllers.
 435                  */
 436                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 437                         continue;
 438
 439                 if (d->dev_type == HCI_BREDR &&
 440                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 441                         rp->index[count++] = cpu_to_le16(d->id);
 442                         BT_DBG("Added hci%u", d->id);
 443                 }
 444         }
 445
 446         rp->num_controllers = cpu_to_le16(count);
 447         rp_len = sizeof(*rp) + (2 * count);
 448
 449         read_unlock(&hci_dev_list_lock);
 450
 451         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 452                            rp_len);
 453
 454         kfree(rp);
 455
 456         return err;
 457 }
 458
 459 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 460                                   void *data, u16 data_len)
 461 {
 462         struct mgmt_rp_read_unconf_index_list *rp;
 463         struct hci_dev *d;
 464         size_t rp_len;
 465         u16 count;
 466         int err;
 467
 468         BT_DBG("sock %p", sk);
 469
 470         read_lock(&hci_dev_list_lock);
 471
 472         count = 0;
 473         list_for_each_entry(d, &hci_dev_list, list) {
 474                 if (d->dev_type == HCI_BREDR &&
 475                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 476                         count++;
 477         }
 478
 479         rp_len = sizeof(*rp) + (2 * count);
 480         rp = kmalloc(rp_len, GFP_ATOMIC);
 481         if (!rp) {
 482                 read_unlock(&hci_dev_list_lock);
 483                 return -ENOMEM;
 484         }
 485
 486         count = 0;
 487         list_for_each_entry(d, &hci_dev_list, list) {
 488                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 489                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 490                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 491                         continue;
 492
 493                 /* Devices marked as raw-only are neither configured
 494                  * nor unconfigured controllers.
 495                  */
 496                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 497                         continue;
 498
 499                 if (d->dev_type == HCI_BREDR &&
 500                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 501                         rp->index[count++] = cpu_to_le16(d->id);
 502                         BT_DBG("Added hci%u", d->id);
 503                 }
 504         }
 505
 506         rp->num_controllers = cpu_to_le16(count);
 507         rp_len = sizeof(*rp) + (2 * count);
 508
 509         read_unlock(&hci_dev_list_lock);
 510
 511         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 512                            0, rp, rp_len);
 513
 514         kfree(rp);
 515
 516         return err;
 517 }
 518
 519 static bool is_configured(struct hci_dev *hdev)
 520 {
 521         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 522             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 523                 return false;
 524
 525         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 526             !bacmp(&hdev->public_addr, BDADDR_ANY))
 527                 return false;
 528
 529         return true;
 530 }
 531
 532 static __le32 get_missing_options(struct hci_dev *hdev)
 533 {
 534         u32 options = 0;
 535
 536         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 537             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 538                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 539
 540         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 541             !bacmp(&hdev->public_addr, BDADDR_ANY))
 542                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 543
 544         return cpu_to_le32(options);
 545 }
 546
 547 static int new_options(struct hci_dev *hdev, struct sock *skip)
 548 {
 549         __le32 options = get_missing_options(hdev);
 550
 551         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 552                           sizeof(options), skip);
 553 }
 554
 555 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 556 {
 557         __le32 options = get_missing_options(hdev);
 558
 559         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 560                             sizeof(options));
 561 }
 562
 563 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 564                             void *data, u16 data_len)
 565 {
 566         struct mgmt_rp_read_config_info rp;
 567         u32 options = 0;
 568
 569         BT_DBG("sock %p %s", sk, hdev->name);
 570
 571         hci_dev_lock(hdev);
 572
 573         memset(&rp, 0, sizeof(rp));
 574         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 575
 576         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 577                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 578
 579         if (hdev->set_bdaddr)
 580                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 581
 582         rp.supported_options = cpu_to_le32(options);
 583         rp.missing_options = get_missing_options(hdev);
 584
 585         hci_dev_unlock(hdev);
 586
 587         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 588                             sizeof(rp));
 589 }
 590
 591 static u32 get_supported_settings(struct hci_dev *hdev)
 592 {
 593         u32 settings = 0;
 594
 595         settings |= MGMT_SETTING_POWERED;
 596         settings |= MGMT_SETTING_BONDABLE;
 597 /* Disable Debug keys implementation now */
 598 #ifdef CONFIG_TIZEN_WIP
 599         settings |= MGMT_SETTING_DEBUG_KEYS;
 600 #endif
 601         settings |= MGMT_SETTING_CONNECTABLE;
 602         settings |= MGMT_SETTING_DISCOVERABLE;
 603
 604         if (lmp_bredr_capable(hdev)) {
 605                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 606                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 607                 settings |= MGMT_SETTING_BREDR;
 608                 settings |= MGMT_SETTING_LINK_SECURITY;
 609
 610                 if (lmp_ssp_capable(hdev)) {
 611                         settings |= MGMT_SETTING_SSP;
 612                         settings |= MGMT_SETTING_HS;
 613                 }
 614
 615 /* Disable Secure connection implementation now */
 616 #ifdef CONFIG_TIZEN_WIP
 617                 if (lmp_sc_capable(hdev) ||
 618                     test_bit(HCI_FORCE_BREDR_SMP, &hdev->dbg_flags))
 619                         settings |= MGMT_SETTING_SECURE_CONN;
 620 #endif
 621         }
 622
 623         if (lmp_le_capable(hdev)) {
 624                 settings |= MGMT_SETTING_LE;
 625                 settings |= MGMT_SETTING_ADVERTISING;
 626                 settings |= MGMT_SETTING_SECURE_CONN;
 627                 settings |= MGMT_SETTING_PRIVACY;
 628         }
 629
 630         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 631             hdev->set_bdaddr)
 632                 settings |= MGMT_SETTING_CONFIGURATION;
 633
 634         return settings;
 635 }
 636
 637 static u32 get_current_settings(struct hci_dev *hdev)
 638 {
 639         u32 settings = 0;
 640
 641         if (hdev_is_powered(hdev))
 642                 settings |= MGMT_SETTING_POWERED;
 643
 644         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 645                 settings |= MGMT_SETTING_CONNECTABLE;
 646
 647         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 648                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 649
 650         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 651                 settings |= MGMT_SETTING_DISCOVERABLE;
 652
 653         if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
 654                 settings |= MGMT_SETTING_BONDABLE;
 655
 656         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 657                 settings |= MGMT_SETTING_BREDR;
 658
 659         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 660                 settings |= MGMT_SETTING_LE;
 661
 662         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 663                 settings |= MGMT_SETTING_LINK_SECURITY;
 664
 665         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 666                 settings |= MGMT_SETTING_SSP;
 667
 668         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 669                 settings |= MGMT_SETTING_HS;
 670
 671         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 672                 settings |= MGMT_SETTING_ADVERTISING;
 673
 674 /* Disable Secure connection and debug keys implementation now */
 675 #ifdef CONFIG_TIZEN_WIP
 676         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 677                 settings |= MGMT_SETTING_SECURE_CONN;
 678
 679         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 680                 settings |= MGMT_SETTING_DEBUG_KEYS;
 681 #endif
 682
 683         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 684                 settings |= MGMT_SETTING_PRIVACY;
 685
 686         return settings;
 687 }
 688
 689 #define PNP_INFO_SVCLASS_ID             0x1200
 690
 691 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 692 {
 693         u8 *ptr = data, *uuids_start = NULL;
 694         struct bt_uuid *uuid;
 695
 696         if (len < 4)
 697                 return ptr;
 698
 699         list_for_each_entry(uuid, &hdev->uuids, list) {
 700                 u16 uuid16;
 701
 702                 if (uuid->size != 16)
 703                         continue;
 704
 705                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 706                 if (uuid16 < 0x1100)
 707                         continue;
 708
 709                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 710                         continue;
 711
 712                 if (!uuids_start) {
 713                         uuids_start = ptr;
 714                         uuids_start[0] = 1;
 715                         uuids_start[1] = EIR_UUID16_ALL;
 716                         ptr += 2;
 717                 }
 718
 719                 /* Stop if not enough space to put next UUID */
 720                 if ((ptr - data) + sizeof(u16) > len) {
 721                         uuids_start[1] = EIR_UUID16_SOME;
 722                         break;
 723                 }
 724
 725                 *ptr++ = (uuid16 & 0x00ff);
 726                 *ptr++ = (uuid16 & 0xff00) >> 8;
 727                 uuids_start[0] += sizeof(uuid16);
 728         }
 729
 730         return ptr;
 731 }
 732
 733 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 734 {
 735         u8 *ptr = data, *uuids_start = NULL;
 736         struct bt_uuid *uuid;
 737
 738         if (len < 6)
 739                 return ptr;
 740
 741         list_for_each_entry(uuid, &hdev->uuids, list) {
 742                 if (uuid->size != 32)
 743                         continue;
 744
 745                 if (!uuids_start) {
 746                         uuids_start = ptr;
 747                         uuids_start[0] = 1;
 748                         uuids_start[1] = EIR_UUID32_ALL;
 749                         ptr += 2;
 750                 }
 751
 752                 /* Stop if not enough space to put next UUID */
 753                 if ((ptr - data) + sizeof(u32) > len) {
 754                         uuids_start[1] = EIR_UUID32_SOME;
 755                         break;
 756                 }
 757
 758                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 759                 ptr += sizeof(u32);
 760                 uuids_start[0] += sizeof(u32);
 761         }
 762
 763         return ptr;
 764 }
 765
 766 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 767 {
 768         u8 *ptr = data, *uuids_start = NULL;
 769         struct bt_uuid *uuid;
 770
 771         if (len < 18)
 772                 return ptr;
 773
 774         list_for_each_entry(uuid, &hdev->uuids, list) {
 775                 if (uuid->size != 128)
 776                         continue;
 777
 778                 if (!uuids_start) {
 779                         uuids_start = ptr;
 780                         uuids_start[0] = 1;
 781                         uuids_start[1] = EIR_UUID128_ALL;
 782                         ptr += 2;
 783                 }
 784
 785                 /* Stop if not enough space to put next UUID */
 786                 if ((ptr - data) + 16 > len) {
 787                         uuids_start[1] = EIR_UUID128_SOME;
 788                         break;
 789                 }
 790
 791                 memcpy(ptr, uuid->uuid, 16);
 792                 ptr += 16;
 793                 uuids_start[0] += 16;
 794         }
 795
 796         return ptr;
 797 }
 798
 799 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 800 {
 801         struct pending_cmd *cmd;
 802
 803         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 804                 if (cmd->opcode == opcode)
 805                         return cmd;
 806         }
 807
 808         return NULL;
 809 }
 810
 811 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 812                                                   struct hci_dev *hdev,
 813                                                   const void *data)
 814 {
 815         struct pending_cmd *cmd;
 816
 817         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 818                 if (cmd->user_data != data)
 819                         continue;
 820                 if (cmd->opcode == opcode)
 821                         return cmd;
 822         }
 823
 824         return NULL;
 825 }
 826
 827 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 828 {
 829         u8 ad_len = 0;
 830         size_t name_len;
 831
 832         name_len = strlen(hdev->dev_name);
 833         if (name_len > 0) {
 834                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 835
 836                 if (name_len > max_len) {
 837                         name_len = max_len;
 838                         ptr[1] = EIR_NAME_SHORT;
 839                 } else
 840                         ptr[1] = EIR_NAME_COMPLETE;
 841
 842                 ptr[0] = name_len + 1;
 843
 844                 memcpy(ptr + 2, hdev->dev_name, name_len);
 845
 846                 ad_len += (name_len + 2);
 847                 ptr += (name_len + 2);
 848         }
 849
 850         return ad_len;
 851 }
 852
 853 static void update_scan_rsp_data(struct hci_request *req)
 854 {
 855         struct hci_dev *hdev = req->hdev;
 856         struct hci_cp_le_set_scan_rsp_data cp;
 857         u8 len;
 858
 859         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 860                 return;
 861
 862         memset(&cp, 0, sizeof(cp));
 863
 864         len = create_scan_rsp_data(hdev, cp.data);
 865
 866 #ifdef  CONFIG_TIZEN_WIP
 867         /* Advertising scan response data is handled in bluez.
 868               This value will be updated only when application request the update */
 869         return;
 870 #else
 871         if (hdev->scan_rsp_data_len == len &&
 872             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 873                 return;
 874
 875         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 876         hdev->scan_rsp_data_len = len;
 877
 878         cp.length = len;
 879
 880         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 881 #endif
 882 }
 883
 884 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 885 {
 886         struct pending_cmd *cmd;
 887
 888         /* If there's a pending mgmt command the flags will not yet have
 889          * their final values, so check for this first.
 890          */
 891         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 892         if (cmd) {
 893                 struct mgmt_mode *cp = cmd->param;
 894                 if (cp->val == 0x01)
 895                         return LE_AD_GENERAL;
 896                 else if (cp->val == 0x02)
 897                         return LE_AD_LIMITED;
 898         } else {
 899                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 900                         return LE_AD_LIMITED;
 901                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 902                         return LE_AD_GENERAL;
 903         }
 904
 905         return 0;
 906 }
 907
 908 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 909 {
 910         u8 ad_len = 0, flags = 0;
 911
 912         flags |= get_adv_discov_flags(hdev);
 913
 914         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 915                 flags |= LE_AD_NO_BREDR;
 916
 917         if (flags) {
 918                 BT_DBG("adv flags 0x%02x", flags);
 919
 920                 ptr[0] = 2;
 921                 ptr[1] = EIR_FLAGS;
 922                 ptr[2] = flags;
 923
 924                 ad_len += 3;
 925                 ptr += 3;
 926         }
 927
 928         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 929                 ptr[0] = 2;
 930                 ptr[1] = EIR_TX_POWER;
 931                 ptr[2] = (u8) hdev->adv_tx_power;
 932
 933                 ad_len += 3;
 934                 ptr += 3;
 935         }
 936
 937         return ad_len;
 938 }
 939
 940 static void update_adv_data(struct hci_request *req)
 941 {
 942         struct hci_dev *hdev = req->hdev;
 943         struct hci_cp_le_set_adv_data cp;
 944         u8 len;
 945
 946         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 947                 return;
 948
 949         memset(&cp, 0, sizeof(cp));
 950
 951         len = create_adv_data(hdev, cp.data);
 952
 953 #ifdef  CONFIG_TIZEN_WIP
 954         /* Bluez will handle the advertising data, including the flag and tx power.
 955             This value will be updated only when application request the update */
 956                 return;
 957 #else
 958         if (hdev->adv_data_len == len &&
 959             memcmp(cp.data, hdev->adv_data, len) == 0)
 960                 return;
 961
 962         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 963         hdev->adv_data_len = len;
 964
 965         cp.length = len;
 966
 967         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 968 #endif
 969 }
 970
 971 int mgmt_update_adv_data(struct hci_dev *hdev)
 972 {
 973         struct hci_request req;
 974
 975         hci_req_init(&req, hdev);
 976         update_adv_data(&req);
 977
 978         return hci_req_run(&req, NULL);
 979 }
 980
 981 static void create_eir(struct hci_dev *hdev, u8 *data)
 982 {
 983         u8 *ptr = data;
 984         size_t name_len;
 985
 986         name_len = strlen(hdev->dev_name);
 987
 988         if (name_len > 0) {
 989                 /* EIR Data type */
 990                 if (name_len > 48) {
 991                         name_len = 48;
 992                         ptr[1] = EIR_NAME_SHORT;
 993                 } else
 994                         ptr[1] = EIR_NAME_COMPLETE;
 995
 996                 /* EIR Data length */
 997                 ptr[0] = name_len + 1;
 998
 999                 memcpy(ptr + 2, hdev->dev_name, name_len);
1000
1001                 ptr += (name_len + 2);
1002         }
1003
1004         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
1005                 ptr[0] = 2;
1006                 ptr[1] = EIR_TX_POWER;
1007                 ptr[2] = (u8) hdev->inq_tx_power;
1008
1009                 ptr += 3;
1010         }
1011
1012         if (hdev->devid_source > 0) {
1013                 ptr[0] = 9;
1014                 ptr[1] = EIR_DEVICE_ID;
1015
1016                 put_unaligned_le16(hdev->devid_source, ptr + 2);
1017                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1018                 put_unaligned_le16(hdev->devid_product, ptr + 6);
1019                 put_unaligned_le16(hdev->devid_version, ptr + 8);
1020
1021                 ptr += 10;
1022         }
1023
1024         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1025         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1026         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1027 #ifdef CONFIG_TIZEN_WIP
1028         if (hdev->manufacturer_len > 0 &&
1029                         ptr - data + hdev->manufacturer_len + 2 <= HCI_MAX_EIR_LENGTH) {
1030                 ptr[0] = hdev->manufacturer_len + 1;
1031                 ptr[1] = EIR_MANUFACTURER_DATA;
1032                 memcpy(ptr + 2, hdev->manufacturer_data, hdev->manufacturer_len);
1033                 ptr += hdev->manufacturer_len + 2;
1034         }
1035 #endif
1036 }
1037
1038 static void update_eir(struct hci_request *req)
1039 {
1040         struct hci_dev *hdev = req->hdev;
1041         struct hci_cp_write_eir cp;
1042
1043         if (!hdev_is_powered(hdev))
1044                 return;
1045
1046         if (!lmp_ext_inq_capable(hdev))
1047                 return;
1048
1049         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1050                 return;
1051
1052         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1053                 return;
1054
1055         memset(&cp, 0, sizeof(cp));
1056
1057         create_eir(hdev, cp.data);
1058
1059         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
1060                 return;
1061
1062         memcpy(hdev->eir, cp.data, sizeof(cp.data));
1063
1064         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1065 }
1066
1067 static u8 get_service_classes(struct hci_dev *hdev)
1068 {
1069         struct bt_uuid *uuid;
1070         u8 val = 0;
1071
1072         list_for_each_entry(uuid, &hdev->uuids, list)
1073                 val |= uuid->svc_hint;
1074
1075         return val;
1076 }
1077
1078 static void update_class(struct hci_request *req)
1079 {
1080         struct hci_dev *hdev = req->hdev;
1081         u8 cod[3];
1082
1083         BT_DBG("%s", hdev->name);
1084
1085         if (!hdev_is_powered(hdev))
1086                 return;
1087
1088         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1089                 return;
1090
1091         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1092                 return;
1093
1094         cod[0] = hdev->minor_class;
1095         cod[1] = hdev->major_class;
1096         cod[2] = get_service_classes(hdev);
1097
1098         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1099                 cod[1] |= 0x20;
1100
1101         if (memcmp(cod, hdev->dev_class, 3) == 0)
1102                 return;
1103
1104         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1105 }
1106
1107 #ifndef CONFIG_TIZEN_WIP
1108 static bool get_connectable(struct hci_dev *hdev)
1109 {
1110         struct pending_cmd *cmd;
1111
1112         /* If there's a pending mgmt command the flag will not yet have
1113          * it's final value, so check for this first.
1114          */
1115         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1116         if (cmd) {
1117                 struct mgmt_mode *cp = cmd->param;
1118                 return cp->val;
1119         }
1120
1121         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1122 }
1123 #endif
1124
1125 static void disable_advertising(struct hci_request *req)
1126 {
1127         u8 enable = 0x00;
1128
1129         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1130 }
1131
1132 static void enable_advertising(struct hci_request *req)
1133 {
1134         struct hci_dev *hdev = req->hdev;
1135         struct hci_cp_le_set_adv_param cp;
1136 #ifndef CONFIG_TIZEN_WIP
1137         u8 own_addr_type, enable = 0x01;
1138         bool connectable;
1139 #else
1140         u8 own_addr_type = ADDR_LE_DEV_PUBLIC;
1141         u8 enable = 0x01;
1142 #endif
1143
1144         if (hci_conn_num(hdev, LE_LINK) > 0)
1145                 return;
1146
1147         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1148                 disable_advertising(req);
1149
1150         /* Clear the HCI_LE_ADV bit temporarily so that the
1151          * hci_update_random_address knows that it's safe to go ahead
1152          * and write a new random address. The flag will be set back on
1153          * as soon as the SET_ADV_ENABLE HCI command completes.
1154          */
1155         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1156
1157 #ifndef CONFIG_TIZEN_WIP
1158         connectable = get_connectable(hdev);
1159
1160         /* Set require_privacy to true only when non-connectable
1161          * advertising is used. In that case it is fine to use a
1162          * non-resolvable private address.
1163          */
1164         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1165                 return;
1166 #endif
1167
1168         memset(&cp, 0, sizeof(cp));
1169         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1170         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1171 #ifdef CONFIG_TIZEN_WIP
1172         cp.filter_policy = hdev->adv_filter_policy;
1173         cp.type = hdev->adv_type;
1174 #else
1175         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1176 #endif
1177         cp.own_address_type = own_addr_type;
1178         cp.channel_map = hdev->le_adv_channel_map;
1179
1180         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1181
1182         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1183 }
1184
1185 static void service_cache_off(struct work_struct *work)
1186 {
1187         struct hci_dev *hdev = container_of(work, struct hci_dev,
1188                                             service_cache.work);
1189         struct hci_request req;
1190
1191         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1192                 return;
1193
1194         hci_req_init(&req, hdev);
1195
1196         hci_dev_lock(hdev);
1197
1198         update_eir(&req);
1199         update_class(&req);
1200
1201         hci_dev_unlock(hdev);
1202
1203         hci_req_run(&req, NULL);
1204 }
1205
1206 static void rpa_expired(struct work_struct *work)
1207 {
1208         struct hci_dev *hdev = container_of(work, struct hci_dev,
1209                                             rpa_expired.work);
1210         struct hci_request req;
1211
1212         BT_DBG("");
1213
1214         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1215
1216         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1217                 return;
1218
1219         /* The generation of a new RPA and programming it into the
1220          * controller happens in the enable_advertising() function.
1221          */
1222         hci_req_init(&req, hdev);
1223         enable_advertising(&req);
1224         hci_req_run(&req, NULL);
1225 }
1226
1227 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1228 {
1229         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1230                 return;
1231
1232         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1233         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1234
1235         /* Non-mgmt controlled devices get this bit set
1236          * implicitly so that pairing works for them, however
1237          * for mgmt we require user-space to explicitly enable
1238          * it
1239          */
1240         clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1241 }
1242
1243 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1244                                 void *data, u16 data_len)
1245 {
1246         struct mgmt_rp_read_info rp;
1247
1248         BT_DBG("sock %p %s", sk, hdev->name);
1249
1250         hci_dev_lock(hdev);
1251
1252         memset(&rp, 0, sizeof(rp));
1253
1254         bacpy(&rp.bdaddr, &hdev->bdaddr);
1255
1256         rp.version = hdev->hci_ver;
1257         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1258
1259         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1260         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1261
1262         memcpy(rp.dev_class, hdev->dev_class, 3);
1263
1264         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1265         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1266
1267         hci_dev_unlock(hdev);
1268
1269         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1270                             sizeof(rp));
1271 }
1272
1273 static void mgmt_pending_free(struct pending_cmd *cmd)
1274 {
1275         sock_put(cmd->sk);
1276         kfree(cmd->param);
1277         kfree(cmd);
1278 }
1279
1280 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1281                                             struct hci_dev *hdev, void *data,
1282                                             u16 len)
1283 {
1284         struct pending_cmd *cmd;
1285
1286         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1287         if (!cmd)
1288                 return NULL;
1289
1290         cmd->opcode = opcode;
1291         cmd->index = hdev->id;
1292
1293         cmd->param = kmemdup(data, len, GFP_KERNEL);
1294         if (!cmd->param) {
1295                 kfree(cmd);
1296                 return NULL;
1297         }
1298
1299         cmd->param_len = len;
1300
1301         cmd->sk = sk;
1302         sock_hold(sk);
1303
1304         list_add(&cmd->list, &hdev->mgmt_pending);
1305
1306         return cmd;
1307 }
1308
1309 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1310                                  void (*cb)(struct pending_cmd *cmd,
1311                                             void *data),
1312                                  void *data)
1313 {
1314         struct pending_cmd *cmd, *tmp;
1315
1316         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1317                 if (opcode > 0 && cmd->opcode != opcode)
1318                         continue;
1319
1320                 cb(cmd, data);
1321         }
1322 }
1323
1324 static void mgmt_pending_remove(struct pending_cmd *cmd)
1325 {
1326         list_del(&cmd->list);
1327         mgmt_pending_free(cmd);
1328 }
1329
1330 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1331 {
1332         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1333
1334         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1335                             sizeof(settings));
1336 }
1337
1338 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1339 {
1340         BT_DBG("%s status 0x%02x", hdev->name, status);
1341
1342         if (hci_conn_count(hdev) == 0) {
1343                 cancel_delayed_work(&hdev->power_off);
1344                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1345         }
1346 }
1347
1348 static bool hci_stop_discovery(struct hci_request *req)
1349 {
1350         struct hci_dev *hdev = req->hdev;
1351         struct hci_cp_remote_name_req_cancel cp;
1352         struct inquiry_entry *e;
1353
1354         switch (hdev->discovery.state) {
1355         case DISCOVERY_FINDING:
1356                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1357                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1358                 } else {
1359                         cancel_delayed_work(&hdev->le_scan_disable);
1360                         hci_req_add_le_scan_disable(req);
1361                 }
1362
1363                 return true;
1364
1365         case DISCOVERY_RESOLVING:
1366                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1367                                                      NAME_PENDING);
1368                 if (!e)
1369                         break;
1370
1371                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1372                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1373                             &cp);
1374
1375                 return true;
1376
1377         default:
1378                 /* Passive scanning */
1379                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1380                         hci_req_add_le_scan_disable(req);
1381                         return true;
1382                 }
1383
1384                 break;
1385         }
1386
1387         return false;
1388 }
1389
1390 static int clean_up_hci_state(struct hci_dev *hdev)
1391 {
1392         struct hci_request req;
1393         struct hci_conn *conn;
1394         bool discov_stopped;
1395         int err;
1396
1397         hci_req_init(&req, hdev);
1398
1399         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1400             test_bit(HCI_PSCAN, &hdev->flags)) {
1401                 u8 scan = 0x00;
1402                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1403         }
1404
1405         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1406                 disable_advertising(&req);
1407
1408         discov_stopped = hci_stop_discovery(&req);
1409
1410         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1411                 struct hci_cp_disconnect dc;
1412                 struct hci_cp_reject_conn_req rej;
1413
1414                 switch (conn->state) {
1415                 case BT_CONNECTED:
1416                 case BT_CONFIG:
1417                         dc.handle = cpu_to_le16(conn->handle);
1418                         dc.reason = 0x15; /* Terminated due to Power Off */
1419                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1420                         break;
1421                 case BT_CONNECT:
1422                         if (conn->type == LE_LINK)
1423                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1424                                             0, NULL);
1425                         else if (conn->type == ACL_LINK)
1426                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1427                                             6, &conn->dst);
1428                         break;
1429                 case BT_CONNECT2:
1430                         bacpy(&rej.bdaddr, &conn->dst);
1431                         rej.reason = 0x15; /* Terminated due to Power Off */
1432                         if (conn->type == ACL_LINK)
1433                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1434                                             sizeof(rej), &rej);
1435                         else if (conn->type == SCO_LINK)
1436                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1437                                             sizeof(rej), &rej);
1438                         break;
1439                 }
1440         }
1441
1442         err = hci_req_run(&req, clean_up_hci_complete);
1443         if (!err && discov_stopped)
1444                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1445
1446 #ifdef CONFIG_TIZEN_WIP
1447         if (!err && discov_stopped)
1448                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
1449 #endif
1450
1451         return err;
1452 }
1453
1454 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1455                        u16 len)
1456 {
1457         struct mgmt_mode *cp = data;
1458         struct pending_cmd *cmd;
1459         int err;
1460
1461         BT_DBG("request for %s", hdev->name);
1462
1463         if (cp->val != 0x00 && cp->val != 0x01)
1464                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1465                                   MGMT_STATUS_INVALID_PARAMS);
1466
1467         hci_dev_lock(hdev);
1468
1469         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1470                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1471                                  MGMT_STATUS_BUSY);
1472                 goto failed;
1473         }
1474
1475         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1476                 cancel_delayed_work(&hdev->power_off);
1477
1478                 if (cp->val) {
1479                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1480                                          data, len);
1481                         err = mgmt_powered(hdev, 1);
1482                         goto failed;
1483                 }
1484         }
1485
1486         if (!!cp->val == hdev_is_powered(hdev)) {
1487                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1488                 goto failed;
1489         }
1490
1491         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1492         if (!cmd) {
1493                 err = -ENOMEM;
1494                 goto failed;
1495         }
1496
1497         if (cp->val) {
1498                 queue_work(hdev->req_workqueue, &hdev->power_on);
1499                 err = 0;
1500         } else {
1501                 /* Disconnect connections, stop scans, etc */
1502                 err = clean_up_hci_state(hdev);
1503                 if (!err)
1504                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1505                                            HCI_POWER_OFF_TIMEOUT);
1506
1507                 /* ENODATA means there were no HCI commands queued */
1508                 if (err == -ENODATA) {
1509                         cancel_delayed_work(&hdev->power_off);
1510                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1511                         err = 0;
1512                 }
1513         }
1514
1515 failed:
1516         hci_dev_unlock(hdev);
1517         return err;
1518 }
1519
1520 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1521 {
1522         __le32 ev;
1523
1524         ev = cpu_to_le32(get_current_settings(hdev));
1525
1526         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1527 }
1528
1529 int mgmt_new_settings(struct hci_dev *hdev)
1530 {
1531         return new_settings(hdev, NULL);
1532 }
1533
1534 struct cmd_lookup {
1535         struct sock *sk;
1536         struct hci_dev *hdev;
1537         u8 mgmt_status;
1538 };
1539
1540 static void settings_rsp(struct pending_cmd *cmd, void *data)
1541 {
1542         struct cmd_lookup *match = data;
1543
1544         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1545
1546         list_del(&cmd->list);
1547
1548         if (match->sk == NULL) {
1549                 match->sk = cmd->sk;
1550                 sock_hold(match->sk);
1551         }
1552
1553         mgmt_pending_free(cmd);
1554 }
1555
1556 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1557 {
1558         u8 *status = data;
1559
1560         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1561         mgmt_pending_remove(cmd);
1562 }
1563
1564 static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
1565 {
1566         if (cmd->cmd_complete) {
1567                 u8 *status = data;
1568
1569                 cmd->cmd_complete(cmd, *status);
1570                 mgmt_pending_remove(cmd);
1571
1572                 return;
1573         }
1574
1575         cmd_status_rsp(cmd, data);
1576 }
1577
1578 static int generic_cmd_complete(struct pending_cmd *cmd, u8 status)
1579 {
1580         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1581                             cmd->param, cmd->param_len);
1582 }
1583
1584 static int addr_cmd_complete(struct pending_cmd *cmd, u8 status)
1585 {
1586         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1587                             sizeof(struct mgmt_addr_info));
1588 }
1589
1590 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1591 {
1592         if (!lmp_bredr_capable(hdev))
1593                 return MGMT_STATUS_NOT_SUPPORTED;
1594         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1595                 return MGMT_STATUS_REJECTED;
1596         else
1597                 return MGMT_STATUS_SUCCESS;
1598 }
1599
1600 static u8 mgmt_le_support(struct hci_dev *hdev)
1601 {
1602         if (!lmp_le_capable(hdev))
1603                 return MGMT_STATUS_NOT_SUPPORTED;
1604         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1605                 return MGMT_STATUS_REJECTED;
1606         else
1607                 return MGMT_STATUS_SUCCESS;
1608 }
1609
1610 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1611                                       u16 opcode)
1612 {
1613         struct pending_cmd *cmd;
1614         struct mgmt_mode *cp;
1615         struct hci_request req;
1616         bool changed;
1617
1618         BT_DBG("status 0x%02x", status);
1619
1620         hci_dev_lock(hdev);
1621
1622         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1623         if (!cmd)
1624                 goto unlock;
1625
1626         if (status) {
1627                 u8 mgmt_err = mgmt_status(status);
1628                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1629                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1630                 goto remove_cmd;
1631         }
1632
1633         cp = cmd->param;
1634         if (cp->val) {
1635                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1636                                             &hdev->dev_flags);
1637
1638                 if (hdev->discov_timeout > 0) {
1639                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1640                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1641                                            to);
1642                 }
1643         } else {
1644                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1645                                              &hdev->dev_flags);
1646         }
1647
1648         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1649
1650         if (changed)
1651                 new_settings(hdev, cmd->sk);
1652
1653         /* When the discoverable mode gets changed, make sure
1654          * that class of device has the limited discoverable
1655          * bit correctly set. Also update page scan based on whitelist
1656          * entries.
1657          */
1658         hci_req_init(&req, hdev);
1659         __hci_update_page_scan(&req);
1660         update_class(&req);
1661         hci_req_run(&req, NULL);
1662
1663 remove_cmd:
1664         mgmt_pending_remove(cmd);
1665
1666 unlock:
1667         hci_dev_unlock(hdev);
1668 }
1669
1670 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1671                             u16 len)
1672 {
1673         struct mgmt_cp_set_discoverable *cp = data;
1674         struct pending_cmd *cmd;
1675         struct hci_request req;
1676         u16 timeout;
1677         u8 scan;
1678         int err;
1679
1680         BT_DBG("request for %s", hdev->name);
1681
1682         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1683             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1684                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1685                                   MGMT_STATUS_REJECTED);
1686
1687         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1688                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1689                                   MGMT_STATUS_INVALID_PARAMS);
1690
1691         timeout = __le16_to_cpu(cp->timeout);
1692
1693         /* Disabling discoverable requires that no timeout is set,
1694          * and enabling limited discoverable requires a timeout.
1695          */
1696         if ((cp->val == 0x00 && timeout > 0) ||
1697             (cp->val == 0x02 && timeout == 0))
1698                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1699                                   MGMT_STATUS_INVALID_PARAMS);
1700
1701         hci_dev_lock(hdev);
1702
1703         if (!hdev_is_powered(hdev) && timeout > 0) {
1704                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1705                                  MGMT_STATUS_NOT_POWERED);
1706                 goto failed;
1707         }
1708
1709         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1710             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1711                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1712                                  MGMT_STATUS_BUSY);
1713                 goto failed;
1714         }
1715
1716         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1717                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1718                                  MGMT_STATUS_REJECTED);
1719                 goto failed;
1720         }
1721
1722         if (!hdev_is_powered(hdev)) {
1723                 bool changed = false;
1724
1725                 /* Setting limited discoverable when powered off is
1726                  * not a valid operation since it requires a timeout
1727                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1728                  */
1729                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1730                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1731                         changed = true;
1732                 }
1733
1734                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1735                 if (err < 0)
1736                         goto failed;
1737
1738                 if (changed)
1739                         err = new_settings(hdev, sk);
1740
1741                 goto failed;
1742         }
1743
1744         /* If the current mode is the same, then just update the timeout
1745          * value with the new value. And if only the timeout gets updated,
1746          * then no need for any HCI transactions.
1747          */
1748         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1749             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1750                                           &hdev->dev_flags)) {
1751                 cancel_delayed_work(&hdev->discov_off);
1752                 hdev->discov_timeout = timeout;
1753
1754                 if (cp->val && hdev->discov_timeout > 0) {
1755                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1756                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1757                                            to);
1758                 }
1759
1760                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1761                 goto failed;
1762         }
1763
1764         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1765         if (!cmd) {
1766                 err = -ENOMEM;
1767                 goto failed;
1768         }
1769
1770         /* Cancel any potential discoverable timeout that might be
1771          * still active and store new timeout value. The arming of
1772          * the timeout happens in the complete handler.
1773          */
1774         cancel_delayed_work(&hdev->discov_off);
1775         hdev->discov_timeout = timeout;
1776
1777         /* Limited discoverable mode */
1778         if (cp->val == 0x02)
1779                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1780         else
1781                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1782
1783         hci_req_init(&req, hdev);
1784
1785         /* The procedure for LE-only controllers is much simpler - just
1786          * update the advertising data.
1787          */
1788         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1789                 goto update_ad;
1790
1791         scan = SCAN_PAGE;
1792
1793         if (cp->val) {
1794                 struct hci_cp_write_current_iac_lap hci_cp;
1795
1796                 if (cp->val == 0x02) {
1797                         /* Limited discoverable mode */
1798                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1799                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1800                         hci_cp.iac_lap[1] = 0x8b;
1801                         hci_cp.iac_lap[2] = 0x9e;
1802                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1803                         hci_cp.iac_lap[4] = 0x8b;
1804                         hci_cp.iac_lap[5] = 0x9e;
1805                 } else {
1806                         /* General discoverable mode */
1807                         hci_cp.num_iac = 1;
1808                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1809                         hci_cp.iac_lap[1] = 0x8b;
1810                         hci_cp.iac_lap[2] = 0x9e;
1811                 }
1812
1813                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1814                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1815
1816                 scan |= SCAN_INQUIRY;
1817         } else {
1818                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1819         }
1820
1821         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1822
1823 update_ad:
1824         update_adv_data(&req);
1825
1826         err = hci_req_run(&req, set_discoverable_complete);
1827         if (err < 0)
1828                 mgmt_pending_remove(cmd);
1829
1830 failed:
1831         hci_dev_unlock(hdev);
1832         return err;
1833 }
1834
1835 static void write_fast_connectable(struct hci_request *req, bool enable)
1836 {
1837         struct hci_dev *hdev = req->hdev;
1838 #ifndef CONFIG_TIZEN_WIP
1839         struct hci_cp_write_page_scan_activity acp;
1840 #endif
1841         u8 type;
1842
1843         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1844                 return;
1845
1846         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1847                 return;
1848
1849 #ifdef CONFIG_TIZEN_WIP
1850         if (enable) {
1851                 type = PAGE_SCAN_TYPE_INTERLACED;
1852         } else {
1853                 type = PAGE_SCAN_TYPE_STANDARD;
1854         }
1855 #else
1856         if (enable) {
1857                 type = PAGE_SCAN_TYPE_INTERLACED;
1858
1859                 /* 160 msec page scan interval */
1860                 acp.interval = cpu_to_le16(0x0100);
1861         } else {
1862                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1863
1864                 /* default 1.28 sec page scan */
1865                 acp.interval = cpu_to_le16(0x0800);
1866         }
1867
1868         acp.window = cpu_to_le16(0x0012);
1869
1870         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1871             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1872                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1873                             sizeof(acp), &acp);
1874 #endif
1875
1876         if (hdev->page_scan_type != type)
1877                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1878 }
1879
1880 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1881                                      u16 opcode)
1882 {
1883         struct pending_cmd *cmd;
1884         struct mgmt_mode *cp;
1885         bool conn_changed, discov_changed;
1886
1887         BT_DBG("status 0x%02x", status);
1888
1889         hci_dev_lock(hdev);
1890
1891         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1892         if (!cmd)
1893                 goto unlock;
1894
1895         if (status) {
1896                 u8 mgmt_err = mgmt_status(status);
1897                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1898                 goto remove_cmd;
1899         }
1900
1901         cp = cmd->param;
1902         if (cp->val) {
1903                 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1904                                                  &hdev->dev_flags);
1905                 discov_changed = false;
1906         } else {
1907                 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1908                                                   &hdev->dev_flags);
1909                 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1910                                                     &hdev->dev_flags);
1911         }
1912
1913         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1914
1915         if (conn_changed || discov_changed) {
1916                 new_settings(hdev, cmd->sk);
1917                 hci_update_page_scan(hdev);
1918                 if (discov_changed)
1919                         mgmt_update_adv_data(hdev);
1920                 hci_update_background_scan(hdev);
1921         }
1922
1923 remove_cmd:
1924         mgmt_pending_remove(cmd);
1925
1926 unlock:
1927         hci_dev_unlock(hdev);
1928 }
1929
1930 static int set_connectable_update_settings(struct hci_dev *hdev,
1931                                            struct sock *sk, u8 val)
1932 {
1933         bool changed = false;
1934         int err;
1935
1936         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1937                 changed = true;
1938
1939         if (val) {
1940                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1941         } else {
1942                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1943                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1944         }
1945
1946         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1947         if (err < 0)
1948                 return err;
1949
1950         if (changed) {
1951                 hci_update_page_scan(hdev);
1952                 hci_update_background_scan(hdev);
1953                 return new_settings(hdev, sk);
1954         }
1955
1956         return 0;
1957 }
1958
1959 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1960                            u16 len)
1961 {
1962         struct mgmt_mode *cp = data;
1963         struct pending_cmd *cmd;
1964         struct hci_request req;
1965         u8 scan;
1966         int err;
1967
1968         BT_DBG("request for %s", hdev->name);
1969
1970         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1971             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1972                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1973                                   MGMT_STATUS_REJECTED);
1974
1975         if (cp->val != 0x00 && cp->val != 0x01)
1976                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1977                                   MGMT_STATUS_INVALID_PARAMS);
1978
1979         hci_dev_lock(hdev);
1980
1981         if (!hdev_is_powered(hdev)) {
1982                 err = set_connectable_update_settings(hdev, sk, cp->val);
1983                 goto failed;
1984         }
1985
1986         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1987             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1988                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1989                                  MGMT_STATUS_BUSY);
1990                 goto failed;
1991         }
1992
1993         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1994         if (!cmd) {
1995                 err = -ENOMEM;
1996                 goto failed;
1997         }
1998
1999         hci_req_init(&req, hdev);
2000
2001         /* If BR/EDR is not enabled and we disable advertising as a
2002          * by-product of disabling connectable, we need to update the
2003          * advertising flags.
2004          */
2005         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2006                 if (!cp->val) {
2007                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
2008                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
2009                 }
2010                 update_adv_data(&req);
2011         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
2012                 if (cp->val) {
2013                         scan = SCAN_PAGE;
2014                 } else {
2015                         /* If we don't have any whitelist entries just
2016                          * disable all scanning. If there are entries
2017                          * and we had both page and inquiry scanning
2018                          * enabled then fall back to only page scanning.
2019                          * Otherwise no changes are needed.
2020                          */
2021                         if (list_empty(&hdev->whitelist))
2022                                 scan = SCAN_DISABLED;
2023                         else if (test_bit(HCI_ISCAN, &hdev->flags))
2024                                 scan = SCAN_PAGE;
2025                         else
2026                                 goto no_scan_update;
2027
2028                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
2029                             hdev->discov_timeout > 0)
2030                                 cancel_delayed_work(&hdev->discov_off);
2031                 }
2032
2033                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2034         }
2035
2036 no_scan_update:
2037         /* If we're going from non-connectable to connectable or
2038          * vice-versa when fast connectable is enabled ensure that fast
2039          * connectable gets disabled. write_fast_connectable won't do
2040          * anything if the page scan parameters are already what they
2041          * should be.
2042          */
2043         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
2044                 write_fast_connectable(&req, false);
2045
2046         /* Update the advertising parameters if necessary */
2047         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2048                 enable_advertising(&req);
2049
2050         err = hci_req_run(&req, set_connectable_complete);
2051         if (err < 0) {
2052                 mgmt_pending_remove(cmd);
2053                 if (err == -ENODATA)
2054                         err = set_connectable_update_settings(hdev, sk,
2055                                                               cp->val);
2056                 goto failed;
2057         }
2058
2059 failed:
2060         hci_dev_unlock(hdev);
2061         return err;
2062 }
2063
2064 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
2065                         u16 len)
2066 {
2067         struct mgmt_mode *cp = data;
2068         bool changed;
2069         int err;
2070
2071         BT_DBG("request for %s", hdev->name);
2072
2073         if (cp->val != 0x00 && cp->val != 0x01)
2074                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2075                                   MGMT_STATUS_INVALID_PARAMS);
2076
2077         hci_dev_lock(hdev);
2078
2079         if (cp->val)
2080                 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
2081         else
2082                 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
2083
2084         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
2085         if (err < 0)
2086                 goto unlock;
2087
2088         if (changed)
2089                 err = new_settings(hdev, sk);
2090
2091 unlock:
2092         hci_dev_unlock(hdev);
2093         return err;
2094 }
2095
2096 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2097                              u16 len)
2098 {
2099         struct mgmt_mode *cp = data;
2100         struct pending_cmd *cmd;
2101         u8 val, status;
2102         int err;
2103
2104         BT_DBG("request for %s", hdev->name);
2105
2106         status = mgmt_bredr_support(hdev);
2107         if (status)
2108                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2109                                   status);
2110
2111         if (cp->val != 0x00 && cp->val != 0x01)
2112                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2113                                   MGMT_STATUS_INVALID_PARAMS);
2114
2115         hci_dev_lock(hdev);
2116
2117         if (!hdev_is_powered(hdev)) {
2118                 bool changed = false;
2119
2120                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
2121                                           &hdev->dev_flags)) {
2122                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
2123                         changed = true;
2124                 }
2125
2126                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2127                 if (err < 0)
2128                         goto failed;
2129
2130                 if (changed)
2131                         err = new_settings(hdev, sk);
2132
2133                 goto failed;
2134         }
2135
2136         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2137                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2138                                  MGMT_STATUS_BUSY);
2139                 goto failed;
2140         }
2141
2142         val = !!cp->val;
2143
2144         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2145                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2146                 goto failed;
2147         }
2148
2149         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2150         if (!cmd) {
2151                 err = -ENOMEM;
2152                 goto failed;
2153         }
2154
2155         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2156         if (err < 0) {
2157                 mgmt_pending_remove(cmd);
2158                 goto failed;
2159         }
2160
2161 failed:
2162         hci_dev_unlock(hdev);
2163         return err;
2164 }
2165
2166 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2167 {
2168         struct mgmt_mode *cp = data;
2169         struct pending_cmd *cmd;
2170         u8 status;
2171         int err;
2172
2173         BT_DBG("request for %s", hdev->name);
2174
2175         status = mgmt_bredr_support(hdev);
2176         if (status)
2177                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2178
2179         if (!lmp_ssp_capable(hdev))
2180                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2181                                   MGMT_STATUS_NOT_SUPPORTED);
2182
2183         if (cp->val != 0x00 && cp->val != 0x01)
2184                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2185                                   MGMT_STATUS_INVALID_PARAMS);
2186
2187         hci_dev_lock(hdev);
2188
2189         if (!hdev_is_powered(hdev)) {
2190                 bool changed;
2191
2192                 if (cp->val) {
2193                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2194                                                     &hdev->dev_flags);
2195                 } else {
2196                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2197                                                      &hdev->dev_flags);
2198                         if (!changed)
2199                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2200                                                              &hdev->dev_flags);
2201                         else
2202                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2203                 }
2204
2205                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2206                 if (err < 0)
2207                         goto failed;
2208
2209                 if (changed)
2210                         err = new_settings(hdev, sk);
2211
2212                 goto failed;
2213         }
2214
2215         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2216             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2217                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2218                                  MGMT_STATUS_BUSY);
2219                 goto failed;
2220         }
2221
2222         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2223                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2224                 goto failed;
2225         }
2226
2227         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2228         if (!cmd) {
2229                 err = -ENOMEM;
2230                 goto failed;
2231         }
2232
2233         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2234                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2235                              sizeof(cp->val), &cp->val);
2236
2237         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2238         if (err < 0) {
2239                 mgmt_pending_remove(cmd);
2240                 goto failed;
2241         }
2242
2243 failed:
2244         hci_dev_unlock(hdev);
2245         return err;
2246 }
2247
2248 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2249 {
2250         struct mgmt_mode *cp = data;
2251         bool changed;
2252         u8 status;
2253         int err;
2254
2255         BT_DBG("request for %s", hdev->name);
2256
2257         status = mgmt_bredr_support(hdev);
2258         if (status)
2259                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2260
2261         if (!lmp_ssp_capable(hdev))
2262                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2263                                   MGMT_STATUS_NOT_SUPPORTED);
2264
2265         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2266                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2267                                   MGMT_STATUS_REJECTED);
2268
2269         if (cp->val != 0x00 && cp->val != 0x01)
2270                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2271                                   MGMT_STATUS_INVALID_PARAMS);
2272
2273         hci_dev_lock(hdev);
2274
2275         if (cp->val) {
2276                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2277         } else {
2278                 if (hdev_is_powered(hdev)) {
2279                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2280                                          MGMT_STATUS_REJECTED);
2281                         goto unlock;
2282                 }
2283
2284                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2285         }
2286
2287         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2288         if (err < 0)
2289                 goto unlock;
2290
2291         if (changed)
2292                 err = new_settings(hdev, sk);
2293
2294 unlock:
2295         hci_dev_unlock(hdev);
2296         return err;
2297 }
2298
2299 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2300 {
2301         struct cmd_lookup match = { NULL, hdev };
2302
2303 #ifdef CONFIG_TIZEN_WIP
2304         hci_dev_lock(hdev);
2305 #endif
2306
2307         if (status) {
2308                 u8 mgmt_err = mgmt_status(status);
2309
2310                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2311                                      &mgmt_err);
2312 #ifdef CONFIG_TIZEN_WIP
2313                 goto unlock;
2314 #else
2315                 return;
2316 #endif
2317         }
2318
2319         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2320
2321         new_settings(hdev, match.sk);
2322
2323         if (match.sk)
2324                 sock_put(match.sk);
2325
2326         /* Make sure the controller has a good default for
2327          * advertising data. Restrict the update to when LE
2328          * has actually been enabled. During power on, the
2329          * update in powered_update_hci will take care of it.
2330          */
2331         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2332                 struct hci_request req;
2333
2334 #ifndef CONFIG_TIZEN_WIP
2335                 hci_dev_lock(hdev);
2336 #endif
2337
2338                 hci_req_init(&req, hdev);
2339                 update_adv_data(&req);
2340                 update_scan_rsp_data(&req);
2341                 __hci_update_background_scan(&req);
2342                 hci_req_run(&req, NULL);
2343         }
2344         hci_update_background_scan(hdev);
2345 #ifdef CONFIG_TIZEN_WIP
2346 unlock:
2347         hci_dev_unlock(hdev);
2348 #endif
2349 }
2350
2351 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2352 {
2353         struct mgmt_mode *cp = data;
2354         struct hci_cp_write_le_host_supported hci_cp;
2355         struct pending_cmd *cmd;
2356         struct hci_request req;
2357         int err;
2358         u8 val, enabled;
2359
2360         BT_DBG("request for %s", hdev->name);
2361
2362         if (!lmp_le_capable(hdev))
2363                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2364                                   MGMT_STATUS_NOT_SUPPORTED);
2365
2366         if (cp->val != 0x00 && cp->val != 0x01)
2367                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2368                                   MGMT_STATUS_INVALID_PARAMS);
2369
2370         /* LE-only devices do not allow toggling LE on/off */
2371         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2372                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2373                                   MGMT_STATUS_REJECTED);
2374
2375         hci_dev_lock(hdev);
2376
2377         val = !!cp->val;
2378         enabled = lmp_host_le_capable(hdev);
2379
2380         if (!hdev_is_powered(hdev) || val == enabled) {
2381                 bool changed = false;
2382
2383                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2384                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2385                         changed = true;
2386                 }
2387
2388                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2389                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2390                         changed = true;
2391                 }
2392
2393                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2394                 if (err < 0)
2395                         goto unlock;
2396
2397                 if (changed)
2398                         err = new_settings(hdev, sk);
2399
2400                 goto unlock;
2401         }
2402
2403         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2404             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2405                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2406                                  MGMT_STATUS_BUSY);
2407                 goto unlock;
2408         }
2409
2410         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2411         if (!cmd) {
2412                 err = -ENOMEM;
2413                 goto unlock;
2414         }
2415
2416         hci_req_init(&req, hdev);
2417
2418         memset(&hci_cp, 0, sizeof(hci_cp));
2419
2420         if (val) {
2421                 hci_cp.le = val;
2422                 hci_cp.simul = 0x00;
2423         } else {
2424                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2425                         disable_advertising(&req);
2426         }
2427
2428         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2429                     &hci_cp);
2430
2431         err = hci_req_run(&req, le_enable_complete);
2432         if (err < 0)
2433                 mgmt_pending_remove(cmd);
2434
2435 unlock:
2436         hci_dev_unlock(hdev);
2437         return err;
2438 }
2439
2440 /* This is a helper function to test for pending mgmt commands that can
2441  * cause CoD or EIR HCI commands. We can only allow one such pending
2442  * mgmt command at a time since otherwise we cannot easily track what
2443  * the current values are, will be, and based on that calculate if a new
2444  * HCI command needs to be sent and if yes with what value.
2445  */
2446 static bool pending_eir_or_class(struct hci_dev *hdev)
2447 {
2448         struct pending_cmd *cmd;
2449
2450         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2451                 switch (cmd->opcode) {
2452                 case MGMT_OP_ADD_UUID:
2453                 case MGMT_OP_REMOVE_UUID:
2454                 case MGMT_OP_SET_DEV_CLASS:
2455                 case MGMT_OP_SET_POWERED:
2456                         return true;
2457                 }
2458         }
2459
2460         return false;
2461 }
2462
2463 static const u8 bluetooth_base_uuid[] = {
2464                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2465                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2466 };
2467
2468 static u8 get_uuid_size(const u8 *uuid)
2469 {
2470         u32 val;
2471
2472         if (memcmp(uuid, bluetooth_base_uuid, 12))
2473                 return 128;
2474
2475         val = get_unaligned_le32(&uuid[12]);
2476         if (val > 0xffff)
2477                 return 32;
2478
2479         return 16;
2480 }
2481
2482 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2483 {
2484         struct pending_cmd *cmd;
2485
2486         hci_dev_lock(hdev);
2487
2488         cmd = mgmt_pending_find(mgmt_op, hdev);
2489         if (!cmd)
2490                 goto unlock;
2491
2492         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2493                      hdev->dev_class, 3);
2494
2495         mgmt_pending_remove(cmd);
2496
2497 unlock:
2498         hci_dev_unlock(hdev);
2499 }
2500
2501 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2502 {
2503         BT_DBG("status 0x%02x", status);
2504
2505         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2506 }
2507
2508 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2509 {
2510         struct mgmt_cp_add_uuid *cp = data;
2511         struct pending_cmd *cmd;
2512         struct hci_request req;
2513         struct bt_uuid *uuid;
2514         int err;
2515
2516         BT_DBG("request for %s", hdev->name);
2517
2518         hci_dev_lock(hdev);
2519
2520         if (pending_eir_or_class(hdev)) {
2521                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2522                                  MGMT_STATUS_BUSY);
2523                 goto failed;
2524         }
2525
2526         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2527         if (!uuid) {
2528                 err = -ENOMEM;
2529                 goto failed;
2530         }
2531
2532         memcpy(uuid->uuid, cp->uuid, 16);
2533         uuid->svc_hint = cp->svc_hint;
2534         uuid->size = get_uuid_size(cp->uuid);
2535
2536         list_add_tail(&uuid->list, &hdev->uuids);
2537
2538         hci_req_init(&req, hdev);
2539
2540         update_class(&req);
2541         update_eir(&req);
2542
2543         err = hci_req_run(&req, add_uuid_complete);
2544         if (err < 0) {
2545                 if (err != -ENODATA)
2546                         goto failed;
2547
2548                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2549                                    hdev->dev_class, 3);
2550                 goto failed;
2551         }
2552
2553         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2554         if (!cmd) {
2555                 err = -ENOMEM;
2556                 goto failed;
2557         }
2558
2559         err = 0;
2560
2561 failed:
2562         hci_dev_unlock(hdev);
2563         return err;
2564 }
2565
2566 static bool enable_service_cache(struct hci_dev *hdev)
2567 {
2568         if (!hdev_is_powered(hdev))
2569                 return false;
2570
2571         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2572                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2573                                    CACHE_TIMEOUT);
2574                 return true;
2575         }
2576
2577         return false;
2578 }
2579
2580 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2581 {
2582         BT_DBG("status 0x%02x", status);
2583
2584         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2585 }
2586
2587 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2588                        u16 len)
2589 {
2590         struct mgmt_cp_remove_uuid *cp = data;
2591         struct pending_cmd *cmd;
2592         struct bt_uuid *match, *tmp;
2593         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2594         struct hci_request req;
2595         int err, found;
2596
2597         BT_DBG("request for %s", hdev->name);
2598
2599         hci_dev_lock(hdev);
2600
2601         if (pending_eir_or_class(hdev)) {
2602                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2603                                  MGMT_STATUS_BUSY);
2604                 goto unlock;
2605         }
2606
2607         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2608                 hci_uuids_clear(hdev);
2609
2610                 if (enable_service_cache(hdev)) {
2611                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2612                                            0, hdev->dev_class, 3);
2613                         goto unlock;
2614                 }
2615
2616                 goto update_class;
2617         }
2618
2619         found = 0;
2620
2621         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2622                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2623                         continue;
2624
2625                 list_del(&match->list);
2626                 kfree(match);
2627                 found++;
2628         }
2629
2630         if (found == 0) {
2631                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2632                                  MGMT_STATUS_INVALID_PARAMS);
2633                 goto unlock;
2634         }
2635
2636 update_class:
2637         hci_req_init(&req, hdev);
2638
2639         update_class(&req);
2640         update_eir(&req);
2641
2642         err = hci_req_run(&req, remove_uuid_complete);
2643         if (err < 0) {
2644                 if (err != -ENODATA)
2645                         goto unlock;
2646
2647                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2648                                    hdev->dev_class, 3);
2649                 goto unlock;
2650         }
2651
2652         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2653         if (!cmd) {
2654                 err = -ENOMEM;
2655                 goto unlock;
2656         }
2657
2658         err = 0;
2659
2660 unlock:
2661         hci_dev_unlock(hdev);
2662         return err;
2663 }
2664
2665 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2666 {
2667         BT_DBG("status 0x%02x", status);
2668
2669         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2670 }
2671
2672 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2673                          u16 len)
2674 {
2675         struct mgmt_cp_set_dev_class *cp = data;
2676         struct pending_cmd *cmd;
2677         struct hci_request req;
2678         int err;
2679
2680         BT_DBG("request for %s", hdev->name);
2681
2682         if (!lmp_bredr_capable(hdev))
2683                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2684                                   MGMT_STATUS_NOT_SUPPORTED);
2685
2686         hci_dev_lock(hdev);
2687
2688         if (pending_eir_or_class(hdev)) {
2689                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2690                                  MGMT_STATUS_BUSY);
2691                 goto unlock;
2692         }
2693
2694         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2695                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2696                                  MGMT_STATUS_INVALID_PARAMS);
2697                 goto unlock;
2698         }
2699
2700         hdev->major_class = cp->major;
2701         hdev->minor_class = cp->minor;
2702
2703         if (!hdev_is_powered(hdev)) {
2704                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2705                                    hdev->dev_class, 3);
2706                 goto unlock;
2707         }
2708
2709         hci_req_init(&req, hdev);
2710
2711         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2712                 hci_dev_unlock(hdev);
2713                 cancel_delayed_work_sync(&hdev->service_cache);
2714                 hci_dev_lock(hdev);
2715                 update_eir(&req);
2716         }
2717
2718         update_class(&req);
2719
2720         err = hci_req_run(&req, set_class_complete);
2721         if (err < 0) {
2722                 if (err != -ENODATA)
2723                         goto unlock;
2724
2725                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2726                                    hdev->dev_class, 3);
2727                 goto unlock;
2728         }
2729
2730         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2731         if (!cmd) {
2732                 err = -ENOMEM;
2733                 goto unlock;
2734         }
2735
2736         err = 0;
2737
2738 unlock:
2739         hci_dev_unlock(hdev);
2740         return err;
2741 }
2742
2743 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2744                           u16 len)
2745 {
2746         struct mgmt_cp_load_link_keys *cp = data;
2747         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2748                                    sizeof(struct mgmt_link_key_info));
2749         u16 key_count, expected_len;
2750         bool changed;
2751         int i;
2752
2753         BT_DBG("request for %s", hdev->name);
2754
2755         if (!lmp_bredr_capable(hdev))
2756                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2757                                   MGMT_STATUS_NOT_SUPPORTED);
2758
2759         key_count = __le16_to_cpu(cp->key_count);
2760         if (key_count > max_key_count) {
2761                 BT_ERR("load_link_keys: too big key_count value %u",
2762                        key_count);
2763                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2764                                   MGMT_STATUS_INVALID_PARAMS);
2765         }
2766
2767         expected_len = sizeof(*cp) + key_count *
2768                                         sizeof(struct mgmt_link_key_info);
2769         if (expected_len != len) {
2770                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2771                        expected_len, len);
2772                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2773                                   MGMT_STATUS_INVALID_PARAMS);
2774         }
2775
2776         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2777                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2778                                   MGMT_STATUS_INVALID_PARAMS);
2779
2780         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2781                key_count);
2782
2783         for (i = 0; i < key_count; i++) {
2784                 struct mgmt_link_key_info *key = &cp->keys[i];
2785
2786                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2787                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2788                                           MGMT_STATUS_INVALID_PARAMS);
2789         }
2790
2791         hci_dev_lock(hdev);
2792
2793         hci_link_keys_clear(hdev);
2794
2795         if (cp->debug_keys)
2796                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2797                                             &hdev->dev_flags);
2798         else
2799                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2800                                              &hdev->dev_flags);
2801
2802         if (changed)
2803                 new_settings(hdev, NULL);
2804
2805         for (i = 0; i < key_count; i++) {
2806                 struct mgmt_link_key_info *key = &cp->keys[i];
2807
2808                 /* Always ignore debug keys and require a new pairing if
2809                  * the user wants to use them.
2810                  */
2811                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2812                         continue;
2813
2814                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2815                                  key->type, key->pin_len, NULL);
2816         }
2817
2818         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2819
2820         hci_dev_unlock(hdev);
2821
2822         return 0;
2823 }
2824
2825 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2826                            u8 addr_type, struct sock *skip_sk)
2827 {
2828         struct mgmt_ev_device_unpaired ev;
2829
2830         bacpy(&ev.addr.bdaddr, bdaddr);
2831         ev.addr.type = addr_type;
2832
2833         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2834                           skip_sk);
2835 }
2836
2837 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2838                          u16 len)
2839 {
2840         struct mgmt_cp_unpair_device *cp = data;
2841         struct mgmt_rp_unpair_device rp;
2842         struct hci_cp_disconnect dc;
2843         struct pending_cmd *cmd;
2844         struct hci_conn *conn;
2845         int err;
2846
2847         memset(&rp, 0, sizeof(rp));
2848         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2849         rp.addr.type = cp->addr.type;
2850
2851         if (!bdaddr_type_is_valid(cp->addr.type))
2852                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2853                                     MGMT_STATUS_INVALID_PARAMS,
2854                                     &rp, sizeof(rp));
2855
2856         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2857                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2858                                     MGMT_STATUS_INVALID_PARAMS,
2859                                     &rp, sizeof(rp));
2860
2861         hci_dev_lock(hdev);
2862
2863         if (!hdev_is_powered(hdev)) {
2864                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2865                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2866                 goto unlock;
2867         }
2868
2869         if (cp->addr.type == BDADDR_BREDR) {
2870                 /* If disconnection is requested, then look up the
2871                  * connection. If the remote device is connected, it
2872                  * will be later used to terminate the link.
2873                  *
2874                  * Setting it to NULL explicitly will cause no
2875                  * termination of the link.
2876                  */
2877                 if (cp->disconnect)
2878                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2879                                                        &cp->addr.bdaddr);
2880                 else
2881                         conn = NULL;
2882
2883                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2884         } else {
2885                 u8 addr_type;
2886
2887                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2888                                                &cp->addr.bdaddr);
2889                 if (conn) {
2890                         /* Defer clearing up the connection parameters
2891                          * until closing to give a chance of keeping
2892                          * them if a repairing happens.
2893                          */
2894                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2895
2896                         /* If disconnection is not requested, then
2897                          * clear the connection variable so that the
2898                          * link is not terminated.
2899                          */
2900                         if (!cp->disconnect)
2901                                 conn = NULL;
2902                 }
2903
2904                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2905                         addr_type = ADDR_LE_DEV_PUBLIC;
2906                 else
2907                         addr_type = ADDR_LE_DEV_RANDOM;
2908
2909                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2910
2911                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2912         }
2913
2914         if (err < 0) {
2915                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2916                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2917                 goto unlock;
2918         }
2919
2920         /* If the connection variable is set, then termination of the
2921          * link is requested.
2922          */
2923         if (!conn) {
2924                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2925                                    &rp, sizeof(rp));
2926                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2927                 goto unlock;
2928         }
2929
2930         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2931                                sizeof(*cp));
2932         if (!cmd) {
2933                 err = -ENOMEM;
2934                 goto unlock;
2935         }
2936
2937         cmd->cmd_complete = addr_cmd_complete;
2938
2939         dc.handle = cpu_to_le16(conn->handle);
2940         dc.reason = 0x13; /* Remote User Terminated Connection */
2941         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2942         if (err < 0)
2943                 mgmt_pending_remove(cmd);
2944
2945 unlock:
2946         hci_dev_unlock(hdev);
2947         return err;
2948 }
2949
2950 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2951                       u16 len)
2952 {
2953         struct mgmt_cp_disconnect *cp = data;
2954         struct mgmt_rp_disconnect rp;
2955         struct pending_cmd *cmd;
2956         struct hci_conn *conn;
2957         int err;
2958
2959         BT_DBG("");
2960
2961         memset(&rp, 0, sizeof(rp));
2962         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2963         rp.addr.type = cp->addr.type;
2964
2965         if (!bdaddr_type_is_valid(cp->addr.type))
2966                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2967                                     MGMT_STATUS_INVALID_PARAMS,
2968                                     &rp, sizeof(rp));
2969
2970         hci_dev_lock(hdev);
2971
2972         if (!test_bit(HCI_UP, &hdev->flags)) {
2973                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2974                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2975                 goto failed;
2976         }
2977
2978         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2979                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2980                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2981                 goto failed;
2982         }
2983
2984         if (cp->addr.type == BDADDR_BREDR)
2985                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2986                                                &cp->addr.bdaddr);
2987         else
2988                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2989
2990         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2991                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2992                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2993                 goto failed;
2994         }
2995
2996         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2997         if (!cmd) {
2998                 err = -ENOMEM;
2999                 goto failed;
3000         }
3001
3002         cmd->cmd_complete = generic_cmd_complete;
3003
3004         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3005         if (err < 0)
3006                 mgmt_pending_remove(cmd);
3007
3008 failed:
3009         hci_dev_unlock(hdev);
3010         return err;
3011 }
3012
3013 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3014 {
3015         switch (link_type) {
3016         case LE_LINK:
3017                 switch (addr_type) {
3018                 case ADDR_LE_DEV_PUBLIC:
3019                         return BDADDR_LE_PUBLIC;
3020
3021                 default:
3022                         /* Fallback to LE Random address type */
3023                         return BDADDR_LE_RANDOM;
3024                 }
3025
3026         default:
3027                 /* Fallback to BR/EDR type */
3028                 return BDADDR_BREDR;
3029         }
3030 }
3031
3032 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3033                            u16 data_len)
3034 {
3035         struct mgmt_rp_get_connections *rp;
3036         struct hci_conn *c;
3037         size_t rp_len;
3038         int err;
3039         u16 i;
3040
3041         BT_DBG("");
3042
3043         hci_dev_lock(hdev);
3044
3045         if (!hdev_is_powered(hdev)) {
3046                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3047                                  MGMT_STATUS_NOT_POWERED);
3048                 goto unlock;
3049         }
3050
3051         i = 0;
3052         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3053                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3054                         i++;
3055         }
3056
3057         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3058         rp = kmalloc(rp_len, GFP_KERNEL);
3059         if (!rp) {
3060                 err = -ENOMEM;
3061                 goto unlock;
3062         }
3063
3064         i = 0;
3065         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3066                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3067                         continue;
3068                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3069                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3070                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3071                         continue;
3072                 i++;
3073         }
3074
3075         rp->conn_count = cpu_to_le16(i);
3076
3077         /* Recalculate length in case of filtered SCO connections, etc */
3078         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3079
3080         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3081                            rp_len);
3082
3083         kfree(rp);
3084
3085 unlock:
3086         hci_dev_unlock(hdev);
3087         return err;
3088 }
3089
3090 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3091                                    struct mgmt_cp_pin_code_neg_reply *cp)
3092 {
3093         struct pending_cmd *cmd;
3094         int err;
3095
3096         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3097                                sizeof(*cp));
3098         if (!cmd)
3099                 return -ENOMEM;
3100
3101         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3102                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3103         if (err < 0)
3104                 mgmt_pending_remove(cmd);
3105
3106         return err;
3107 }
3108
3109 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3110                           u16 len)
3111 {
3112         struct hci_conn *conn;
3113         struct mgmt_cp_pin_code_reply *cp = data;
3114         struct hci_cp_pin_code_reply reply;
3115         struct pending_cmd *cmd;
3116         int err;
3117
3118         BT_DBG("");
3119
3120         hci_dev_lock(hdev);
3121
3122         if (!hdev_is_powered(hdev)) {
3123                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3124                                  MGMT_STATUS_NOT_POWERED);
3125                 goto failed;
3126         }
3127
3128         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3129         if (!conn) {
3130                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3131                                  MGMT_STATUS_NOT_CONNECTED);
3132                 goto failed;
3133         }
3134
3135         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3136                 struct mgmt_cp_pin_code_neg_reply ncp;
3137
3138                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3139
3140                 BT_ERR("PIN code is not 16 bytes long");
3141
3142                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3143                 if (err >= 0)
3144                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3145                                          MGMT_STATUS_INVALID_PARAMS);
3146
3147                 goto failed;
3148         }
3149
3150         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3151         if (!cmd) {
3152                 err = -ENOMEM;
3153                 goto failed;
3154         }
3155
3156         cmd->cmd_complete = addr_cmd_complete;
3157
3158         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3159         reply.pin_len = cp->pin_len;
3160         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3161
3162         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3163         if (err < 0)
3164                 mgmt_pending_remove(cmd);
3165
3166 failed:
3167         hci_dev_unlock(hdev);
3168         return err;
3169 }
3170
3171 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3172                              u16 len)
3173 {
3174         struct mgmt_cp_set_io_capability *cp = data;
3175
3176         BT_DBG("");
3177
3178         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3179                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3180                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3181
3182         hci_dev_lock(hdev);
3183
3184         hdev->io_capability = cp->io_capability;
3185
3186         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3187                hdev->io_capability);
3188
3189         hci_dev_unlock(hdev);
3190
3191         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3192                             0);
3193 }
3194
3195 static struct pending_cmd *find_pairing(struct hci_conn *conn)
3196 {
3197         struct hci_dev *hdev = conn->hdev;
3198         struct pending_cmd *cmd;
3199
3200         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3201                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3202                         continue;
3203
3204                 if (cmd->user_data != conn)
3205                         continue;
3206
3207                 return cmd;
3208         }
3209
3210         return NULL;
3211 }
3212
3213 static int pairing_complete(struct pending_cmd *cmd, u8 status)
3214 {
3215         struct mgmt_rp_pair_device rp;
3216         struct hci_conn *conn = cmd->user_data;
3217         int err;
3218
3219         bacpy(&rp.addr.bdaddr, &conn->dst);
3220         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3221
3222         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3223                            &rp, sizeof(rp));
3224
3225         /* So we don't get further callbacks for this connection */
3226         conn->connect_cfm_cb = NULL;
3227         conn->security_cfm_cb = NULL;
3228         conn->disconn_cfm_cb = NULL;
3229
3230         hci_conn_drop(conn);
3231
3232         /* The device is paired so there is no need to remove
3233          * its connection parameters anymore.
3234          */
3235         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3236
3237         hci_conn_put(conn);
3238
3239         return err;
3240 }
3241
3242 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3243 {
3244         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3245         struct pending_cmd *cmd;
3246
3247         cmd = find_pairing(conn);
3248         if (cmd) {
3249                 cmd->cmd_complete(cmd, status);
3250                 mgmt_pending_remove(cmd);
3251         }
3252 }
3253
3254 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3255 {
3256         struct pending_cmd *cmd;
3257
3258         BT_DBG("status %u", status);
3259
3260         cmd = find_pairing(conn);
3261         if (!cmd) {
3262                 BT_DBG("Unable to find a pending command");
3263                 return;
3264         }
3265
3266         cmd->cmd_complete(cmd, mgmt_status(status));
3267         mgmt_pending_remove(cmd);
3268 }
3269
3270 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3271 {
3272         struct pending_cmd *cmd;
3273
3274         BT_DBG("status %u", status);
3275
3276         if (!status)
3277                 return;
3278
3279         cmd = find_pairing(conn);
3280         if (!cmd) {
3281                 BT_DBG("Unable to find a pending command");
3282                 return;
3283         }
3284
3285         cmd->cmd_complete(cmd, mgmt_status(status));
3286         mgmt_pending_remove(cmd);
3287 }
3288
3289 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3290                        u16 len)
3291 {
3292         struct mgmt_cp_pair_device *cp = data;
3293         struct mgmt_rp_pair_device rp;
3294         struct pending_cmd *cmd;
3295         u8 sec_level, auth_type;
3296         struct hci_conn *conn;
3297         int err;
3298
3299         BT_DBG("");
3300
3301         memset(&rp, 0, sizeof(rp));
3302         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3303         rp.addr.type = cp->addr.type;
3304
3305         if (!bdaddr_type_is_valid(cp->addr.type))
3306                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3307                                     MGMT_STATUS_INVALID_PARAMS,
3308                                     &rp, sizeof(rp));
3309
3310         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3311                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3312                                     MGMT_STATUS_INVALID_PARAMS,
3313                                     &rp, sizeof(rp));
3314
3315         hci_dev_lock(hdev);
3316
3317         if (!hdev_is_powered(hdev)) {
3318                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3319                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3320                 goto unlock;
3321         }
3322
3323         sec_level = BT_SECURITY_MEDIUM;
3324         auth_type = HCI_AT_DEDICATED_BONDING;
3325
3326         if (cp->addr.type == BDADDR_BREDR) {
3327                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3328                                        auth_type);
3329         } else {
3330                 u8 addr_type;
3331
3332                 /* Convert from L2CAP channel address type to HCI address type
3333                  */
3334                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3335                         addr_type = ADDR_LE_DEV_PUBLIC;
3336                 else
3337                         addr_type = ADDR_LE_DEV_RANDOM;
3338
3339                 /* When pairing a new device, it is expected to remember
3340                  * this device for future connections. Adding the connection
3341                  * parameter information ahead of time allows tracking
3342                  * of the slave preferred values and will speed up any
3343                  * further connection establishment.
3344                  *
3345                  * If connection parameters already exist, then they
3346                  * will be kept and this function does nothing.
3347                  */
3348                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3349
3350                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3351                                       sec_level, HCI_LE_CONN_TIMEOUT,
3352                                       HCI_ROLE_MASTER);
3353         }
3354
3355         if (IS_ERR(conn)) {
3356                 int status;
3357
3358                 if (PTR_ERR(conn) == -EBUSY)
3359                         status = MGMT_STATUS_BUSY;
3360                 else
3361                         status = MGMT_STATUS_CONNECT_FAILED;
3362
3363                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3364                                    status, &rp,
3365                                    sizeof(rp));
3366                 goto unlock;
3367         }
3368
3369         if (conn->connect_cfm_cb) {
3370                 hci_conn_drop(conn);
3371                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3372                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3373                 goto unlock;
3374         }
3375
3376         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3377         if (!cmd) {
3378                 err = -ENOMEM;
3379                 hci_conn_drop(conn);
3380                 goto unlock;
3381         }
3382
3383         cmd->cmd_complete = pairing_complete;
3384
3385         /* For LE, just connecting isn't a proof that the pairing finished */
3386         if (cp->addr.type == BDADDR_BREDR) {
3387                 conn->connect_cfm_cb = pairing_complete_cb;
3388                 conn->security_cfm_cb = pairing_complete_cb;
3389                 conn->disconn_cfm_cb = pairing_complete_cb;
3390         } else {
3391                 conn->connect_cfm_cb = le_pairing_complete_cb;
3392                 conn->security_cfm_cb = le_pairing_complete_cb;
3393                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3394         }
3395
3396         conn->io_capability = cp->io_cap;
3397         cmd->user_data = hci_conn_get(conn);
3398
3399         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3400             hci_conn_security(conn, sec_level, auth_type, true)) {
3401                 cmd->cmd_complete(cmd, 0);
3402                 mgmt_pending_remove(cmd);
3403         }
3404
3405         err = 0;
3406
3407 unlock:
3408         hci_dev_unlock(hdev);
3409         return err;
3410 }
3411
3412 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3413                               u16 len)
3414 {
3415         struct mgmt_addr_info *addr = data;
3416         struct pending_cmd *cmd;
3417         struct hci_conn *conn;
3418         int err;
3419
3420         BT_DBG("");
3421
3422         hci_dev_lock(hdev);
3423
3424         if (!hdev_is_powered(hdev)) {
3425                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3426                                  MGMT_STATUS_NOT_POWERED);
3427                 goto unlock;
3428         }
3429
3430         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3431         if (!cmd) {
3432                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3433                                  MGMT_STATUS_INVALID_PARAMS);
3434                 goto unlock;
3435         }
3436
3437         conn = cmd->user_data;
3438
3439         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3440                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3441                                  MGMT_STATUS_INVALID_PARAMS);
3442                 goto unlock;
3443         }
3444
3445         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3446         mgmt_pending_remove(cmd);
3447
3448         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3449                            addr, sizeof(*addr));
3450 unlock:
3451         hci_dev_unlock(hdev);
3452         return err;
3453 }
3454
3455 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3456                              struct mgmt_addr_info *addr, u16 mgmt_op,
3457                              u16 hci_op, __le32 passkey)
3458 {
3459         struct pending_cmd *cmd;
3460         struct hci_conn *conn;
3461         int err;
3462
3463         hci_dev_lock(hdev);
3464
3465         if (!hdev_is_powered(hdev)) {
3466                 err = cmd_complete(sk, hdev->id, mgmt_op,
3467                                    MGMT_STATUS_NOT_POWERED, addr,
3468                                    sizeof(*addr));
3469                 goto done;
3470         }
3471
3472         if (addr->type == BDADDR_BREDR)
3473                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3474         else
3475                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3476
3477         if (!conn) {
3478                 err = cmd_complete(sk, hdev->id, mgmt_op,
3479                                    MGMT_STATUS_NOT_CONNECTED, addr,
3480                                    sizeof(*addr));
3481                 goto done;
3482         }
3483
3484         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3485                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3486                 if (!err)
3487                         err = cmd_complete(sk, hdev->id, mgmt_op,
3488                                            MGMT_STATUS_SUCCESS, addr,
3489                                            sizeof(*addr));
3490                 else
3491                         err = cmd_complete(sk, hdev->id, mgmt_op,
3492                                            MGMT_STATUS_FAILED, addr,
3493                                            sizeof(*addr));
3494
3495                 goto done;
3496         }
3497
3498         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3499         if (!cmd) {
3500                 err = -ENOMEM;
3501                 goto done;
3502         }
3503
3504         cmd->cmd_complete = addr_cmd_complete;
3505
3506         /* Continue with pairing via HCI */
3507         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3508                 struct hci_cp_user_passkey_reply cp;
3509
3510                 bacpy(&cp.bdaddr, &addr->bdaddr);
3511                 cp.passkey = passkey;
3512                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3513         } else
3514                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3515                                    &addr->bdaddr);
3516
3517         if (err < 0)
3518                 mgmt_pending_remove(cmd);
3519
3520 done:
3521         hci_dev_unlock(hdev);
3522         return err;
3523 }
3524
3525 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3526                               void *data, u16 len)
3527 {
3528         struct mgmt_cp_pin_code_neg_reply *cp = data;
3529
3530         BT_DBG("");
3531
3532         return user_pairing_resp(sk, hdev, &cp->addr,
3533                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3534                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3535 }
3536
3537 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3538                               u16 len)
3539 {
3540         struct mgmt_cp_user_confirm_reply *cp = data;
3541
3542         BT_DBG("");
3543
3544         if (len != sizeof(*cp))
3545                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3546                                   MGMT_STATUS_INVALID_PARAMS);
3547
3548         return user_pairing_resp(sk, hdev, &cp->addr,
3549                                  MGMT_OP_USER_CONFIRM_REPLY,
3550                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3551 }
3552
3553 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3554                                   void *data, u16 len)
3555 {
3556         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3557
3558         BT_DBG("");
3559
3560         return user_pairing_resp(sk, hdev, &cp->addr,
3561                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3562                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3563 }
3564
3565 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3566                               u16 len)
3567 {
3568         struct mgmt_cp_user_passkey_reply *cp = data;
3569
3570         BT_DBG("");
3571
3572         return user_pairing_resp(sk, hdev, &cp->addr,
3573                                  MGMT_OP_USER_PASSKEY_REPLY,
3574                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3575 }
3576
3577 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3578                                   void *data, u16 len)
3579 {
3580         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3581
3582         BT_DBG("");
3583
3584         return user_pairing_resp(sk, hdev, &cp->addr,
3585                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3586                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3587 }
3588
3589 static void update_name(struct hci_request *req)
3590 {
3591         struct hci_dev *hdev = req->hdev;
3592         struct hci_cp_write_local_name cp;
3593
3594         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3595
3596         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3597 }
3598
3599 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3600 {
3601         struct mgmt_cp_set_local_name *cp;
3602         struct pending_cmd *cmd;
3603
3604         BT_DBG("status 0x%02x", status);
3605
3606         hci_dev_lock(hdev);
3607
3608         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3609         if (!cmd)
3610                 goto unlock;
3611
3612         cp = cmd->param;
3613
3614         if (status)
3615                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3616                            mgmt_status(status));
3617         else
3618                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3619                              cp, sizeof(*cp));
3620
3621         mgmt_pending_remove(cmd);
3622
3623 unlock:
3624         hci_dev_unlock(hdev);
3625 }
3626
3627 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3628                           u16 len)
3629 {
3630         struct mgmt_cp_set_local_name *cp = data;
3631         struct pending_cmd *cmd;
3632         struct hci_request req;
3633         int err;
3634
3635         BT_DBG("");
3636
3637         hci_dev_lock(hdev);
3638
3639         /* If the old values are the same as the new ones just return a
3640          * direct command complete event.
3641          */
3642         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3643             !memcmp(hdev->short_name, cp->short_name,
3644                     sizeof(hdev->short_name))) {
3645                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3646                                    data, len);
3647                 goto failed;
3648         }
3649
3650         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3651
3652         if (!hdev_is_powered(hdev)) {
3653                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3654
3655                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3656                                    data, len);
3657                 if (err < 0)
3658                         goto failed;
3659
3660                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3661                                  sk);
3662
3663                 goto failed;
3664         }
3665
3666         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3667         if (!cmd) {
3668                 err = -ENOMEM;
3669                 goto failed;
3670         }
3671
3672         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3673
3674         hci_req_init(&req, hdev);
3675
3676         if (lmp_bredr_capable(hdev)) {
3677                 update_name(&req);
3678                 update_eir(&req);
3679         }
3680
3681         /* The name is stored in the scan response data and so
3682          * no need to udpate the advertising data here.
3683          */
3684         if (lmp_le_capable(hdev))
3685                 update_scan_rsp_data(&req);
3686
3687         err = hci_req_run(&req, set_name_complete);
3688         if (err < 0)
3689                 mgmt_pending_remove(cmd);
3690
3691 failed:
3692         hci_dev_unlock(hdev);
3693         return err;
3694 }
3695
3696 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3697                                void *data, u16 data_len)
3698 {
3699         struct pending_cmd *cmd;
3700         int err;
3701
3702         BT_DBG("%s", hdev->name);
3703
3704         hci_dev_lock(hdev);
3705
3706         if (!hdev_is_powered(hdev)) {
3707                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3708                                  MGMT_STATUS_NOT_POWERED);
3709                 goto unlock;
3710         }
3711
3712         if (!lmp_ssp_capable(hdev)) {
3713                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3714                                  MGMT_STATUS_NOT_SUPPORTED);
3715                 goto unlock;
3716         }
3717
3718         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3719                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3720                                  MGMT_STATUS_BUSY);
3721                 goto unlock;
3722         }
3723
3724         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3725         if (!cmd) {
3726                 err = -ENOMEM;
3727                 goto unlock;
3728         }
3729
3730         if (bredr_sc_enabled(hdev))
3731                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3732                                    0, NULL);
3733         else
3734                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3735
3736         if (err < 0)
3737                 mgmt_pending_remove(cmd);
3738
3739 unlock:
3740         hci_dev_unlock(hdev);
3741         return err;
3742 }
3743
3744 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3745                                void *data, u16 len)
3746 {
3747         struct mgmt_addr_info *addr = data;
3748         int err;
3749
3750         BT_DBG("%s ", hdev->name);
3751
3752         if (!bdaddr_type_is_valid(addr->type))
3753                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3754                                     MGMT_STATUS_INVALID_PARAMS, addr,
3755                                     sizeof(*addr));
3756
3757         hci_dev_lock(hdev);
3758
3759         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3760                 struct mgmt_cp_add_remote_oob_data *cp = data;
3761                 u8 status;
3762
3763                 if (cp->addr.type != BDADDR_BREDR) {
3764                         err = cmd_complete(sk, hdev->id,
3765                                            MGMT_OP_ADD_REMOTE_OOB_DATA,
3766                                            MGMT_STATUS_INVALID_PARAMS,
3767                                            &cp->addr, sizeof(cp->addr));
3768                         goto unlock;
3769                 }
3770
3771                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3772                                               cp->addr.type, cp->hash,
3773                                               cp->rand, NULL, NULL);
3774                 if (err < 0)
3775                         status = MGMT_STATUS_FAILED;
3776                 else
3777                         status = MGMT_STATUS_SUCCESS;
3778
3779                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3780                                    status, &cp->addr, sizeof(cp->addr));
3781         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3782                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3783                 u8 *rand192, *hash192;
3784                 u8 status;
3785
3786                 if (bdaddr_type_is_le(cp->addr.type)) {
3787                         /* Enforce zero-valued 192-bit parameters as
3788                          * long as legacy SMP OOB isn't implemented.
3789                          */
3790                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3791                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3792                                 err = cmd_complete(sk, hdev->id,
3793                                                    MGMT_OP_ADD_REMOTE_OOB_DATA,
3794                                                    MGMT_STATUS_INVALID_PARAMS,
3795                                                    addr, sizeof(*addr));
3796                                 goto unlock;
3797                         }
3798
3799                         rand192 = NULL;
3800                         hash192 = NULL;
3801                 } else {
3802                         rand192 = cp->rand192;
3803                         hash192 = cp->hash192;
3804                 }
3805
3806                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3807                                               cp->addr.type, hash192, rand192,
3808                                               cp->hash256, cp->rand256);
3809                 if (err < 0)
3810                         status = MGMT_STATUS_FAILED;
3811                 else
3812                         status = MGMT_STATUS_SUCCESS;
3813
3814                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3815                                    status, &cp->addr, sizeof(cp->addr));
3816         } else {
3817                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3818                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3819                                  MGMT_STATUS_INVALID_PARAMS);
3820         }
3821
3822 unlock:
3823         hci_dev_unlock(hdev);
3824         return err;
3825 }
3826
3827 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3828                                   void *data, u16 len)
3829 {
3830         struct mgmt_cp_remove_remote_oob_data *cp = data;
3831         u8 status;
3832         int err;
3833
3834         BT_DBG("%s", hdev->name);
3835
3836         if (cp->addr.type != BDADDR_BREDR)
3837                 return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3838                                     MGMT_STATUS_INVALID_PARAMS,
3839                                     &cp->addr, sizeof(cp->addr));
3840
3841         hci_dev_lock(hdev);
3842
3843         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3844                 hci_remote_oob_data_clear(hdev);
3845                 status = MGMT_STATUS_SUCCESS;
3846                 goto done;
3847         }
3848
3849         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3850         if (err < 0)
3851                 status = MGMT_STATUS_INVALID_PARAMS;
3852         else
3853                 status = MGMT_STATUS_SUCCESS;
3854
3855 done:
3856         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3857                            status, &cp->addr, sizeof(cp->addr));
3858
3859         hci_dev_unlock(hdev);
3860         return err;
3861 }
3862
3863 static bool trigger_discovery(struct hci_request *req, u8 *status)
3864 {
3865         struct hci_dev *hdev = req->hdev;
3866         struct hci_cp_le_set_scan_param param_cp;
3867         struct hci_cp_le_set_scan_enable enable_cp;
3868         struct hci_cp_inquiry inq_cp;
3869         /* General inquiry access code (GIAC) */
3870         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3871         u8 own_addr_type;
3872         int err;
3873
3874         switch (hdev->discovery.type) {
3875         case DISCOV_TYPE_BREDR:
3876                 *status = mgmt_bredr_support(hdev);
3877                 if (*status)
3878                         return false;
3879
3880                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3881                         *status = MGMT_STATUS_BUSY;
3882                         return false;
3883                 }
3884
3885                 hci_inquiry_cache_flush(hdev);
3886
3887                 memset(&inq_cp, 0, sizeof(inq_cp));
3888                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3889                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3890                 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3891                 break;
3892
3893         case DISCOV_TYPE_LE:
3894         case DISCOV_TYPE_INTERLEAVED:
3895                 *status = mgmt_le_support(hdev);
3896                 if (*status)
3897                         return false;
3898
3899                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3900                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3901                         *status = MGMT_STATUS_NOT_SUPPORTED;
3902                         return false;
3903                 }
3904
3905                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3906                         /* Don't let discovery abort an outgoing
3907                          * connection attempt that's using directed
3908                          * advertising.
3909                          */
3910                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3911                                                        BT_CONNECT)) {
3912                                 *status = MGMT_STATUS_REJECTED;
3913                                 return false;
3914                         }
3915
3916                         disable_advertising(req);
3917                 }
3918
3919                 /* If controller is scanning, it means the background scanning
3920                  * is running. Thus, we should temporarily stop it in order to
3921                  * set the discovery scanning parameters.
3922                  */
3923                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3924                         hci_req_add_le_scan_disable(req);
3925
3926                 memset(&param_cp, 0, sizeof(param_cp));
3927
3928                 /* All active scans will be done with either a resolvable
3929                  * private address (when privacy feature has been enabled)
3930                  * or non-resolvable private address.
3931                  */
3932                 err = hci_update_random_address(req, true, &own_addr_type);
3933                 if (err < 0) {
3934                         *status = MGMT_STATUS_FAILED;
3935                         return false;
3936                 }
3937
3938                 param_cp.type = LE_SCAN_ACTIVE;
3939                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3940                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3941                 param_cp.own_address_type = own_addr_type;
3942                 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3943                             &param_cp);
3944
3945                 memset(&enable_cp, 0, sizeof(enable_cp));
3946                 enable_cp.enable = LE_SCAN_ENABLE;
3947                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3948                 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3949                             &enable_cp);
3950                 break;
3951
3952         default:
3953                 *status = MGMT_STATUS_INVALID_PARAMS;
3954                 return false;
3955         }
3956
3957         return true;
3958 }
3959
3960 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
3961                                      u16 opcode)
3962 {
3963         struct pending_cmd *cmd;
3964         unsigned long timeout;
3965
3966         BT_DBG("status %d", status);
3967
3968         hci_dev_lock(hdev);
3969
3970         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3971         if (!cmd)
3972                 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3973
3974         if (cmd) {
3975                 cmd->cmd_complete(cmd, mgmt_status(status));
3976                 mgmt_pending_remove(cmd);
3977         }
3978
3979         if (status) {
3980                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3981                 goto unlock;
3982         }
3983
3984         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3985
3986         switch (hdev->discovery.type) {
3987         case DISCOV_TYPE_LE:
3988                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3989                 break;
3990         case DISCOV_TYPE_INTERLEAVED:
3991                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3992                 break;
3993         case DISCOV_TYPE_BREDR:
3994                 timeout = 0;
3995                 break;
3996         default:
3997                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3998                 timeout = 0;
3999                 break;
4000         }
4001
4002         if (timeout)
4003                 queue_delayed_work(hdev->workqueue,
4004                                    &hdev->le_scan_disable, timeout);
4005
4006 unlock:
4007         hci_dev_unlock(hdev);
4008 }
4009
4010 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4011                            void *data, u16 len)
4012 {
4013         struct mgmt_cp_start_discovery *cp = data;
4014         struct pending_cmd *cmd;
4015         struct hci_request req;
4016         u8 status;
4017         int err;
4018
4019         BT_DBG("%s", hdev->name);
4020
4021         hci_dev_lock(hdev);
4022
4023         if (!hdev_is_powered(hdev)) {
4024                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4025                                    MGMT_STATUS_NOT_POWERED,
4026                                    &cp->type, sizeof(cp->type));
4027                 goto failed;
4028         }
4029
4030         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4031             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
4032                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4033                                    MGMT_STATUS_BUSY, &cp->type,
4034                                    sizeof(cp->type));
4035                 goto failed;
4036         }
4037
4038         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
4039         if (!cmd) {
4040                 err = -ENOMEM;
4041                 goto failed;
4042         }
4043
4044         cmd->cmd_complete = generic_cmd_complete;
4045
4046         /* Clear the discovery filter first to free any previously
4047          * allocated memory for the UUID list.
4048          */
4049         hci_discovery_filter_clear(hdev);
4050
4051         hdev->discovery.type = cp->type;
4052         hdev->discovery.report_invalid_rssi = false;
4053
4054         hci_req_init(&req, hdev);
4055
4056         if (!trigger_discovery(&req, &status)) {
4057                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4058                                    status, &cp->type, sizeof(cp->type));
4059                 mgmt_pending_remove(cmd);
4060                 goto failed;
4061         }
4062
4063         err = hci_req_run(&req, start_discovery_complete);
4064         if (err < 0) {
4065                 mgmt_pending_remove(cmd);
4066                 goto failed;
4067         }
4068
4069         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4070
4071 failed:
4072         hci_dev_unlock(hdev);
4073         return err;
4074 }
4075
4076 static int service_discovery_cmd_complete(struct pending_cmd *cmd, u8 status)
4077 {
4078         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4079                             cmd->param, 1);
4080 }
4081
4082 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4083                                    void *data, u16 len)
4084 {
4085         struct mgmt_cp_start_service_discovery *cp = data;
4086         struct pending_cmd *cmd;
4087         struct hci_request req;
4088         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4089         u16 uuid_count, expected_len;
4090         u8 status;
4091         int err;
4092
4093         BT_DBG("%s", hdev->name);
4094
4095         hci_dev_lock(hdev);
4096
4097         if (!hdev_is_powered(hdev)) {
4098                 err = cmd_complete(sk, hdev->id,
4099                                    MGMT_OP_START_SERVICE_DISCOVERY,
4100                                    MGMT_STATUS_NOT_POWERED,
4101                                    &cp->type, sizeof(cp->type));
4102                 goto failed;
4103         }
4104
4105         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4106             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
4107                 err = cmd_complete(sk, hdev->id,
4108                                    MGMT_OP_START_SERVICE_DISCOVERY,
4109                                    MGMT_STATUS_BUSY, &cp->type,
4110                                    sizeof(cp->type));
4111                 goto failed;
4112         }
4113
4114         uuid_count = __le16_to_cpu(cp->uuid_count);
4115         if (uuid_count > max_uuid_count) {
4116                 BT_ERR("service_discovery: too big uuid_count value %u",
4117                        uuid_count);
4118                 err = cmd_complete(sk, hdev->id,
4119                                    MGMT_OP_START_SERVICE_DISCOVERY,
4120                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
4121                                    sizeof(cp->type));
4122                 goto failed;
4123         }
4124
4125         expected_len = sizeof(*cp) + uuid_count * 16;
4126         if (expected_len != len) {
4127                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4128                        expected_len, len);
4129                 err = cmd_complete(sk, hdev->id,
4130                                    MGMT_OP_START_SERVICE_DISCOVERY,
4131                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
4132                                    sizeof(cp->type));
4133                 goto failed;
4134         }
4135
4136         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4137                                hdev, data, len);
4138         if (!cmd) {
4139                 err = -ENOMEM;
4140                 goto failed;
4141         }
4142
4143         cmd->cmd_complete = service_discovery_cmd_complete;
4144
4145         /* Clear the discovery filter first to free any previously
4146          * allocated memory for the UUID list.
4147          */
4148         hci_discovery_filter_clear(hdev);
4149
4150         hdev->discovery.type = cp->type;
4151         hdev->discovery.rssi = cp->rssi;
4152         hdev->discovery.uuid_count = uuid_count;
4153
4154         if (uuid_count > 0) {
4155                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4156                                                 GFP_KERNEL);
4157                 if (!hdev->discovery.uuids) {
4158                         err = cmd_complete(sk, hdev->id,
4159                                            MGMT_OP_START_SERVICE_DISCOVERY,
4160                                            MGMT_STATUS_FAILED,
4161                                            &cp->type, sizeof(cp->type));
4162                         mgmt_pending_remove(cmd);
4163                         goto failed;
4164                 }
4165         }
4166
4167         hci_req_init(&req, hdev);
4168
4169         if (!trigger_discovery(&req, &status)) {
4170                 err = cmd_complete(sk, hdev->id,
4171                                    MGMT_OP_START_SERVICE_DISCOVERY,
4172                                    status, &cp->type, sizeof(cp->type));
4173                 mgmt_pending_remove(cmd);
4174                 goto failed;
4175         }
4176
4177         err = hci_req_run(&req, start_discovery_complete);
4178         if (err < 0) {
4179                 mgmt_pending_remove(cmd);
4180                 goto failed;
4181         }
4182
4183         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4184
4185 failed:
4186         hci_dev_unlock(hdev);
4187         return err;
4188 }
4189
4190 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4191 {
4192         struct pending_cmd *cmd;
4193
4194         BT_DBG("status %d", status);
4195
4196         hci_dev_lock(hdev);
4197
4198         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4199         if (cmd) {
4200                 cmd->cmd_complete(cmd, mgmt_status(status));
4201                 mgmt_pending_remove(cmd);
4202         }
4203
4204         if (!status)
4205                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4206
4207         hci_dev_unlock(hdev);
4208 }
4209
4210 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4211                           u16 len)
4212 {
4213         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4214         struct pending_cmd *cmd;
4215         struct hci_request req;
4216         int err;
4217
4218         BT_DBG("%s", hdev->name);
4219
4220         hci_dev_lock(hdev);
4221
4222         if (!hci_discovery_active(hdev)) {
4223                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4224                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
4225                                    sizeof(mgmt_cp->type));
4226                 goto unlock;
4227         }
4228
4229         if (hdev->discovery.type != mgmt_cp->type) {
4230                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4231                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
4232                                    sizeof(mgmt_cp->type));
4233                 goto unlock;
4234         }
4235
4236         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4237         if (!cmd) {
4238                 err = -ENOMEM;
4239                 goto unlock;
4240         }
4241
4242         cmd->cmd_complete = generic_cmd_complete;
4243
4244         hci_req_init(&req, hdev);
4245
4246         hci_stop_discovery(&req);
4247
4248         err = hci_req_run(&req, stop_discovery_complete);
4249         if (!err) {
4250                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4251                 goto unlock;
4252         }
4253
4254         mgmt_pending_remove(cmd);
4255
4256         /* If no HCI commands were sent we're done */
4257         if (err == -ENODATA) {
4258                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4259                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
4260                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4261         }
4262
4263 unlock:
4264         hci_dev_unlock(hdev);
4265         return err;
4266 }
4267
4268 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4269                         u16 len)
4270 {
4271         struct mgmt_cp_confirm_name *cp = data;
4272         struct inquiry_entry *e;
4273         int err;
4274
4275         BT_DBG("%s", hdev->name);
4276
4277         hci_dev_lock(hdev);
4278
4279         if (!hci_discovery_active(hdev)) {
4280                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4281                                    MGMT_STATUS_FAILED, &cp->addr,
4282                                    sizeof(cp->addr));
4283                 goto failed;
4284         }
4285
4286         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4287         if (!e) {
4288                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4289                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4290                                    sizeof(cp->addr));
4291                 goto failed;
4292         }
4293
4294         if (cp->name_known) {
4295                 e->name_state = NAME_KNOWN;
4296                 list_del(&e->list);
4297         } else {
4298                 e->name_state = NAME_NEEDED;
4299                 hci_inquiry_cache_update_resolve(hdev, e);
4300         }
4301
4302         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4303                            sizeof(cp->addr));
4304
4305 failed:
4306         hci_dev_unlock(hdev);
4307         return err;
4308 }
4309
4310 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4311                         u16 len)
4312 {
4313         struct mgmt_cp_block_device *cp = data;
4314         u8 status;
4315         int err;
4316
4317         BT_DBG("%s", hdev->name);
4318
4319         if (!bdaddr_type_is_valid(cp->addr.type))
4320                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4321                                     MGMT_STATUS_INVALID_PARAMS,
4322                                     &cp->addr, sizeof(cp->addr));
4323
4324         hci_dev_lock(hdev);
4325
4326         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4327                                   cp->addr.type);
4328         if (err < 0) {
4329                 status = MGMT_STATUS_FAILED;
4330                 goto done;
4331         }
4332
4333         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4334                    sk);
4335         status = MGMT_STATUS_SUCCESS;
4336
4337 done:
4338         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4339                            &cp->addr, sizeof(cp->addr));
4340
4341         hci_dev_unlock(hdev);
4342
4343         return err;
4344 }
4345
4346 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4347                           u16 len)
4348 {
4349         struct mgmt_cp_unblock_device *cp = data;
4350         u8 status;
4351         int err;
4352
4353         BT_DBG("%s", hdev->name);
4354
4355         if (!bdaddr_type_is_valid(cp->addr.type))
4356                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4357                                     MGMT_STATUS_INVALID_PARAMS,
4358                                     &cp->addr, sizeof(cp->addr));
4359
4360         hci_dev_lock(hdev);
4361
4362         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4363                                   cp->addr.type);
4364         if (err < 0) {
4365                 status = MGMT_STATUS_INVALID_PARAMS;
4366                 goto done;
4367         }
4368
4369         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4370                    sk);
4371         status = MGMT_STATUS_SUCCESS;
4372
4373 done:
4374         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4375                            &cp->addr, sizeof(cp->addr));
4376
4377         hci_dev_unlock(hdev);
4378
4379         return err;
4380 }
4381
4382 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4383                          u16 len)
4384 {
4385         struct mgmt_cp_set_device_id *cp = data;
4386         struct hci_request req;
4387         int err;
4388         __u16 source;
4389
4390         BT_DBG("%s", hdev->name);
4391
4392         source = __le16_to_cpu(cp->source);
4393
4394         if (source > 0x0002)
4395                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4396                                   MGMT_STATUS_INVALID_PARAMS);
4397
4398         hci_dev_lock(hdev);
4399
4400         hdev->devid_source = source;
4401         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4402         hdev->devid_product = __le16_to_cpu(cp->product);
4403         hdev->devid_version = __le16_to_cpu(cp->version);
4404
4405         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4406
4407         hci_req_init(&req, hdev);
4408         update_eir(&req);
4409         hci_req_run(&req, NULL);
4410
4411         hci_dev_unlock(hdev);
4412
4413         return err;
4414 }
4415
4416 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4417                                      u16 opcode)
4418 {
4419         struct cmd_lookup match = { NULL, hdev };
4420
4421         hci_dev_lock(hdev);
4422
4423         if (status) {
4424                 u8 mgmt_err = mgmt_status(status);
4425
4426                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4427                                      cmd_status_rsp, &mgmt_err);
4428                 goto unlock;
4429         }
4430
4431         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4432                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4433         else
4434                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4435
4436         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4437                              &match);
4438
4439         new_settings(hdev, match.sk);
4440
4441         if (match.sk)
4442                 sock_put(match.sk);
4443
4444 unlock:
4445         hci_dev_unlock(hdev);
4446 }
4447
4448 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4449                            u16 len)
4450 {
4451         struct mgmt_mode *cp = data;
4452         struct pending_cmd *cmd;
4453         struct hci_request req;
4454         u8 val, enabled, status;
4455         int err;
4456
4457         BT_DBG("request for %s", hdev->name);
4458
4459         status = mgmt_le_support(hdev);
4460         if (status)
4461                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4462                                   status);
4463
4464         if (cp->val != 0x00 && cp->val != 0x01)
4465                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4466                                   MGMT_STATUS_INVALID_PARAMS);
4467
4468         hci_dev_lock(hdev);
4469
4470         val = !!cp->val;
4471         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4472
4473         /* The following conditions are ones which mean that we should
4474          * not do any HCI communication but directly send a mgmt
4475          * response to user space (after toggling the flag if
4476          * necessary).
4477          */
4478         if (!hdev_is_powered(hdev) || val == enabled ||
4479             hci_conn_num(hdev, LE_LINK) > 0 ||
4480             (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4481              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4482                 bool changed = false;
4483
4484                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4485                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4486                         changed = true;
4487                 }
4488
4489                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4490                 if (err < 0)
4491                         goto unlock;
4492
4493                 if (changed)
4494                         err = new_settings(hdev, sk);
4495
4496                 goto unlock;
4497         }
4498
4499         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4500             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4501                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4502                                  MGMT_STATUS_BUSY);
4503                 goto unlock;
4504         }
4505
4506         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4507         if (!cmd) {
4508                 err = -ENOMEM;
4509                 goto unlock;
4510         }
4511
4512         hci_req_init(&req, hdev);
4513
4514         if (val)
4515                 enable_advertising(&req);
4516         else
4517                 disable_advertising(&req);
4518
4519         err = hci_req_run(&req, set_advertising_complete);
4520         if (err < 0)
4521                 mgmt_pending_remove(cmd);
4522
4523 unlock:
4524         hci_dev_unlock(hdev);
4525         return err;
4526 }
4527
4528 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4529                               void *data, u16 len)
4530 {
4531         struct mgmt_cp_set_static_address *cp = data;
4532         int err;
4533
4534         BT_DBG("%s", hdev->name);
4535
4536         if (!lmp_le_capable(hdev))
4537                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4538                                   MGMT_STATUS_NOT_SUPPORTED);
4539
4540         if (hdev_is_powered(hdev))
4541                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4542                                   MGMT_STATUS_REJECTED);
4543
4544         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4545                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4546                         return cmd_status(sk, hdev->id,
4547                                           MGMT_OP_SET_STATIC_ADDRESS,
4548                                           MGMT_STATUS_INVALID_PARAMS);
4549
4550                 /* Two most significant bits shall be set */
4551                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4552                         return cmd_status(sk, hdev->id,
4553                                           MGMT_OP_SET_STATIC_ADDRESS,
4554                                           MGMT_STATUS_INVALID_PARAMS);
4555         }
4556
4557         hci_dev_lock(hdev);
4558
4559         bacpy(&hdev->static_addr, &cp->bdaddr);
4560
4561         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4562
4563         hci_dev_unlock(hdev);
4564
4565         return err;
4566 }
4567
4568 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4569                            void *data, u16 len)
4570 {
4571         struct mgmt_cp_set_scan_params *cp = data;
4572         __u16 interval, window;
4573         int err;
4574
4575         BT_DBG("%s", hdev->name);
4576
4577         if (!lmp_le_capable(hdev))
4578                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4579                                   MGMT_STATUS_NOT_SUPPORTED);
4580
4581         interval = __le16_to_cpu(cp->interval);
4582
4583         if (interval < 0x0004 || interval > 0x4000)
4584                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4585                                   MGMT_STATUS_INVALID_PARAMS);
4586
4587         window = __le16_to_cpu(cp->window);
4588
4589         if (window < 0x0004 || window > 0x4000)
4590                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4591                                   MGMT_STATUS_INVALID_PARAMS);
4592
4593         if (window > interval)
4594                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4595                                   MGMT_STATUS_INVALID_PARAMS);
4596
4597         hci_dev_lock(hdev);
4598
4599         hdev->le_scan_interval = interval;
4600         hdev->le_scan_window = window;
4601
4602         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4603
4604         /* If background scan is running, restart it so new parameters are
4605          * loaded.
4606          */
4607         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4608             hdev->discovery.state == DISCOVERY_STOPPED) {
4609                 struct hci_request req;
4610
4611                 hci_req_init(&req, hdev);
4612
4613                 hci_req_add_le_scan_disable(&req);
4614                 hci_req_add_le_passive_scan(&req);
4615
4616                 hci_req_run(&req, NULL);
4617         }
4618
4619         hci_dev_unlock(hdev);
4620
4621         return err;
4622 }
4623
4624 #ifdef CONFIG_TIZEN_WIP
4625 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
4626                            void *data, u16 len)
4627 {
4628         struct mgmt_cp_le_set_scan_params *cp = data;
4629         __u16 interval, window;
4630         int err;
4631
4632         BT_DBG("%s", hdev->name);
4633
4634         if (!lmp_le_capable(hdev))
4635                 return cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
4636                                   MGMT_STATUS_NOT_SUPPORTED);
4637
4638         interval = __le16_to_cpu(cp->interval);
4639
4640         if (interval < 0x0004 || interval > 0x4000)
4641                 return cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
4642                                   MGMT_STATUS_INVALID_PARAMS);
4643
4644         window = __le16_to_cpu(cp->window);
4645
4646         if (window < 0x0004 || window > 0x4000)
4647                 return cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
4648                                   MGMT_STATUS_INVALID_PARAMS);
4649
4650         if (window > interval)
4651                 return cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
4652                                   MGMT_STATUS_INVALID_PARAMS);
4653
4654         hci_dev_lock(hdev);
4655
4656         hdev->le_scan_type = cp->type;
4657         hdev->le_scan_interval = interval;
4658         hdev->le_scan_window = window;
4659
4660         err = cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0, NULL, 0);
4661
4662         /* If background scan is running, restart it so new parameters are
4663          * loaded.
4664          */
4665         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4666             hdev->discovery.state == DISCOVERY_STOPPED) {
4667                 struct hci_request req;
4668
4669                 hci_req_init(&req, hdev);
4670
4671                 hci_req_add_le_scan_disable(&req);
4672                 hci_req_add_le_passive_scan(&req);
4673
4674                 hci_req_run(&req, NULL);
4675         }
4676
4677         hci_dev_unlock(hdev);
4678
4679         return err;
4680 }
4681 #endif
4682
4683 #ifdef CONFIG_TIZEN_WIP /* Adv White List feature */
4684 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4685 {
4686         struct mgmt_cp_add_dev_white_list *cp;
4687         struct pending_cmd *cmd;
4688
4689         BT_DBG("status 0x%02x", status);
4690
4691         hci_dev_lock(hdev);
4692
4693         cmd = mgmt_pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
4694         if (!cmd)
4695                 goto unlock;
4696
4697         cp = cmd->param;
4698
4699         if (status)
4700                 cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
4701                            mgmt_status(status));
4702         else
4703                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST, 0,
4704                              cp, sizeof(*cp));
4705
4706         mgmt_pending_remove(cmd);
4707
4708 unlock:
4709         hci_dev_unlock(hdev);
4710 }
4711
4712 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
4713                            void *data, u16 len)
4714 {
4715         struct pending_cmd *cmd;
4716         struct mgmt_cp_add_dev_white_list *cp = data;
4717         struct hci_request req;
4718         int err;
4719
4720         BT_DBG("%s", hdev->name);
4721
4722         if (!lmp_le_capable(hdev))
4723                 return cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
4724                                   MGMT_STATUS_NOT_SUPPORTED);
4725
4726         if (!hdev_is_powered(hdev))
4727                 return cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
4728                                   MGMT_STATUS_REJECTED);
4729
4730         hci_dev_lock(hdev);
4731
4732         if (mgmt_pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
4733                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
4734                                 MGMT_STATUS_BUSY);
4735                 goto unlocked;
4736         }
4737
4738         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
4739         if (!cmd) {
4740                 err = -ENOMEM;
4741                 goto unlocked;
4742         }
4743
4744         hci_req_init(&req, hdev);
4745
4746         hci_req_add(&req, HCI_OP_LE_ADD_DEV_WHITE_LIST, sizeof(*cp), cp);
4747
4748         err = hci_req_run(&req, add_white_list_complete);
4749         if (err < 0) {
4750                 mgmt_pending_remove(cmd);
4751                 goto unlocked;
4752         }
4753
4754 unlocked:
4755         hci_dev_unlock(hdev);
4756
4757         return err;
4758 }
4759
4760 static void remove_from_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4761 {
4762         struct mgmt_cp_remove_dev_from_white_list *cp;
4763         struct pending_cmd *cmd;
4764
4765         BT_DBG("status 0x%02x", status);
4766
4767         hci_dev_lock(hdev);
4768
4769         cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
4770         if (!cmd)
4771                 goto unlock;
4772
4773         cp = cmd->param;
4774
4775         if (status)
4776                 cmd_status(cmd->sk, hdev->id, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
4777                            mgmt_status(status));
4778         else
4779                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
4780                              cp, sizeof(*cp));
4781
4782         mgmt_pending_remove(cmd);
4783
4784 unlock:
4785         hci_dev_unlock(hdev);
4786 }
4787
4788 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
4789                            void *data, u16 len)
4790 {
4791         struct pending_cmd *cmd;
4792         struct mgmt_cp_remove_dev_from_white_list *cp = data;
4793         struct hci_request req;
4794         int err;
4795
4796         BT_DBG("%s", hdev->name);
4797
4798         if (!lmp_le_capable(hdev))
4799                 return cmd_status(sk, hdev->id, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
4800                                   MGMT_STATUS_NOT_SUPPORTED);
4801
4802         if (!hdev_is_powered(hdev))
4803                 return cmd_status(sk, hdev->id, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
4804                                   MGMT_STATUS_REJECTED);
4805
4806         hci_dev_lock(hdev);
4807
4808         if (mgmt_pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
4809                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
4810                                 MGMT_STATUS_BUSY);
4811                 goto unlocked;
4812         }
4813
4814         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev, data, len);
4815         if (!cmd) {
4816                 err = -ENOMEM;
4817                 goto unlocked;
4818         }
4819
4820         hci_req_init(&req, hdev);
4821
4822         hci_req_add(&req, HCI_OP_LE_REMOVE_FROM_DEV_WHITE_LIST, sizeof(*cp), cp);
4823
4824         err = hci_req_run(&req, remove_from_white_list_complete);
4825         if (err < 0) {
4826                 mgmt_pending_remove(cmd);
4827                 goto unlocked;
4828         }
4829
4830 unlocked:
4831         hci_dev_unlock(hdev);
4832
4833         return err;
4834 }
4835
4836 static void clear_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4837 {
4838         struct pending_cmd *cmd;
4839
4840         BT_DBG("status 0x%02x", status);
4841
4842         hci_dev_lock(hdev);
4843
4844         cmd = mgmt_pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
4845         if (!cmd)
4846                 goto unlock;
4847
4848         if (status)
4849                 cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
4850                            mgmt_status(status));
4851         else
4852                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST, 0,
4853                              NULL, 0);
4854
4855         mgmt_pending_remove(cmd);
4856
4857 unlock:
4858         hci_dev_unlock(hdev);
4859 }
4860
4861 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
4862                            void *data, u16 len)
4863 {
4864         struct pending_cmd *cmd;
4865         struct hci_request req;
4866         int err;
4867
4868         BT_DBG("%s", hdev->name);
4869
4870         if (!lmp_le_capable(hdev))
4871                 return cmd_status(sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
4872                                   MGMT_STATUS_NOT_SUPPORTED);
4873
4874         if (!hdev_is_powered(hdev))
4875                 return cmd_status(sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
4876                                   MGMT_STATUS_REJECTED);
4877
4878         hci_dev_lock(hdev);
4879
4880         if (mgmt_pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
4881                 err = cmd_status(sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
4882                                 MGMT_STATUS_BUSY);
4883                 goto unlocked;
4884         }
4885
4886         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev, NULL, 0);
4887         if (!cmd) {
4888                 err = -ENOMEM;
4889                 goto unlocked;
4890         }
4891
4892         hci_req_init(&req, hdev);
4893
4894         hci_req_add(&req, HCI_OP_LE_CLEAR_DEV_WHITE_LIST, 0, NULL);
4895
4896         err = hci_req_run(&req, clear_white_list_complete);
4897         if (err < 0) {
4898                 mgmt_pending_remove(cmd);
4899                 goto unlocked;
4900         }
4901
4902 unlocked:
4903         hci_dev_unlock(hdev);
4904
4905         return err;
4906 }
4907
4908 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
4909 {
4910         struct pending_cmd *cmd;
4911         u8 type;
4912         int err;
4913
4914         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
4915
4916         cmd = mgmt_pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
4917         if (!cmd)
4918                 return -ENOENT;
4919
4920         type = hdev->le_discovery.type;
4921
4922         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4923                            &type, sizeof(type));
4924         mgmt_pending_remove(cmd);
4925
4926         return err;
4927 }
4928
4929 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4930 {
4931         unsigned long timeout = 0;
4932
4933         BT_DBG("status %d", status);
4934
4935         if (status) {
4936                 hci_dev_lock(hdev);
4937                 mgmt_start_le_discovery_failed(hdev, status);
4938                 hci_dev_unlock(hdev);
4939                 return;
4940         }
4941
4942         hci_dev_lock(hdev);
4943         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
4944         hci_dev_unlock(hdev);
4945
4946         switch (hdev->le_discovery.type) {
4947         case DISCOV_TYPE_LE:
4948 /* BEGIN TIZEN_Bluetooth :: Keep going on LE Scan  */
4949 #if 0
4950                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4951 #endif
4952 /* END TIZEN_Bluetooth */
4953                 break;
4954
4955         default:
4956                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
4957         }
4958
4959         if (!timeout)
4960                 return;
4961
4962         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
4963 }
4964
4965 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
4966                            void *data, u16 len)
4967 {
4968         struct mgmt_cp_start_le_discovery *cp = data;
4969         struct pending_cmd *cmd;
4970         struct hci_cp_le_set_scan_param param_cp;
4971         struct hci_cp_le_set_scan_enable enable_cp;
4972         struct hci_request req;
4973         u8 status, own_addr_type;
4974         int err;
4975
4976         BT_DBG("%s", hdev->name);
4977
4978         hci_dev_lock(hdev);
4979
4980         if (!hdev_is_powered(hdev)) {
4981                 err = cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
4982                                  MGMT_STATUS_NOT_POWERED);
4983                 goto failed;
4984         }
4985
4986         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
4987                 err = cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
4988                                  MGMT_STATUS_BUSY);
4989                 goto failed;
4990         }
4991
4992         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
4993         if (!cmd) {
4994                 err = -ENOMEM;
4995                 goto failed;
4996         }
4997
4998         hdev->le_discovery.type = cp->type;
4999
5000         hci_req_init(&req, hdev);
5001
5002         switch (hdev->le_discovery.type) {
5003         case DISCOV_TYPE_LE:
5004                 status = mgmt_le_support(hdev);
5005                 if (status) {
5006                         err = cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
5007                                          status);
5008                         mgmt_pending_remove(cmd);
5009                         goto failed;
5010                 }
5011
5012                 /* If controller is scanning, it means the background scanning
5013                  * is running. Thus, we should temporarily stop it in order to
5014                  * set the discovery scanning parameters.
5015                  */
5016                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
5017                         hci_req_add_le_scan_disable(&req);
5018
5019                 memset(&param_cp, 0, sizeof(param_cp));
5020
5021                 /* All active scans will be done with either a resolvable
5022                  * private address (when privacy feature has been enabled)
5023                  * or unresolvable private address.
5024                  */
5025                 err = hci_update_random_address(&req, true, &own_addr_type);
5026                 if (err < 0) {
5027                         err = cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
5028                                          MGMT_STATUS_FAILED);
5029                         mgmt_pending_remove(cmd);
5030                         goto failed;
5031                 }
5032
5033                 param_cp.type = hdev->le_scan_type;
5034                 param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
5035                 param_cp.window = cpu_to_le16(hdev->le_scan_window);
5036                 param_cp.own_address_type = own_addr_type;
5037                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
5038                             &param_cp);
5039
5040                 memset(&enable_cp, 0, sizeof(enable_cp));
5041                 enable_cp.enable = LE_SCAN_ENABLE;
5042                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
5043
5044                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
5045                             &enable_cp);
5046                 break;
5047
5048         default:
5049                 err = cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
5050                                  MGMT_STATUS_INVALID_PARAMS);
5051                 mgmt_pending_remove(cmd);
5052                 goto failed;
5053         }
5054
5055         err = hci_req_run(&req, start_le_discovery_complete);
5056         if (err < 0)
5057                 mgmt_pending_remove(cmd);
5058         else
5059                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
5060
5061 failed:
5062         hci_dev_unlock(hdev);
5063         return err;
5064 }
5065
5066 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
5067 {
5068         struct pending_cmd *cmd;
5069         int err;
5070
5071         cmd = mgmt_pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
5072         if (!cmd)
5073                 return -ENOENT;
5074
5075         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
5076                            &hdev->le_discovery.type, sizeof(hdev->le_discovery.type));
5077         mgmt_pending_remove(cmd);
5078
5079         return err;
5080 }
5081
5082 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5083 {
5084         BT_DBG("status %d", status);
5085
5086         hci_dev_lock(hdev);
5087
5088         if (status) {
5089                 mgmt_stop_le_discovery_failed(hdev, status);
5090                 goto unlock;
5091         }
5092
5093         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
5094
5095 unlock:
5096         hci_dev_unlock(hdev);
5097 }
5098
5099 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5100                           u16 len)
5101 {
5102         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
5103         struct pending_cmd *cmd;
5104         struct hci_request req;
5105         int err;
5106
5107         BT_DBG("%s", hdev->name);
5108
5109         hci_dev_lock(hdev);
5110
5111         if (!hci_le_discovery_active(hdev)) {
5112                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
5113                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
5114                                    sizeof(mgmt_cp->type));
5115                 goto unlock;
5116         }
5117
5118         if (hdev->le_discovery.type != mgmt_cp->type) {
5119                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
5120                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
5121                                    sizeof(mgmt_cp->type));
5122                 goto unlock;
5123         }
5124
5125         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
5126         if (!cmd) {
5127                 err = -ENOMEM;
5128                 goto unlock;
5129         }
5130
5131         hci_req_init(&req, hdev);
5132
5133         switch (hdev->le_discovery.state) {
5134         case DISCOVERY_FINDING:
5135                 cancel_delayed_work(&hdev->le_scan_disable);
5136                 hci_req_add_le_scan_disable(&req);
5137                 break;
5138
5139         default:
5140                 BT_DBG("unknown le discovery state %u", hdev->le_discovery.state);
5141
5142                 mgmt_pending_remove(cmd);
5143                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
5144                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
5145                                    sizeof(mgmt_cp->type));
5146                 goto unlock;
5147         }
5148
5149         err = hci_req_run(&req, stop_le_discovery_complete);
5150         if (err < 0)
5151                 mgmt_pending_remove(cmd);
5152         else
5153                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
5154
5155 unlock:
5156         hci_dev_unlock(hdev);
5157         return err;
5158 }
5159
5160 /* BEGIN TIZEN_Bluetooth :: LE auto connect */
5161 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
5162                         void *data, u16 len)
5163 {
5164         int err;
5165
5166         BT_DBG("%s", hdev->name);
5167
5168         hci_dev_lock(hdev);
5169
5170         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
5171         if (err < 0) {
5172                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
5173         }
5174
5175         hci_dev_unlock(hdev);
5176
5177         return err;
5178 }
5179 /* END TIZEN_Bluetooth */
5180
5181 /* BEGIN TIZEN_Bluetooth :: LE connection Update */
5182 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
5183                         u16 len)
5184 {
5185         struct mgmt_cp_le_conn_update *cp = data;
5186
5187         struct hci_conn *conn;
5188         u16 min, max, latency, supervision_timeout;
5189         int err = -1;
5190
5191         if (!hdev_is_powered(hdev))
5192                 return cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
5193                                 MGMT_STATUS_NOT_POWERED);
5194
5195         min     = __le16_to_cpu(cp->conn_interval_min);
5196         max     = __le16_to_cpu(cp->conn_interval_max);
5197         latency     = __le16_to_cpu(cp->conn_latency);
5198         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
5199
5200         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
5201                         min, max, latency, supervision_timeout);
5202
5203         err = check_le_conn_update_param(min, max, latency, supervision_timeout);
5204
5205         if (err < 0) {
5206                 err = cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
5207                                 MGMT_STATUS_INVALID_PARAMS);
5208
5209                 goto done;
5210         }
5211
5212         hci_dev_lock(hdev);
5213         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
5214
5215         if (!conn) {
5216                 cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
5217                                 MGMT_STATUS_NOT_CONNECTED);
5218                 goto done;
5219         }
5220
5221         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
5222
5223         err = cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
5224                                 NULL, 0);
5225 done:
5226         hci_dev_unlock(hdev);
5227         return err;
5228 }
5229
5230 static int set_dev_rpa_res_support(struct sock *sk, struct hci_dev *hdev,
5231                                    void *data, u16 len)
5232 {
5233         struct mgmt_cp_set_dev_rpa_res_support *cp = data;
5234         int err;
5235
5236         BT_DBG("Set resolve RPA as %u for %s", cp->res_support, hdev->name);
5237
5238         hci_dev_lock(hdev);
5239
5240         if (!lmp_le_capable(hdev)) {
5241                 err = cmd_status(sk, hdev->id,
5242                                  MGMT_OP_SET_DEV_RPA_RES_SUPPORT,
5243                                  MGMT_STATUS_NOT_SUPPORTED);
5244                 goto unlocked;
5245         }
5246
5247         if (!hdev_is_powered(hdev)) {
5248                 err = cmd_status(sk, hdev->id,
5249                                  MGMT_OP_SET_DEV_RPA_RES_SUPPORT,
5250                                  MGMT_STATUS_REJECTED);
5251                 goto unlocked;
5252         }
5253
5254         if (hci_set_rpa_res_support(hdev, &cp->addr.bdaddr, cp->addr.type,
5255                                     cp->res_support)) {
5256                 err = cmd_complete(sk, hdev->id,
5257                                    MGMT_OP_SET_DEV_RPA_RES_SUPPORT,
5258                                    MGMT_STATUS_NOT_PAIRED, NULL, 0);
5259                 goto unlocked;
5260         }
5261
5262         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_RPA_RES_SUPPORT,
5263                            MGMT_STATUS_SUCCESS, NULL, 0);
5264
5265 unlocked:
5266         hci_dev_unlock(hdev);
5267         return err;
5268 }
5269
5270 static int set_irk(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5271                    u16 len)
5272 {
5273         struct mgmt_cp_set_irk *cp = cp_data;
5274         int err;
5275
5276         BT_DBG("request for %s", hdev->name);
5277
5278         hci_dev_lock(hdev);
5279
5280         if (!lmp_le_capable(hdev)) {
5281                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_IRK,
5282                                  MGMT_STATUS_NOT_SUPPORTED);
5283                 goto unlocked;
5284         }
5285
5286         memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5287
5288         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_IRK, 0, NULL, 0);
5289
5290 unlocked:
5291         hci_dev_unlock(hdev);
5292         return err;
5293 }
5294 /* END TIZEN_Bluetooth */
5295 #endif
5296
5297 static void fast_connectable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5298 {
5299         struct pending_cmd *cmd;
5300
5301         BT_DBG("status 0x%02x", status);
5302
5303         hci_dev_lock(hdev);
5304
5305         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5306         if (!cmd)
5307                 goto unlock;
5308
5309         if (status) {
5310                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5311                            mgmt_status(status));
5312         } else {
5313                 struct mgmt_mode *cp = cmd->param;
5314
5315                 if (cp->val)
5316                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
5317                 else
5318                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
5319
5320                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5321                 new_settings(hdev, cmd->sk);
5322         }
5323
5324         mgmt_pending_remove(cmd);
5325
5326 unlock:
5327         hci_dev_unlock(hdev);
5328 }
5329
5330 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5331                                 void *data, u16 len)
5332 {
5333         struct mgmt_mode *cp = data;
5334         struct pending_cmd *cmd;
5335         struct hci_request req;
5336         int err;
5337
5338         BT_DBG("%s", hdev->name);
5339
5340         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
5341             hdev->hci_ver < BLUETOOTH_VER_1_2)
5342                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5343                                   MGMT_STATUS_NOT_SUPPORTED);
5344
5345         if (cp->val != 0x00 && cp->val != 0x01)
5346                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5347                                   MGMT_STATUS_INVALID_PARAMS);
5348
5349         if (!hdev_is_powered(hdev))
5350                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5351                                   MGMT_STATUS_NOT_POWERED);
5352
5353         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
5354                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5355                                   MGMT_STATUS_REJECTED);
5356
5357         hci_dev_lock(hdev);
5358
5359         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5360                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5361                                  MGMT_STATUS_BUSY);
5362                 goto unlock;
5363         }
5364
5365         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
5366                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5367                                         hdev);
5368                 goto unlock;
5369         }
5370
5371         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5372                                data, len);
5373         if (!cmd) {
5374                 err = -ENOMEM;
5375                 goto unlock;
5376         }
5377
5378         hci_req_init(&req, hdev);
5379
5380         write_fast_connectable(&req, cp->val);
5381
5382         err = hci_req_run(&req, fast_connectable_complete);
5383         if (err < 0) {
5384                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5385                                  MGMT_STATUS_FAILED);
5386                 mgmt_pending_remove(cmd);
5387         }
5388
5389 unlock:
5390         hci_dev_unlock(hdev);
5391
5392         return err;
5393 }
5394
5395 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5396 {
5397         struct pending_cmd *cmd;
5398
5399         BT_DBG("status 0x%02x", status);
5400
5401         hci_dev_lock(hdev);
5402
5403         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
5404         if (!cmd)
5405                 goto unlock;
5406
5407         if (status) {
5408                 u8 mgmt_err = mgmt_status(status);
5409
5410                 /* We need to restore the flag if related HCI commands
5411                  * failed.
5412                  */
5413                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
5414
5415                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5416         } else {
5417                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5418                 new_settings(hdev, cmd->sk);
5419         }
5420
5421         mgmt_pending_remove(cmd);
5422
5423 unlock:
5424         hci_dev_unlock(hdev);
5425 }
5426
5427 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5428 {
5429         struct mgmt_mode *cp = data;
5430         struct pending_cmd *cmd;
5431         struct hci_request req;
5432         int err;
5433
5434         BT_DBG("request for %s", hdev->name);
5435
5436         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5437                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5438                                   MGMT_STATUS_NOT_SUPPORTED);
5439
5440         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
5441                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5442                                   MGMT_STATUS_REJECTED);
5443
5444         if (cp->val != 0x00 && cp->val != 0x01)
5445                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5446                                   MGMT_STATUS_INVALID_PARAMS);
5447
5448         hci_dev_lock(hdev);
5449
5450         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5451                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5452                 goto unlock;
5453         }
5454
5455         if (!hdev_is_powered(hdev)) {
5456                 if (!cp->val) {
5457                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5458                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5459                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5460                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
5461                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5462                 }
5463
5464                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
5465
5466                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5467                 if (err < 0)
5468                         goto unlock;
5469
5470                 err = new_settings(hdev, sk);
5471                 goto unlock;
5472         }
5473
5474         /* Reject disabling when powered on */
5475         if (!cp->val) {
5476                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5477                                  MGMT_STATUS_REJECTED);
5478                 goto unlock;
5479         } else {
5480                 /* When configuring a dual-mode controller to operate
5481                  * with LE only and using a static address, then switching
5482                  * BR/EDR back on is not allowed.
5483                  *
5484                  * Dual-mode controllers shall operate with the public
5485                  * address as its identity address for BR/EDR and LE. So
5486                  * reject the attempt to create an invalid configuration.
5487                  *
5488                  * The same restrictions applies when secure connections
5489                  * has been enabled. For BR/EDR this is a controller feature
5490                  * while for LE it is a host stack feature. This means that
5491                  * switching BR/EDR back on when secure connections has been
5492                  * enabled is not a supported transaction.
5493                  */
5494                 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
5495                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5496                      test_bit(HCI_SC_ENABLED, &hdev->dev_flags))) {
5497                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5498                                          MGMT_STATUS_REJECTED);
5499                         goto unlock;
5500                 }
5501         }
5502
5503         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
5504                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5505                                  MGMT_STATUS_BUSY);
5506                 goto unlock;
5507         }
5508
5509         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5510         if (!cmd) {
5511                 err = -ENOMEM;
5512                 goto unlock;
5513         }
5514
5515         /* We need to flip the bit already here so that update_adv_data
5516          * generates the correct flags.
5517          */
5518         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
5519
5520         hci_req_init(&req, hdev);
5521
5522         write_fast_connectable(&req, false);
5523         __hci_update_page_scan(&req);
5524
5525         /* Since only the advertising data flags will change, there
5526          * is no need to update the scan response data.
5527          */
5528         update_adv_data(&req);
5529
5530         err = hci_req_run(&req, set_bredr_complete);
5531         if (err < 0)
5532                 mgmt_pending_remove(cmd);
5533
5534 unlock:
5535         hci_dev_unlock(hdev);
5536         return err;
5537 }
5538
5539 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5540 {
5541         struct pending_cmd *cmd;
5542         struct mgmt_mode *cp;
5543
5544         BT_DBG("%s status %u", hdev->name, status);
5545
5546         hci_dev_lock(hdev);
5547
5548         cmd = mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5549         if (!cmd)
5550                 goto unlock;
5551
5552         if (status) {
5553                 cmd_status(cmd->sk, cmd->index, cmd->opcode,
5554                            mgmt_status(status));
5555                 goto remove;
5556         }
5557
5558         cp = cmd->param;
5559
5560         switch (cp->val) {
5561         case 0x00:
5562                 clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5563                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5564                 break;
5565         case 0x01:
5566                 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5567                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5568                 break;
5569         case 0x02:
5570                 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5571                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
5572                 break;
5573         }
5574
5575         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5576         new_settings(hdev, cmd->sk);
5577
5578 remove:
5579         mgmt_pending_remove(cmd);
5580 unlock:
5581         hci_dev_unlock(hdev);
5582 }
5583
5584 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5585                            void *data, u16 len)
5586 {
5587         struct mgmt_mode *cp = data;
5588         struct pending_cmd *cmd;
5589         struct hci_request req;
5590         u8 val;
5591         int err;
5592
5593         BT_DBG("request for %s", hdev->name);
5594
5595         if (!lmp_sc_capable(hdev) &&
5596             !test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
5597                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5598                                   MGMT_STATUS_NOT_SUPPORTED);
5599
5600         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
5601             !test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
5602                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5603                                   MGMT_STATUS_REJECTED);
5604
5605         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5606                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5607                                   MGMT_STATUS_INVALID_PARAMS);
5608
5609         hci_dev_lock(hdev);
5610
5611         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5612             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5613                 bool changed;
5614
5615                 if (cp->val) {
5616                         changed = !test_and_set_bit(HCI_SC_ENABLED,
5617                                                     &hdev->dev_flags);
5618                         if (cp->val == 0x02)
5619                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
5620                         else
5621                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5622                 } else {
5623                         changed = test_and_clear_bit(HCI_SC_ENABLED,
5624                                                      &hdev->dev_flags);
5625                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5626                 }
5627
5628                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5629                 if (err < 0)
5630                         goto failed;
5631
5632                 if (changed)
5633                         err = new_settings(hdev, sk);
5634
5635                 goto failed;
5636         }
5637
5638         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5639                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5640                                  MGMT_STATUS_BUSY);
5641                 goto failed;
5642         }
5643
5644         val = !!cp->val;
5645
5646         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
5647             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
5648                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5649                 goto failed;
5650         }
5651
5652         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5653         if (!cmd) {
5654                 err = -ENOMEM;
5655                 goto failed;
5656         }
5657
5658         hci_req_init(&req, hdev);
5659         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5660         err = hci_req_run(&req, sc_enable_complete);
5661         if (err < 0) {
5662                 mgmt_pending_remove(cmd);
5663                 goto failed;
5664         }
5665
5666 failed:
5667         hci_dev_unlock(hdev);
5668         return err;
5669 }
5670
5671 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5672                           void *data, u16 len)
5673 {
5674         struct mgmt_mode *cp = data;
5675         bool changed, use_changed;
5676         int err;
5677
5678         BT_DBG("request for %s", hdev->name);
5679
5680         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5681                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5682                                   MGMT_STATUS_INVALID_PARAMS);
5683
5684         hci_dev_lock(hdev);
5685
5686         if (cp->val)
5687                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
5688                                             &hdev->dev_flags);
5689         else
5690                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
5691                                              &hdev->dev_flags);
5692
5693         if (cp->val == 0x02)
5694                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
5695                                                 &hdev->dev_flags);
5696         else
5697                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
5698                                                  &hdev->dev_flags);
5699
5700         if (hdev_is_powered(hdev) && use_changed &&
5701             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
5702                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5703                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5704                              sizeof(mode), &mode);
5705         }
5706
5707         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5708         if (err < 0)
5709                 goto unlock;
5710
5711         if (changed)
5712                 err = new_settings(hdev, sk);
5713
5714 unlock:
5715         hci_dev_unlock(hdev);
5716         return err;
5717 }
5718
5719 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5720                        u16 len)
5721 {
5722         struct mgmt_cp_set_privacy *cp = cp_data;
5723         bool changed;
5724         int err;
5725
5726         BT_DBG("request for %s", hdev->name);
5727
5728         if (!lmp_le_capable(hdev))
5729                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5730                                   MGMT_STATUS_NOT_SUPPORTED);
5731
5732         if (cp->privacy != 0x00 && cp->privacy != 0x01)
5733                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5734                                   MGMT_STATUS_INVALID_PARAMS);
5735
5736 /* Not sure why below condition is required; commenting for now,
5737         * since set privacy command is always rejected if this condition is enabled.
5738         */
5739 #ifndef CONFIG_TIZEN_WIP
5740         if (hdev_is_powered(hdev))
5741                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5742                                   MGMT_STATUS_REJECTED);
5743 #endif
5744
5745         hci_dev_lock(hdev);
5746
5747         /* If user space supports this command it is also expected to
5748          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5749          */
5750         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5751
5752         if (cp->privacy) {
5753                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
5754                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5755                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
5756         } else {
5757                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
5758                 memset(hdev->irk, 0, sizeof(hdev->irk));
5759                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
5760         }
5761
5762         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5763         if (err < 0)
5764                 goto unlock;
5765
5766         if (changed)
5767                 err = new_settings(hdev, sk);
5768
5769 unlock:
5770         hci_dev_unlock(hdev);
5771         return err;
5772 }
5773
5774 static bool irk_is_valid(struct mgmt_irk_info *irk)
5775 {
5776         switch (irk->addr.type) {
5777         case BDADDR_LE_PUBLIC:
5778                 return true;
5779
5780         case BDADDR_LE_RANDOM:
5781                 /* Two most significant bits shall be set */
5782                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5783                         return false;
5784                 return true;
5785         }
5786
5787         return false;
5788 }
5789
5790 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5791                      u16 len)
5792 {
5793         struct mgmt_cp_load_irks *cp = cp_data;
5794         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5795                                    sizeof(struct mgmt_irk_info));
5796         u16 irk_count, expected_len;
5797         int i, err;
5798
5799         BT_DBG("request for %s", hdev->name);
5800
5801         if (!lmp_le_capable(hdev))
5802                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5803                                   MGMT_STATUS_NOT_SUPPORTED);
5804
5805         irk_count = __le16_to_cpu(cp->irk_count);
5806         if (irk_count > max_irk_count) {
5807                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5808                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5809                                   MGMT_STATUS_INVALID_PARAMS);
5810         }
5811
5812         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5813         if (expected_len != len) {
5814                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5815                        expected_len, len);
5816                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5817                                   MGMT_STATUS_INVALID_PARAMS);
5818         }
5819
5820         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5821
5822         for (i = 0; i < irk_count; i++) {
5823                 struct mgmt_irk_info *key = &cp->irks[i];
5824
5825                 if (!irk_is_valid(key))
5826                         return cmd_status(sk, hdev->id,
5827                                           MGMT_OP_LOAD_IRKS,
5828                                           MGMT_STATUS_INVALID_PARAMS);
5829         }
5830
5831         hci_dev_lock(hdev);
5832
5833         hci_smp_irks_clear(hdev);
5834
5835         for (i = 0; i < irk_count; i++) {
5836                 struct mgmt_irk_info *irk = &cp->irks[i];
5837                 u8 addr_type;
5838
5839                 if (irk->addr.type == BDADDR_LE_PUBLIC)
5840                         addr_type = ADDR_LE_DEV_PUBLIC;
5841                 else
5842                         addr_type = ADDR_LE_DEV_RANDOM;
5843
5844                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5845                             BDADDR_ANY);
5846         }
5847
5848         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5849
5850         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5851
5852         hci_dev_unlock(hdev);
5853
5854         return err;
5855 }
5856
5857 #ifdef CONFIG_TIZEN_WIP
5858 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
5859                                   void *data, u16 len)
5860 {
5861         struct mgmt_cp_set_advertising_params *cp = data;
5862         __u16 min_interval;
5863         __u16 max_interval;
5864         int err;
5865
5866         BT_DBG("%s", hdev->name);
5867
5868         if (!lmp_le_capable(hdev))
5869                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_PARAMS,
5870                                 MGMT_STATUS_NOT_SUPPORTED);
5871
5872         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5873                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_PARAMS,
5874                                 MGMT_STATUS_BUSY);
5875
5876         min_interval = __le16_to_cpu(cp->interval_min);
5877         max_interval = __le16_to_cpu(cp->interval_max);
5878
5879         if (min_interval > max_interval ||
5880             min_interval < 0x0020 || max_interval > 0x4000)
5881                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_PARAMS,
5882                                 MGMT_STATUS_INVALID_PARAMS);
5883
5884         hci_dev_lock(hdev);
5885
5886         hdev->le_adv_min_interval = min_interval;
5887         hdev->le_adv_max_interval = max_interval;
5888         hdev->adv_filter_policy = cp->filter_policy;
5889         hdev->adv_type = cp->type;
5890
5891         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
5892
5893         hci_dev_unlock(hdev);
5894
5895         return err;
5896 }
5897
5898 static void set_advertising_data_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5899 {
5900         struct mgmt_cp_set_advertising_data *cp;
5901         struct pending_cmd *cmd;
5902
5903         BT_DBG("status 0x%02x", status);
5904
5905         hci_dev_lock(hdev);
5906
5907         cmd = mgmt_pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
5908         if (!cmd)
5909                 goto unlock;
5910
5911         cp = cmd->param;
5912
5913         if (status)
5914                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_ADVERTISING_DATA,
5915                            mgmt_status(status));
5916         else
5917                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_ADVERTISING_DATA, 0,
5918                              cp, sizeof(*cp));
5919
5920         mgmt_pending_remove(cmd);
5921
5922 unlock:
5923         hci_dev_unlock(hdev);
5924 }
5925
5926 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
5927                                 void *data, u16 len)
5928 {
5929         struct pending_cmd *cmd;
5930         struct hci_request req;
5931         struct mgmt_cp_set_advertising_data *cp = data;
5932         struct hci_cp_le_set_adv_data adv;
5933         int err;
5934
5935         BT_DBG("%s", hdev->name);
5936
5937         if (!lmp_le_capable(hdev)) {
5938                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_DATA,
5939                                 MGMT_STATUS_NOT_SUPPORTED);
5940         }
5941
5942         hci_dev_lock(hdev);
5943
5944         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
5945                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_DATA,
5946                                 MGMT_STATUS_BUSY);
5947                 goto unlocked;
5948         }
5949
5950         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
5951                                hdev, data, len);
5952         if (!cmd) {
5953                 err = -ENOMEM;
5954                 goto unlocked;
5955         }
5956
5957         if (len > HCI_MAX_AD_LENGTH) {
5958                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_DATA,
5959                                  MGMT_STATUS_INVALID_PARAMS);
5960                 goto unlocked;
5961         }
5962
5963         hci_req_init(&req, hdev);
5964
5965         memset(&adv, 0, sizeof(adv));
5966         memcpy(adv.data, cp->data, len);
5967         adv.length = len;
5968
5969         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
5970
5971         err = hci_req_run(&req, set_advertising_data_complete);
5972         if (err < 0) {
5973                 mgmt_pending_remove(cmd);
5974         }
5975
5976 unlocked:
5977         hci_dev_unlock(hdev);
5978
5979         return err;
5980 }
5981
5982 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5983 {
5984         struct mgmt_cp_set_scan_rsp_data *cp;
5985         struct pending_cmd *cmd;
5986
5987         BT_DBG("status 0x%02x", status);
5988
5989         hci_dev_lock(hdev);
5990
5991         cmd = mgmt_pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
5992         if (!cmd)
5993                 goto unlock;
5994
5995         cp = cmd->param;
5996
5997         if (status)
5998                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
5999                            mgmt_status(status));
6000         else
6001                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA, 0,
6002                              cp, sizeof(*cp));
6003
6004         mgmt_pending_remove(cmd);
6005
6006 unlock:
6007         hci_dev_unlock(hdev);
6008 }
6009
6010 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
6011                              u16 len)
6012 {
6013         struct pending_cmd *cmd;
6014         struct hci_request req;
6015         struct mgmt_cp_set_scan_rsp_data *cp = data;
6016         struct hci_cp_le_set_scan_rsp_data rsp;
6017         int err;
6018
6019         BT_DBG("%s", hdev->name);
6020
6021         if (!lmp_le_capable(hdev))
6022                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6023                                 MGMT_STATUS_NOT_SUPPORTED);
6024
6025         hci_dev_lock(hdev);
6026
6027         if (mgmt_pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
6028                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6029                                 MGMT_STATUS_BUSY);
6030                 goto unlocked;
6031         }
6032
6033         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
6034         if (!cmd) {
6035                 err = -ENOMEM;
6036                 goto unlocked;
6037         }
6038         if (len > HCI_MAX_AD_LENGTH) {
6039                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6040                                  MGMT_STATUS_INVALID_PARAMS);
6041                 goto unlocked;
6042         }
6043
6044         hci_req_init(&req, hdev);
6045
6046         memset(&rsp, 0, sizeof(rsp));
6047         memcpy(rsp.data, cp->data, len);
6048         rsp.length = len;
6049
6050         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
6051
6052         err = hci_req_run(&req, set_scan_rsp_data_complete);
6053         if (err < 0) {
6054                 mgmt_pending_remove(cmd);
6055         }
6056
6057 unlocked:
6058         hci_dev_unlock(hdev);
6059
6060         return err;
6061 }
6062
6063 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6064 {
6065         struct mgmt_cp_set_manufacturer_data *cp;
6066         struct pending_cmd *cmd;
6067
6068         BT_DBG("status 0x%02x", status);
6069
6070         hci_dev_lock(hdev);
6071
6072         cmd = mgmt_pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
6073         if (!cmd)
6074                 goto unlock;
6075
6076         cp = cmd->param;
6077
6078         if (status)
6079                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
6080                            mgmt_status(status));
6081         else
6082                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA, 0,
6083                              cp, sizeof(*cp));
6084
6085         mgmt_pending_remove(cmd);
6086
6087 unlock:
6088         hci_dev_unlock(hdev);
6089 }
6090
6091 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
6092                                         void *data, u16 len)
6093 {
6094         struct pending_cmd *cmd;
6095         struct hci_request req;
6096         struct mgmt_cp_set_manufacturer_data *cp = data;
6097         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
6098         u8 old_len;
6099
6100         int err;
6101
6102         BT_DBG("%s", hdev->name);
6103
6104         if (!lmp_bredr_capable(hdev)) {
6105                 return cmd_status(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
6106                                 MGMT_STATUS_NOT_SUPPORTED);
6107         }
6108
6109         if (cp->data[0] == 0 ||
6110                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data)) {
6111                 return cmd_status(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
6112                                 MGMT_STATUS_INVALID_PARAMS);
6113         }
6114
6115         if (cp->data[1] != 0xFF) {
6116                 return cmd_status(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
6117                                 MGMT_STATUS_NOT_SUPPORTED);
6118         }
6119
6120         hci_dev_lock(hdev);
6121
6122         if (mgmt_pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
6123                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
6124                                 MGMT_STATUS_BUSY);
6125                 goto unlocked;
6126         }
6127
6128         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data, len);
6129         if (!cmd) {
6130                 err = -ENOMEM;
6131                 goto unlocked;
6132         }
6133
6134         hci_req_init(&req, hdev);
6135
6136         /* if new data is same as previous data then return command complete event*/
6137         if (hdev->manufacturer_len == cp->data[0] - 1 &&
6138             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
6139                 mgmt_pending_remove(cmd);
6140                 cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA, 0,
6141                                 cp, sizeof(*cp));
6142                 hci_dev_unlock(hdev);
6143                 return 0;
6144         }
6145
6146         old_len = hdev->manufacturer_len;
6147         if (old_len > 0) {
6148                 memcpy(old_data, hdev->manufacturer_data, old_len);
6149         }
6150
6151         hdev->manufacturer_len = cp->data[0] - 1;
6152         if (hdev->manufacturer_len > 0) {
6153                 memcpy(hdev->manufacturer_data, cp->data + 2, hdev->manufacturer_len);
6154         }
6155
6156         update_eir(&req);
6157
6158         err = hci_req_run(&req, set_manufacturer_data_complete);
6159         if (err < 0) {
6160                 mgmt_pending_remove(cmd);
6161                 goto failed;
6162         }
6163
6164 unlocked:
6165         hci_dev_unlock(hdev);
6166
6167         return err;
6168
6169 failed:
6170         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
6171         hdev->manufacturer_len = old_len;
6172         if (hdev->manufacturer_len > 0) {
6173                 memcpy(hdev->manufacturer_data, old_data,
6174                        hdev->manufacturer_len);
6175         }
6176         hci_dev_unlock(hdev);
6177         return err;
6178 }
6179
6180 #ifdef CONFIG_TIZEN_WIP
6181 static int set_voice_setting(struct sock *sk, struct hci_dev *hdev,
6182                                         void *data, u16 len)
6183 {
6184         struct mgmt_cp_set_voice_setting *cp = data;
6185         struct hci_conn *conn;
6186         struct hci_conn *sco_conn;
6187
6188         int err;
6189
6190         BT_DBG("%s", hdev->name);
6191
6192         if (!lmp_bredr_capable(hdev)) {
6193                 return cmd_status(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING,
6194                                 MGMT_STATUS_NOT_SUPPORTED);
6195         }
6196
6197         hci_dev_lock(hdev);
6198
6199         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
6200         if (!conn) {
6201                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
6202                                 NULL, 0);
6203                 goto unlock;
6204         }
6205
6206         conn->voice_setting = cp->voice_setting;
6207         conn->sco_role = cp->sco_role;
6208
6209         sco_conn = hci_conn_hash_lookup_sco(hdev);
6210         if (sco_conn && bacmp(&sco_conn->dst, &cp->bdaddr) != 0) {
6211                 BT_ERR("There is other SCO connection.");
6212                 goto done;
6213         }
6214
6215         if (conn->sco_role == MGMT_SCO_ROLE_HANDSFREE) {
6216                 if (conn->voice_setting == 0x0063)
6217                         sco_connect_set_wbc(hdev);
6218                 else
6219                         sco_connect_set_nbc(hdev);
6220         } else {
6221                 if (conn->voice_setting == 0x0063)
6222                         sco_connect_set_gw_wbc(hdev);
6223                 else
6224                         sco_connect_set_gw_nbc(hdev);
6225         }
6226
6227 done:
6228         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
6229                         cp, sizeof(cp));
6230
6231 unlock:
6232         hci_dev_unlock(hdev);
6233         return err;
6234 }
6235 #endif
6236
6237 static int get_adv_tx_power(struct sock *sk, struct hci_dev *hdev,
6238                            void *data, u16 len)
6239 {
6240         struct mgmt_rp_get_adv_tx_power *rp;
6241         size_t rp_len;
6242         int err;
6243
6244         BT_DBG("%s", hdev->name);
6245
6246         hci_dev_lock(hdev);
6247
6248         rp_len = sizeof(*rp);
6249         rp = kmalloc(rp_len, GFP_KERNEL);
6250         if (!rp) {
6251                 err = -ENOMEM;
6252                 goto unlock;
6253         }
6254
6255         rp->adv_tx_power= hdev->adv_tx_power;
6256
6257         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_TX_POWER, 0, rp,
6258                            rp_len);
6259
6260         kfree(rp);
6261
6262 unlock:
6263         hci_dev_unlock(hdev);
6264
6265         return err;
6266 }
6267
6268 /* BEGIN TIZEN_Bluetooth :: Apply RSSI changes   */
6269 static void set_rssi_threshold_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6270 {
6271         BT_DBG("status 0x%02x", status);
6272 }
6273
6274 static void set_rssi_disable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6275 {
6276         BT_DBG("status 0x%02x", status);
6277 }
6278
6279 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6280                 void *data, u16 len)
6281 {
6282         int err = 0;
6283         struct hci_cp_set_rssi_threshold th = { 0, };
6284         struct mgmt_cp_set_enable_rssi *cp = data;
6285         struct hci_conn *conn;
6286         struct pending_cmd *cmd;
6287         struct hci_request req;
6288         __u8 dest_type;
6289
6290         hci_dev_lock(hdev);
6291
6292         cmd = mgmt_pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6293         if (!cmd) {
6294                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6295                                 MGMT_STATUS_FAILED);
6296                 goto unlocked;
6297         }
6298
6299         if (!lmp_le_capable(hdev)) {
6300                 mgmt_pending_remove(cmd);
6301                 return cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6302                                 MGMT_STATUS_NOT_SUPPORTED);
6303         }
6304
6305         if (!hdev_is_powered(hdev)) {
6306                 BT_DBG("%s", hdev->name);
6307                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6308                                 MGMT_STATUS_NOT_POWERED, data, len);
6309                 mgmt_pending_remove(cmd);
6310                 goto unlocked;
6311         }
6312
6313         if (cp->link_type == 0x01)
6314                 dest_type = LE_LINK;
6315         else
6316                 dest_type = ACL_LINK;
6317
6318         /* Get LE/ACL link handle info*/
6319         conn = hci_conn_hash_lookup_ba(hdev,
6320                         dest_type, &cp->bdaddr);
6321
6322         if (conn == NULL) {
6323                 err = cmd_complete(sk, hdev->id,
6324                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6325                 mgmt_pending_remove(cmd);
6326                 goto unlocked;
6327         }
6328
6329         hci_req_init(&req, hdev);
6330
6331         th.hci_le_ext_opcode = 0x0B;
6332         th.mode = 0x01;
6333         th.conn_handle = conn->handle;
6334         th.alert_mask = 0x07;
6335         th.low_th = cp->low_th;
6336         th.in_range_th = cp->in_range_th;
6337         th.high_th = cp->high_th;
6338
6339         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6340         err = hci_req_run(&req, set_rssi_threshold_complete);
6341
6342         if (err < 0) {
6343                 mgmt_pending_remove(cmd);
6344                 BT_ERR("Error in requesting hci_req_run");
6345                 goto unlocked;
6346         }
6347
6348 unlocked:
6349         hci_dev_unlock(hdev);
6350         return err;
6351 }
6352
6353 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6354                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6355 {
6356         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6357         struct mgmt_cp_set_enable_rssi *cp = data;
6358         struct pending_cmd *cmd;
6359
6360         if (cp == NULL || rp == NULL)
6361                 goto remove_cmd;
6362
6363         mgmt_rp.status = rp->status;
6364         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6365         mgmt_rp.bt_address = cp->bdaddr;
6366         mgmt_rp.link_type = cp->link_type;
6367
6368         cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, MGMT_STATUS_SUCCESS,
6369                         &mgmt_rp, sizeof(struct mgmt_cc_rsp_enable_rssi));
6370
6371         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6372                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6373
6374         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6375         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6376                         &mgmt_rp.bt_address, true);
6377
6378 remove_cmd:
6379         hci_dev_lock(hdev);
6380         cmd = mgmt_pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6381         if (cmd)
6382                 mgmt_pending_remove(cmd);
6383
6384         hci_dev_unlock(hdev);
6385 }
6386
6387 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6388                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6389 {
6390         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6391         struct mgmt_cp_disable_rssi *cp = data;
6392         struct pending_cmd *cmd;
6393
6394         if (cp == NULL || rp == NULL)
6395                 goto remove_cmd;
6396
6397         mgmt_rp.status = rp->status;
6398         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6399         mgmt_rp.bt_address = cp->bdaddr;
6400         mgmt_rp.link_type = cp->link_type;
6401
6402         cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE, MGMT_STATUS_SUCCESS,
6403                         &mgmt_rp, sizeof(struct mgmt_cc_rsp_enable_rssi));
6404
6405         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6406                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6407
6408         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6409                         &mgmt_rp.bt_address, false);
6410
6411
6412 remove_cmd:
6413         hci_dev_lock(hdev);
6414         cmd = mgmt_pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6415         if (cmd)
6416                 mgmt_pending_remove(cmd);
6417
6418         hci_dev_unlock(hdev);
6419 }
6420
6421 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6422                 void *data, u16 len)
6423 {
6424         struct pending_cmd *cmd;
6425         struct hci_request req;
6426         struct hci_cp_set_enable_rssi cp_en = { 0, };
6427         int err;
6428
6429         BT_DBG("Set Disable RSSI.");
6430
6431         cp_en.hci_le_ext_opcode = 0x01;
6432         cp_en.le_enable_cs_Features = 0x00;
6433         cp_en.data[0] = 0x00;
6434         cp_en.data[1] = 0x00;
6435         cp_en.data[2] = 0x00;
6436
6437         hci_dev_lock(hdev);
6438
6439         cmd = mgmt_pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6440         if (!cmd) {
6441                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6442                                 MGMT_STATUS_FAILED);
6443                 goto unlocked;
6444         }
6445
6446         if (!lmp_le_capable(hdev)) {
6447                 mgmt_pending_remove(cmd);
6448                 return cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6449                                 MGMT_STATUS_NOT_SUPPORTED);
6450         }
6451
6452         if (!hdev_is_powered(hdev)) {
6453                 BT_DBG("%s", hdev->name);
6454                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6455                                 MGMT_STATUS_NOT_POWERED, data, len);
6456                 mgmt_pending_remove(cmd);
6457                 goto unlocked;
6458         }
6459
6460         hci_req_init(&req, hdev);
6461
6462         BT_DBG("Enable Len: %d [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6463                         sizeof(struct hci_cp_set_enable_rssi),
6464                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6465                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6466
6467         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6468         err = hci_req_run(&req, set_rssi_disable_complete);
6469
6470         if (err < 0) {
6471                 mgmt_pending_remove(cmd);
6472                 BT_ERR("Error in requesting hci_req_run");
6473                 goto unlocked;
6474         }
6475
6476 unlocked:
6477         hci_dev_unlock(hdev);
6478
6479         return err;
6480
6481 }
6482
6483 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6484 {
6485         struct hci_cc_rsp_enable_rssi *rp = response;
6486         struct pending_cmd *cmd_enable = NULL;
6487         struct pending_cmd *cmd_disable = NULL;
6488         struct mgmt_cp_set_enable_rssi *cp_en;
6489         struct mgmt_cp_disable_rssi *cp_dis;
6490
6491         hci_dev_lock(hdev);
6492         cmd_enable = mgmt_pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6493         cmd_disable = mgmt_pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6494         hci_dev_unlock(hdev);
6495
6496         if(cmd_enable)
6497                 BT_DBG("Enable Request");
6498
6499         if(cmd_disable)
6500                 BT_DBG("Disable Request");
6501
6502         if (cmd_enable) {
6503                 cp_en = cmd_enable->param;
6504
6505                 if (status != 0x00)
6506                         return;
6507
6508                 switch (rp->le_ext_opcode) {
6509                 case 0x01:
6510                         BT_DBG("RSSI enabled.. Setting Threshold...");
6511                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6512                                         cp_en, sizeof(*cp_en));
6513                         break;
6514
6515                 case 0x0B:
6516                         BT_DBG("Sending RSSI enable success");
6517                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6518                                         cp_en, rp, rp->status);
6519                         break;
6520                 }
6521
6522         } else if (cmd_disable) {
6523                 cp_dis = cmd_disable->param;
6524
6525                 if (status != 0x00)
6526                         return;
6527
6528                 switch (rp->le_ext_opcode) {
6529                 case 0x01:
6530                         BT_DBG("Sending RSSI disable success");
6531                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6532                                         cp_dis, rp, rp->status);
6533                         break;
6534
6535                 case 0x0B:
6536                         /* Only unset RSSI Threshold values for the Link if
6537                            RSSI is monitored for other BREDR or LE Links*/
6538                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6539                                 BT_DBG("Unset Threshold. Other links being monitored");
6540                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6541                                                 cp_dis, rp, rp->status);
6542                         } else {
6543                                 BT_DBG("Unset Threshold. Disabling...");
6544                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6545                                                 cp_dis, sizeof(*cp_dis));
6546                         }
6547                         break;
6548                 }
6549         }
6550 }
6551
6552 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6553 {
6554         BT_DBG("status 0x%02x", status);
6555 }
6556
6557 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
6558                 void *data, u16 len)
6559 {
6560         struct pending_cmd *cmd;
6561         struct hci_request req;
6562         struct mgmt_cp_set_enable_rssi *cp = data;
6563         struct hci_cp_set_enable_rssi cp_en = { 0, };
6564         int err;
6565         BT_DBG("Set Enable RSSI.");
6566
6567         cp_en.hci_le_ext_opcode = 0x01;
6568         cp_en.le_enable_cs_Features = 0x04;
6569         cp_en.data[0] = 0x00;
6570         cp_en.data[1] = 0x00;
6571         cp_en.data[2] = 0x00;
6572
6573         if (!lmp_le_capable(hdev))
6574                 return cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6575                                 MGMT_STATUS_NOT_SUPPORTED);
6576
6577         hci_dev_lock(hdev);
6578         if (!hdev_is_powered(hdev)) {
6579                 BT_DBG("%s", hdev->name);
6580                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6581                                    data, len);
6582
6583                 goto unlocked;
6584         }
6585
6586         if (mgmt_pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
6587                 BT_DBG("%s", hdev->name);
6588                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6589                                 MGMT_STATUS_BUSY);
6590                 goto unlocked;
6591         }
6592
6593         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp, sizeof(*cp));
6594         if (!cmd) {
6595                 BT_DBG("%s", hdev->name);
6596                 err = -ENOMEM;
6597                 goto unlocked;
6598         }
6599
6600         /* If RSSI is already enabled directly set Threshold values*/
6601         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
6602                 hci_dev_unlock(hdev);
6603                 BT_DBG("RSSI Enabled. Directly set Threshold");
6604                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
6605                 return err;
6606         }
6607
6608         hci_req_init(&req, hdev);
6609
6610         BT_DBG("Enable Len: %d [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6611                         sizeof(struct hci_cp_set_enable_rssi),
6612                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6613                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6614
6615         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6616         err = hci_req_run(&req, set_rssi_enable_complete);
6617
6618         if (err < 0) {
6619                 mgmt_pending_remove(cmd);
6620                 BT_ERR("Error in requesting hci_req_run");
6621                 goto unlocked;
6622         }
6623
6624 unlocked:
6625         hci_dev_unlock(hdev);
6626
6627         return err;
6628 }
6629
6630 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6631 {
6632         struct pending_cmd *cmd;
6633
6634         BT_DBG("status 0x%02x", status);
6635
6636         hci_dev_lock(hdev);
6637
6638         cmd = mgmt_pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
6639         if (!cmd)
6640                 goto unlock;
6641
6642         cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI, MGMT_STATUS_SUCCESS,
6643                         &status, 1);
6644
6645         mgmt_pending_remove(cmd);
6646
6647 unlock:
6648         hci_dev_unlock(hdev);
6649 }
6650
6651 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
6652                         u16 len)
6653 {
6654         struct pending_cmd *cmd;
6655         struct hci_request req;
6656         struct mgmt_cp_get_raw_rssi *cp = data;
6657         struct hci_cp_get_raw_rssi hci_cp;
6658
6659         struct hci_conn *conn;
6660         int err;
6661         __u8 dest_type;
6662
6663         BT_DBG("Get Raw RSSI.");
6664         if (!lmp_le_capable(hdev))
6665                 return cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6666                                 MGMT_STATUS_NOT_SUPPORTED);
6667
6668         hci_dev_lock(hdev);
6669
6670         if (cp->link_type == 0x01) {
6671                 dest_type = LE_LINK;
6672         } else {
6673                 dest_type = ACL_LINK;
6674         }
6675
6676         /* Get LE/BREDR link handle info*/
6677         conn = hci_conn_hash_lookup_ba(hdev,
6678                         dest_type, &cp->bt_address);
6679         if (conn == NULL) {
6680                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_RAW_RSSI, 1,
6681                                                    data, len);
6682                 goto unlocked;
6683         }
6684         hci_cp.conn_handle = conn->handle;
6685
6686         if (!hdev_is_powered(hdev)) {
6687                 BT_DBG("%s", hdev->name);
6688                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_RAW_RSSI, 0,
6689                                    data, len);
6690
6691                 goto unlocked;
6692         }
6693
6694         if (mgmt_pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
6695                 BT_DBG("%s", hdev->name);
6696                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6697                                 MGMT_STATUS_BUSY);
6698                 goto unlocked;
6699         }
6700
6701         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
6702         if (!cmd) {
6703                 BT_DBG("%s", hdev->name);
6704                 err = -ENOMEM;
6705                 goto unlocked;
6706         }
6707
6708         hci_req_init(&req, hdev);
6709
6710         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
6711         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
6712         err = hci_req_run(&req, get_raw_rssi_complete);
6713
6714         if (err < 0) {
6715                 mgmt_pending_remove(cmd);
6716                 BT_ERR("Error in requesting hci_req_run");
6717         }
6718
6719 unlocked:
6720         hci_dev_unlock(hdev);
6721
6722         return err;
6723 }
6724
6725 void mgmt_raw_rssi_response(struct hci_dev *hdev,
6726                 struct hci_cc_rp_get_raw_rssi *rp, int success)
6727 {
6728         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
6729         struct hci_conn *conn;
6730
6731         mgmt_rp.status = rp->status;
6732         mgmt_rp.rssi_dbm = rp->rssi_dbm;
6733
6734         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
6735         if (conn == NULL)
6736                 return;
6737
6738         bacpy(&mgmt_rp.bt_address, &conn->dst);
6739         if (conn->type == LE_LINK) {
6740                 mgmt_rp.link_type = 0x01;
6741         } else {
6742                 mgmt_rp.link_type = 0x00;
6743         }
6744
6745         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
6746                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
6747 }
6748
6749 static void set_disable_threshold_complete(struct hci_dev *hdev,
6750                         u8 status, u16 opcode)
6751 {
6752         BT_DBG("status 0x%02x", status);
6753 }
6754
6755 /** Removes monitoring for a link*/
6756 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
6757                 void *data, u16 len)
6758 {
6759         int err = 0;
6760         struct hci_cp_set_rssi_threshold th = { 0, };
6761         struct mgmt_cp_disable_rssi *cp = data;
6762         struct hci_conn *conn;
6763         struct pending_cmd *cmd;
6764         struct hci_request req;
6765         __u8 dest_type;
6766         BT_DBG("Set Disable RSSI.");
6767
6768         if (!lmp_le_capable(hdev)) {
6769                 return cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6770                                 MGMT_STATUS_NOT_SUPPORTED);
6771         }
6772
6773         hci_dev_lock(hdev);
6774
6775         /* Get LE/ACL link handle info*/
6776         if (cp->link_type == 0x01)
6777                 dest_type = LE_LINK;
6778         else
6779                 dest_type = ACL_LINK;
6780
6781         conn = hci_conn_hash_lookup_ba(hdev,
6782                         dest_type, &cp->bdaddr);
6783         if (conn == NULL) {
6784                 err = cmd_complete(sk, hdev->id,
6785                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
6786                 goto unlocked;
6787         }
6788
6789         th.hci_le_ext_opcode = 0x0B;
6790         th.mode = 0x01;
6791         th.conn_handle = conn->handle;
6792         th.alert_mask = 0x00;
6793         th.low_th = 0x00;
6794         th.in_range_th = 0x00;
6795         th.high_th = 0x00;
6796
6797         if (!hdev_is_powered(hdev)) {
6798                 BT_DBG("%s", hdev->name);
6799                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE, 0,
6800                                    data, len);
6801                 goto unlocked;
6802         }
6803
6804         if (mgmt_pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
6805                 BT_DBG("%s", hdev->name);
6806                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6807                                 MGMT_STATUS_BUSY);
6808                 goto unlocked;
6809         }
6810
6811         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp, sizeof(*cp));
6812         if (!cmd) {
6813                 BT_DBG("%s", hdev->name);
6814                 err = -ENOMEM;
6815                 goto unlocked;
6816         }
6817
6818         hci_req_init(&req, hdev);
6819
6820         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6821         err = hci_req_run(&req, set_disable_threshold_complete);
6822         if (err < 0) {
6823                 mgmt_pending_remove(cmd);
6824                 BT_ERR("Error in requesting hci_req_run");
6825                 goto unlocked;
6826         }
6827
6828 unlocked:
6829         hci_dev_unlock(hdev);
6830
6831         return err;
6832 }
6833
6834 void mgmt_rssi_alert_evt(struct hci_dev *hdev, struct sk_buff *skb)
6835 {
6836         struct hci_ev_vendor_specific_rssi_alert *ev = (void *) skb->data;
6837         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
6838         struct hci_conn *conn;
6839
6840         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
6841                         ev->conn_handle, ev->alert_type, ev->rssi_dbm);
6842
6843         conn = hci_conn_hash_lookup_handle(hdev, ev->conn_handle);
6844
6845         if (conn == NULL) {
6846                 BT_ERR("RSSI alert Error: Device not found for handle");
6847                 return;
6848         }
6849         bacpy(&mgmt_ev.bdaddr, &conn->dst);
6850
6851         if (conn->type == LE_LINK)
6852                 mgmt_ev.link_type = 0x01;
6853         else
6854                 mgmt_ev.link_type = 0x00;
6855
6856         mgmt_ev.alert_type = ev->alert_type;
6857         mgmt_ev.rssi_dbm = ev->rssi_dbm;
6858
6859         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
6860                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert), NULL);
6861 }
6862
6863 void mgmt_multi_adv_state_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
6864 {
6865         struct hci_ev_vendor_specific_multi_adv_state *ev = (void *) skb->data;
6866         struct mgmt_ev_vendor_specific_multi_adv_state_changed mgmt_ev;
6867
6868         BT_DBG("Multi adv state changed [%2.2X %2.2X %2.2X]",
6869                         ev->adv_instance, ev->state_change_reason, ev->connection_handle);
6870
6871         mgmt_ev.adv_instance = ev->adv_instance;
6872         mgmt_ev.state_change_reason = ev->state_change_reason;
6873         mgmt_ev.connection_handle = ev->connection_handle;
6874
6875         mgmt_event(MGMT_EV_MULTI_ADV_STATE_CHANGED, hdev, &mgmt_ev,
6876                         sizeof(struct mgmt_ev_vendor_specific_multi_adv_state_changed), NULL);
6877 }
6878
6879 static int enable_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
6880                 void *data, u16 len)
6881 {
6882         int err;
6883         struct mgmt_cp_enable_6lowpan *cp = data;
6884
6885         BT_DBG("%s", hdev->name);
6886
6887         hci_dev_lock(hdev);
6888
6889         if (!hdev_is_powered(hdev)) {
6890                 err = cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
6891                                       MGMT_STATUS_NOT_POWERED);
6892                 goto unlocked;
6893         }
6894
6895         if (!lmp_le_capable(hdev)) {
6896                 err = cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
6897                                       MGMT_STATUS_NOT_SUPPORTED);
6898                 goto unlocked;
6899         }
6900
6901         if (cp->enable_6lowpan)
6902                 bt_6lowpan_enable();
6903         else
6904                 bt_6lowpan_disable();
6905
6906         err = cmd_complete(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
6907                                 MGMT_STATUS_SUCCESS, NULL, 0);
6908 unlocked:
6909         hci_dev_unlock(hdev);
6910         return err;
6911 }
6912
6913 static int connect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
6914                 void *data, u16 len)
6915 {
6916         struct mgmt_cp_connect_6lowpan *cp = data;
6917         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
6918         int err;
6919
6920         BT_DBG("%s", hdev->name);
6921
6922         hci_dev_lock(hdev);
6923
6924         if (!lmp_le_capable(hdev)) {
6925                 err = cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
6926                                       MGMT_STATUS_NOT_SUPPORTED);
6927                 goto unlocked;
6928         }
6929
6930         if (!hdev_is_powered(hdev)) {
6931                 err = cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
6932                                       MGMT_STATUS_REJECTED);
6933                 goto unlocked;
6934         }
6935
6936         if (bdaddr_type_is_le(cp->addr.type)) {
6937                 if (cp->addr.type == BDADDR_LE_PUBLIC)
6938                         addr_type = ADDR_LE_DEV_PUBLIC;
6939                 else
6940                         addr_type = ADDR_LE_DEV_RANDOM;
6941         } else {
6942                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
6943                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
6944                 goto unlocked;
6945         }
6946
6947         hci_dev_unlock(hdev);
6948
6949         /* 6lowpan Connect */
6950         err = _bt_6lowpan_connect(&cp->addr.bdaddr, cp->addr.type);
6951
6952         hci_dev_lock(hdev);
6953
6954         if (err < 0) {
6955                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
6956                                         MGMT_STATUS_REJECTED, NULL, 0);
6957
6958                 goto unlocked;
6959         }
6960
6961         err = cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
6962                                 NULL, 0);
6963 unlocked:
6964         hci_dev_unlock(hdev);
6965         return err;
6966 }
6967
6968 static int disconnect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
6969                 void *data, u16 len)
6970 {
6971         struct mgmt_cp_disconnect_6lowpan *cp = data;
6972         struct hci_conn *conn = NULL;
6973         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
6974         int err;
6975
6976         BT_DBG("%s", hdev->name);
6977
6978         hci_dev_lock(hdev);
6979
6980         if (!lmp_le_capable(hdev)) {
6981                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
6982                                       MGMT_STATUS_NOT_SUPPORTED);
6983                 goto unlocked;
6984         }
6985
6986         if (!hdev_is_powered(hdev)) {
6987                 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
6988                                       MGMT_STATUS_REJECTED);
6989                 goto unlocked;
6990         }
6991
6992         if (bdaddr_type_is_le(cp->addr.type)) {
6993                 if (cp->addr.type == BDADDR_LE_PUBLIC)
6994                         addr_type = ADDR_LE_DEV_PUBLIC;
6995                 else
6996                         addr_type = ADDR_LE_DEV_RANDOM;
6997         } else {
6998                 err = cmd_complete(sk, hdev->id,
6999                                         MGMT_OP_DISCONNECT_6LOWPAN,
7000                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
7001                 goto unlocked;
7002         }
7003
7004         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7005         if (!conn) {
7006                 err = cmd_complete(sk, hdev->id,
7007                                         MGMT_OP_DISCONNECT_6LOWPAN,
7008                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
7009                 goto unlocked;
7010         }
7011
7012         if (conn->dst_type != addr_type) {
7013                 err = cmd_complete(sk, hdev->id,
7014                                         MGMT_OP_DISCONNECT_6LOWPAN,
7015                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
7016                 goto unlocked;
7017         }
7018
7019         if (conn->state != BT_CONNECTED) {
7020                 err = cmd_complete(sk, hdev->id,
7021                                         MGMT_OP_DISCONNECT_6LOWPAN,
7022                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
7023                 goto unlocked;
7024         }
7025
7026         /* 6lowpan Disconnect */
7027         err = _bt_6lowpan_disconnect(conn->l2cap_data, cp->addr.type);
7028         if (err < 0) {
7029                 err = cmd_complete(sk, hdev->id,
7030                                         MGMT_OP_DISCONNECT_6LOWPAN,
7031                                         MGMT_STATUS_REJECTED, NULL, 0);
7032                 goto unlocked;
7033         }
7034
7035         err = cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
7036                                 NULL, 0);
7037
7038 unlocked:
7039         hci_dev_unlock(hdev);
7040         return err;
7041 }
7042
7043 void mgmt_6lowpan_conn_changed(struct hci_dev *hdev, char if_name[16],
7044                 bdaddr_t *bdaddr, u8 addr_type, bool connected)
7045 {
7046         char buf[512];
7047         struct mgmt_ev_6lowpan_conn_state_changed *ev = (void *)buf;
7048         size_t ev_size;
7049
7050         memset(buf, 0, sizeof(buf));
7051         bacpy(&ev->addr.bdaddr, bdaddr);
7052         ev->addr.type = addr_type;
7053         ev->connected = connected;
7054         memcpy(ev->ifname, (__u8 *)if_name, 16);
7055
7056         ev_size = sizeof(*ev);
7057
7058         mgmt_event(MGMT_EV_6LOWPAN_CONN_STATE_CHANGED, hdev, ev, ev_size, NULL);
7059 }
7060
7061 void mgmt_le_read_maximum_data_length_complete(struct hci_dev *hdev, u8 status)
7062 {
7063         struct pending_cmd *cmd;
7064         struct mgmt_rp_le_read_maximum_data_length rp;
7065
7066         BT_DBG("%s status %u", hdev->name, status);
7067
7068         cmd = mgmt_pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev);
7069         if (!cmd)
7070                 return;
7071
7072         if (status)
7073                 cmd_status(cmd->sk, hdev->id,
7074                                 MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
7075                                 mgmt_status(status));
7076
7077         memset(&rp, 0, sizeof(rp));
7078
7079         rp.max_tx_octets = cpu_to_le16(hdev->le_max_tx_len);
7080         rp.max_tx_time = cpu_to_le16(hdev->le_max_tx_time);
7081         rp.max_rx_octets = cpu_to_le16(hdev->le_max_rx_len);
7082         rp.max_rx_time = cpu_to_le16(hdev->le_max_rx_time);
7083
7084         cmd_complete(cmd->sk, hdev->id,
7085                           MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, 0,
7086                           &rp, sizeof(rp));
7087
7088         mgmt_pending_remove(cmd);
7089 }
7090
7091 static int read_maximum_le_data_length(struct sock *sk,
7092                 struct hci_dev *hdev, void *data, u16 len)
7093 {
7094         struct pending_cmd *cmd;
7095         int err;
7096
7097         BT_DBG("read_maximum_le_data_length  %s", hdev->name);
7098
7099         hci_dev_lock(hdev);
7100
7101         if (!hdev_is_powered(hdev)) {
7102                 err = cmd_status(sk, hdev->id,
7103                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
7104                                       MGMT_STATUS_NOT_POWERED);
7105                 goto unlock;
7106         }
7107
7108         if (!lmp_le_capable(hdev)) {
7109                 err = cmd_status(sk, hdev->id,
7110                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
7111                                       MGMT_STATUS_NOT_SUPPORTED);
7112                 goto unlock;
7113         }
7114
7115         if (mgmt_pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev)) {
7116                 err = cmd_status(sk, hdev->id,
7117                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
7118                                       MGMT_STATUS_BUSY);
7119                 goto unlock;
7120         }
7121
7122         cmd = mgmt_pending_add(sk, MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
7123                                hdev, data, len);
7124         if (!cmd) {
7125                 err = -ENOMEM;
7126                 goto unlock;
7127         }
7128
7129         err = hci_send_cmd(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
7130         if (err < 0)
7131                 mgmt_pending_remove(cmd);
7132
7133 unlock:
7134         hci_dev_unlock(hdev);
7135         return err;
7136 }
7137
7138 void mgmt_le_write_host_suggested_data_length_complete(struct hci_dev *hdev,
7139                 u8 status)
7140 {
7141         struct pending_cmd *cmd;
7142
7143         BT_DBG("status 0x%02x", status);
7144
7145         hci_dev_lock(hdev);
7146
7147         cmd = mgmt_pending_find(MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH, hdev);
7148         if (!cmd) {
7149                 BT_ERR("cmd not found in the pending list");
7150                 goto unlock;
7151         }
7152
7153         if (status)
7154                 cmd_status(cmd->sk, hdev->id,
7155                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
7156                                 mgmt_status(status));
7157         else
7158                 cmd_complete(cmd->sk, hdev->id,
7159                                   MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
7160                                   0, NULL, 0);
7161
7162         mgmt_pending_remove(cmd);
7163
7164 unlock:
7165         hci_dev_unlock(hdev);
7166 }
7167
7168 static int write_host_suggested_le_data_length(struct sock *sk,
7169                 struct hci_dev *hdev, void *data, u16 len)
7170 {
7171         struct pending_cmd *cmd;
7172         struct mgmt_cp_le_write_host_suggested_data_length *cp = data;
7173         struct hci_cp_le_write_def_data_len hci_data;
7174         int err = 0;
7175
7176         BT_DBG("Write host suggested data length request for %s", hdev->name);
7177
7178         hci_dev_lock(hdev);
7179
7180         if (!hdev_is_powered(hdev)) {
7181                 err = cmd_status(sk, hdev->id,
7182                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
7183                                 MGMT_STATUS_NOT_POWERED);
7184                 goto unlock;
7185         }
7186
7187         if (!lmp_le_capable(hdev)) {
7188                 err = cmd_status(sk, hdev->id,
7189                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
7190                                 MGMT_STATUS_NOT_SUPPORTED);
7191                 goto unlock;
7192         }
7193
7194         if (mgmt_pending_find(MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH, hdev)) {
7195                 err = cmd_status(sk, hdev->id,
7196                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
7197                                 MGMT_STATUS_BUSY);
7198                 goto unlock;
7199         }
7200
7201         cmd = mgmt_pending_add(sk, MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
7202                                hdev, data, len);
7203         if (!cmd) {
7204                 err = -ENOMEM;
7205                 goto unlock;
7206         }
7207
7208         hci_data.tx_len = cp->def_tx_octets;
7209         hci_data.tx_time = cp->def_tx_time;
7210
7211         err = hci_send_cmd(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN,
7212                            sizeof(hci_data), &hci_data);
7213         if (err < 0)
7214                 mgmt_pending_remove(cmd);
7215
7216 unlock:
7217         hci_dev_unlock(hdev);
7218
7219         return err;
7220 }
7221
7222 void mgmt_le_read_host_suggested_data_length_complete(struct hci_dev *hdev,
7223                 u8 status)
7224 {
7225         struct pending_cmd *cmd;
7226         struct mgmt_rp_le_read_host_suggested_data_length rp;
7227
7228         BT_DBG("%s status %u", hdev->name, status);
7229
7230         cmd = mgmt_pending_find(MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, hdev);
7231         if (!cmd) {
7232                 BT_ERR("cmd not found in the pending list");
7233                 return;
7234         }
7235
7236         if (status)
7237                 cmd_status(cmd->sk, hdev->id,
7238                         MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
7239                         mgmt_status(status));
7240
7241         memset(&rp, 0, sizeof(rp));
7242
7243         rp.def_tx_octets = cpu_to_le16(hdev->le_def_tx_len);
7244         rp.def_tx_time = cpu_to_le16(hdev->le_def_tx_time);
7245
7246         cmd_complete(cmd->sk, hdev->id,
7247                           MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, 0,
7248                           &rp, sizeof(rp));
7249
7250         mgmt_pending_remove(cmd);
7251 }
7252
7253 static int read_host_suggested_data_length(struct sock *sk,
7254                 struct hci_dev *hdev, void *data, u16 len)
7255 {
7256         struct pending_cmd *cmd;
7257         int err;
7258
7259         BT_DBG("read_host_suggested_data_length %s", hdev->name);
7260
7261         hci_dev_lock(hdev);
7262
7263         if (!hdev_is_powered(hdev)) {
7264                 err = cmd_status(sk, hdev->id,
7265                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
7266                                 MGMT_STATUS_NOT_POWERED);
7267                 goto unlock;
7268         }
7269
7270         if (!lmp_le_capable(hdev)) {
7271                 err = cmd_status(sk, hdev->id,
7272                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
7273                                 MGMT_STATUS_NOT_SUPPORTED);
7274                 goto unlock;
7275         }
7276
7277         if (mgmt_pending_find(MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH, hdev)) {
7278                 err = cmd_status(sk, hdev->id,
7279                                 MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
7280                                 MGMT_STATUS_BUSY);
7281                 goto unlock;
7282         }
7283
7284         cmd = mgmt_pending_add(sk, MGMT_OP_LE_READ_HOST_SUGGESTED_DATA_LENGTH,
7285                                hdev, data, len);
7286         if (!cmd) {
7287                 err = -ENOMEM;
7288                 goto unlock;
7289         }
7290
7291         err = hci_send_cmd(hdev, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
7292         if (err < 0)
7293                 mgmt_pending_remove(cmd);
7294
7295 unlock:
7296         hci_dev_unlock(hdev);
7297
7298         return err;
7299 }
7300
7301 static int set_le_data_length_params(struct sock *sk, struct hci_dev *hdev,
7302                 void *data, u16 len)
7303 {
7304         struct mgmt_cp_le_set_data_length *cp = data;
7305         struct mgmt_rp_le_set_data_length *rp;
7306         struct pending_cmd *cmd;
7307         struct hci_conn *conn;
7308         int err = 0;
7309         u16 max_tx_octets, max_tx_time;
7310         size_t rp_len;
7311
7312         BT_INFO("Set Data length for the device %s", hdev->name);
7313
7314         hci_dev_lock(hdev);
7315
7316         rp_len = sizeof(*rp);
7317         rp = kmalloc(rp_len, GFP_KERNEL);
7318         if (!rp) {
7319                 err = -ENOMEM;
7320                 goto unlock;
7321         }
7322
7323         if (!hdev_is_powered(hdev)) {
7324                 err = cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
7325                                       MGMT_STATUS_NOT_POWERED);
7326                 goto unlock;
7327         }
7328
7329         if (!lmp_le_capable(hdev)) {
7330                 err = cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
7331                                       MGMT_STATUS_NOT_SUPPORTED);
7332                 goto unlock;
7333         }
7334
7335         if (mgmt_pending_find(MGMT_OP_LE_SET_DATA_LENGTH, hdev)) {
7336                 err = cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
7337                                       MGMT_STATUS_BUSY);
7338                 goto unlock;
7339         }
7340
7341         cmd = mgmt_pending_add(sk, MGMT_OP_LE_SET_DATA_LENGTH, hdev, data, len);
7342         if (!cmd) {
7343                 err = -ENOMEM;
7344                 goto unlock;
7345         }
7346
7347         max_tx_octets = __le16_to_cpu(cp->max_tx_octets);
7348         max_tx_time = __le16_to_cpu(cp->max_tx_time);
7349
7350         BT_DBG("max_tx_octets 0x%4.4x max_tx_time 0x%4.4x latency",
7351                max_tx_octets, max_tx_time);
7352
7353         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
7354         if (!conn) {
7355                 cmd_status(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH,
7356                                 MGMT_STATUS_NOT_CONNECTED);
7357                 goto unlock;
7358         }
7359
7360         hci_dev_unlock(hdev);
7361
7362         err = hci_le_set_data_length(conn, max_tx_octets, max_tx_time);
7363         if (err < 0)
7364                 mgmt_pending_remove(cmd);
7365
7366         rp->handle = conn->handle;
7367         rp->status = 0;
7368
7369         hci_dev_lock(hdev);
7370         err = cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_DATA_LENGTH, 0,
7371                                 rp, rp_len);
7372 unlock:
7373         kfree(rp);
7374         hci_dev_unlock(hdev);
7375
7376         return err;
7377 }
7378
7379 void mgmt_le_data_length_change_complete(struct hci_dev *hdev,
7380                 bdaddr_t *bdaddr, u16 tx_octets, u16 tx_time,
7381                 u16 rx_octets, u16 rx_time)
7382 {
7383         struct mgmt_ev_le_data_length_changed ev;
7384
7385         bacpy(&ev.addr.bdaddr, bdaddr);
7386         ev.max_tx_octets = tx_octets;
7387         ev.max_tx_time = tx_time;
7388         ev.max_rx_octets = rx_octets;
7389         ev.max_rx_time = rx_time;
7390
7391         mgmt_event(MGMT_EV_LE_DATA_LENGTH_CHANGED, hdev, &ev, sizeof(ev), NULL);
7392 }
7393 /* END TIZEN_Bluetooth */
7394 #endif
7395
7396 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7397 {
7398         if (key->master != 0x00 && key->master != 0x01)
7399                 return false;
7400
7401         switch (key->addr.type) {
7402         case BDADDR_LE_PUBLIC:
7403                 return true;
7404
7405         case BDADDR_LE_RANDOM:
7406                 /* Two most significant bits shall be set */
7407                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7408                         return false;
7409                 return true;
7410         }
7411
7412         return false;
7413 }
7414
7415 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7416                                void *cp_data, u16 len)
7417 {
7418         struct mgmt_cp_load_long_term_keys *cp = cp_data;
7419         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7420                                    sizeof(struct mgmt_ltk_info));
7421         u16 key_count, expected_len;
7422         int i, err;
7423
7424         BT_DBG("request for %s", hdev->name);
7425
7426         if (!lmp_le_capable(hdev))
7427                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7428                                   MGMT_STATUS_NOT_SUPPORTED);
7429
7430         key_count = __le16_to_cpu(cp->key_count);
7431         if (key_count > max_key_count) {
7432                 BT_ERR("load_ltks: too big key_count value %u", key_count);
7433                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7434                                   MGMT_STATUS_INVALID_PARAMS);
7435         }
7436
7437         expected_len = sizeof(*cp) + key_count *
7438                                         sizeof(struct mgmt_ltk_info);
7439         if (expected_len != len) {
7440                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
7441                        expected_len, len);
7442                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7443                                   MGMT_STATUS_INVALID_PARAMS);
7444         }
7445
7446         BT_DBG("%s key_count %u", hdev->name, key_count);
7447
7448         for (i = 0; i < key_count; i++) {
7449                 struct mgmt_ltk_info *key = &cp->keys[i];
7450
7451                 if (!ltk_is_valid(key))
7452                         return cmd_status(sk, hdev->id,
7453                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
7454                                           MGMT_STATUS_INVALID_PARAMS);
7455         }
7456
7457         hci_dev_lock(hdev);
7458
7459         hci_smp_ltks_clear(hdev);
7460
7461         for (i = 0; i < key_count; i++) {
7462                 struct mgmt_ltk_info *key = &cp->keys[i];
7463                 u8 type, addr_type, authenticated;
7464
7465                 if (key->addr.type == BDADDR_LE_PUBLIC)
7466                         addr_type = ADDR_LE_DEV_PUBLIC;
7467                 else
7468                         addr_type = ADDR_LE_DEV_RANDOM;
7469
7470                 switch (key->type) {
7471                 case MGMT_LTK_UNAUTHENTICATED:
7472                         authenticated = 0x00;
7473                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
7474                         break;
7475                 case MGMT_LTK_AUTHENTICATED:
7476                         authenticated = 0x01;
7477                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
7478                         break;
7479                 case MGMT_LTK_P256_UNAUTH:
7480                         authenticated = 0x00;
7481                         type = SMP_LTK_P256;
7482                         break;
7483                 case MGMT_LTK_P256_AUTH:
7484                         authenticated = 0x01;
7485                         type = SMP_LTK_P256;
7486                         break;
7487                 case MGMT_LTK_P256_DEBUG:
7488                         authenticated = 0x00;
7489                         type = SMP_LTK_P256_DEBUG;
7490                 default:
7491                         continue;
7492                 }
7493
7494                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
7495                             authenticated, key->val, key->enc_size, key->ediv,
7496                             key->rand);
7497         }
7498
7499         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7500                            NULL, 0);
7501
7502         hci_dev_unlock(hdev);
7503
7504         return err;
7505 }
7506
7507 static int conn_info_cmd_complete(struct pending_cmd *cmd, u8 status)
7508 {
7509         struct hci_conn *conn = cmd->user_data;
7510         struct mgmt_rp_get_conn_info rp;
7511         int err;
7512
7513         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
7514
7515         if (status == MGMT_STATUS_SUCCESS) {
7516                 rp.rssi = conn->rssi;
7517                 rp.tx_power = conn->tx_power;
7518                 rp.max_tx_power = conn->max_tx_power;
7519         } else {
7520                 rp.rssi = HCI_RSSI_INVALID;
7521                 rp.tx_power = HCI_TX_POWER_INVALID;
7522                 rp.max_tx_power = HCI_TX_POWER_INVALID;
7523         }
7524
7525         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
7526                            &rp, sizeof(rp));
7527
7528         hci_conn_drop(conn);
7529         hci_conn_put(conn);
7530
7531         return err;
7532 }
7533
7534 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
7535                                        u16 opcode)
7536 {
7537         struct hci_cp_read_rssi *cp;
7538         struct pending_cmd *cmd;
7539         struct hci_conn *conn;
7540         u16 handle;
7541         u8 status;
7542
7543         BT_DBG("status 0x%02x", hci_status);
7544
7545         hci_dev_lock(hdev);
7546
7547         /* Commands sent in request are either Read RSSI or Read Transmit Power
7548          * Level so we check which one was last sent to retrieve connection
7549          * handle.  Both commands have handle as first parameter so it's safe to
7550          * cast data on the same command struct.
7551          *
7552          * First command sent is always Read RSSI and we fail only if it fails.
7553          * In other case we simply override error to indicate success as we
7554          * already remembered if TX power value is actually valid.
7555          */
7556         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
7557         if (!cp) {
7558                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
7559                 status = MGMT_STATUS_SUCCESS;
7560         } else {
7561                 status = mgmt_status(hci_status);
7562         }
7563
7564         if (!cp) {
7565                 BT_ERR("invalid sent_cmd in conn_info response");
7566                 goto unlock;
7567         }
7568
7569         handle = __le16_to_cpu(cp->handle);
7570         conn = hci_conn_hash_lookup_handle(hdev, handle);
7571         if (!conn) {
7572                 BT_ERR("unknown handle (%d) in conn_info response", handle);
7573                 goto unlock;
7574         }
7575
7576         cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
7577         if (!cmd)
7578                 goto unlock;
7579
7580         cmd->cmd_complete(cmd, status);
7581         mgmt_pending_remove(cmd);
7582
7583 unlock:
7584         hci_dev_unlock(hdev);
7585 }
7586
7587
7588 #ifdef CONFIG_TIZEN_WIP
7589 /* defination of "prandom_u32_max" is imported from latest kernel,
7590  * so if the kernel is migrated to latest, below defination should be removed
7591  */
7592
7593 /**
7594  * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro)
7595  * @ep_ro: right open interval endpoint
7596  *
7597  * Returns a pseudo-random number that is in interval [0, ep_ro). Note
7598  * that the result depends on PRNG being well distributed in [0, ~0U]
7599  * u32 space. Here we use maximally equidistributed combined Tausworthe
7600  * generator, that is, prandom_u32(). This is useful when requesting a
7601  * random index of an array containing ep_ro elements, for example.
7602  *
7603  * Returns: pseudo-random number in interval [0, ep_ro)
7604  */
7605 static inline u32 prandom_u32_max(u32 ep_ro)
7606 {
7607         return (u32)(((u64) prandom_u32() * ep_ro) >> 32);
7608 }
7609 #endif
7610
7611 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7612                          u16 len)
7613 {
7614         struct mgmt_cp_get_conn_info *cp = data;
7615         struct mgmt_rp_get_conn_info rp;
7616         struct hci_conn *conn;
7617         unsigned long conn_info_age;
7618         int err = 0;
7619
7620         BT_DBG("%s", hdev->name);
7621
7622         memset(&rp, 0, sizeof(rp));
7623         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7624         rp.addr.type = cp->addr.type;
7625
7626         if (!bdaddr_type_is_valid(cp->addr.type))
7627                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7628                                     MGMT_STATUS_INVALID_PARAMS,
7629                                     &rp, sizeof(rp));
7630
7631         hci_dev_lock(hdev);
7632
7633         if (!hdev_is_powered(hdev)) {
7634                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7635                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
7636                 goto unlock;
7637         }
7638
7639         if (cp->addr.type == BDADDR_BREDR)
7640                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7641                                                &cp->addr.bdaddr);
7642         else
7643                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7644
7645         if (!conn || conn->state != BT_CONNECTED) {
7646                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7647                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
7648                 goto unlock;
7649         }
7650
7651         if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
7652                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7653                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
7654                 goto unlock;
7655         }
7656
7657         /* To avoid client trying to guess when to poll again for information we
7658          * calculate conn info age as random value between min/max set in hdev.
7659          */
7660         conn_info_age = hdev->conn_info_min_age +
7661                         prandom_u32_max(hdev->conn_info_max_age -
7662                                         hdev->conn_info_min_age);
7663
7664         /* Query controller to refresh cached values if they are too old or were
7665          * never read.
7666          */
7667         if (time_after(jiffies, conn->conn_info_timestamp +
7668                        msecs_to_jiffies(conn_info_age)) ||
7669             !conn->conn_info_timestamp) {
7670                 struct hci_request req;
7671                 struct hci_cp_read_tx_power req_txp_cp;
7672                 struct hci_cp_read_rssi req_rssi_cp;
7673                 struct pending_cmd *cmd;
7674
7675                 hci_req_init(&req, hdev);
7676                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
7677                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
7678                             &req_rssi_cp);
7679
7680                 /* For LE links TX power does not change thus we don't need to
7681                  * query for it once value is known.
7682                  */
7683                 if (!bdaddr_type_is_le(cp->addr.type) ||
7684                     conn->tx_power == HCI_TX_POWER_INVALID) {
7685                         req_txp_cp.handle = cpu_to_le16(conn->handle);
7686                         req_txp_cp.type = 0x00;
7687                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
7688                                     sizeof(req_txp_cp), &req_txp_cp);
7689                 }
7690
7691                 /* Max TX power needs to be read only once per connection */
7692                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
7693                         req_txp_cp.handle = cpu_to_le16(conn->handle);
7694                         req_txp_cp.type = 0x01;
7695                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
7696                                     sizeof(req_txp_cp), &req_txp_cp);
7697                 }
7698
7699                 err = hci_req_run(&req, conn_info_refresh_complete);
7700                 if (err < 0)
7701                         goto unlock;
7702
7703                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
7704                                        data, len);
7705                 if (!cmd) {
7706                         err = -ENOMEM;
7707                         goto unlock;
7708                 }
7709
7710                 hci_conn_hold(conn);
7711                 cmd->user_data = hci_conn_get(conn);
7712                 cmd->cmd_complete = conn_info_cmd_complete;
7713
7714                 conn->conn_info_timestamp = jiffies;
7715         } else {
7716                 /* Cache is valid, just reply with values cached in hci_conn */
7717                 rp.rssi = conn->rssi;
7718                 rp.tx_power = conn->tx_power;
7719                 rp.max_tx_power = conn->max_tx_power;
7720
7721                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7722                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7723         }
7724
7725 unlock:
7726         hci_dev_unlock(hdev);
7727         return err;
7728 }
7729
7730 static int clock_info_cmd_complete(struct pending_cmd *cmd, u8 status)
7731 {
7732         struct hci_conn *conn = cmd->user_data;
7733         struct mgmt_rp_get_clock_info rp;
7734         struct hci_dev *hdev;
7735         int err;
7736
7737         memset(&rp, 0, sizeof(rp));
7738         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
7739
7740         if (status)
7741                 goto complete;
7742
7743         hdev = hci_dev_get(cmd->index);
7744         if (hdev) {
7745                 rp.local_clock = cpu_to_le32(hdev->clock);
7746                 hci_dev_put(hdev);
7747         }
7748
7749         if (conn) {
7750                 rp.piconet_clock = cpu_to_le32(conn->clock);
7751                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7752         }
7753
7754 complete:
7755         err = cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
7756                            sizeof(rp));
7757
7758         if (conn) {
7759                 hci_conn_drop(conn);
7760                 hci_conn_put(conn);
7761         }
7762
7763         return err;
7764 }
7765
7766 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7767 {
7768         struct hci_cp_read_clock *hci_cp;
7769         struct pending_cmd *cmd;
7770         struct hci_conn *conn;
7771
7772         BT_DBG("%s status %u", hdev->name, status);
7773
7774         hci_dev_lock(hdev);
7775
7776         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
7777         if (!hci_cp)
7778                 goto unlock;
7779
7780         if (hci_cp->which) {
7781                 u16 handle = __le16_to_cpu(hci_cp->handle);
7782                 conn = hci_conn_hash_lookup_handle(hdev, handle);
7783         } else {
7784                 conn = NULL;
7785         }
7786
7787         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
7788         if (!cmd)
7789                 goto unlock;
7790
7791         cmd->cmd_complete(cmd, mgmt_status(status));
7792         mgmt_pending_remove(cmd);
7793
7794 unlock:
7795         hci_dev_unlock(hdev);
7796 }
7797
7798 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
7799                          u16 len)
7800 {
7801         struct mgmt_cp_get_clock_info *cp = data;
7802         struct mgmt_rp_get_clock_info rp;
7803         struct hci_cp_read_clock hci_cp;
7804         struct pending_cmd *cmd;
7805         struct hci_request req;
7806         struct hci_conn *conn;
7807         int err;
7808
7809         BT_DBG("%s", hdev->name);
7810
7811         memset(&rp, 0, sizeof(rp));
7812         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7813         rp.addr.type = cp->addr.type;
7814
7815         if (cp->addr.type != BDADDR_BREDR)
7816                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7817                                     MGMT_STATUS_INVALID_PARAMS,
7818                                     &rp, sizeof(rp));
7819
7820         hci_dev_lock(hdev);
7821
7822         if (!hdev_is_powered(hdev)) {
7823                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7824                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
7825                 goto unlock;
7826         }
7827
7828         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7829                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7830                                                &cp->addr.bdaddr);
7831                 if (!conn || conn->state != BT_CONNECTED) {
7832                         err = cmd_complete(sk, hdev->id,
7833                                            MGMT_OP_GET_CLOCK_INFO,
7834                                            MGMT_STATUS_NOT_CONNECTED,
7835                                            &rp, sizeof(rp));
7836                         goto unlock;
7837                 }
7838         } else {
7839                 conn = NULL;
7840         }
7841
7842         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7843         if (!cmd) {
7844                 err = -ENOMEM;
7845                 goto unlock;
7846         }
7847
7848         cmd->cmd_complete = clock_info_cmd_complete;
7849
7850         hci_req_init(&req, hdev);
7851
7852         memset(&hci_cp, 0, sizeof(hci_cp));
7853         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
7854
7855         if (conn) {
7856                 hci_conn_hold(conn);
7857                 cmd->user_data = hci_conn_get(conn);
7858
7859                 hci_cp.handle = cpu_to_le16(conn->handle);
7860                 hci_cp.which = 0x01; /* Piconet clock */
7861                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
7862         }
7863
7864         err = hci_req_run(&req, get_clock_info_complete);
7865         if (err < 0)
7866                 mgmt_pending_remove(cmd);
7867
7868 unlock:
7869         hci_dev_unlock(hdev);
7870         return err;
7871 }
7872
7873 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
7874 {
7875         struct hci_conn *conn;
7876
7877         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
7878         if (!conn)
7879                 return false;
7880
7881         if (conn->dst_type != type)
7882                 return false;
7883
7884         if (conn->state != BT_CONNECTED)
7885                 return false;
7886
7887         return true;
7888 }
7889
7890 /* This function requires the caller holds hdev->lock */
7891 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
7892                                u8 addr_type, u8 auto_connect)
7893 {
7894         struct hci_dev *hdev = req->hdev;
7895         struct hci_conn_params *params;
7896
7897         params = hci_conn_params_add(hdev, addr, addr_type);
7898         if (!params)
7899                 return -EIO;
7900
7901         if (params->auto_connect == auto_connect)
7902                 return 0;
7903
7904         list_del_init(&params->action);
7905
7906         switch (auto_connect) {
7907         case HCI_AUTO_CONN_DISABLED:
7908         case HCI_AUTO_CONN_LINK_LOSS:
7909                 __hci_update_background_scan(req);
7910                 break;
7911         case HCI_AUTO_CONN_REPORT:
7912                 list_add(&params->action, &hdev->pend_le_reports);
7913                 __hci_update_background_scan(req);
7914                 break;
7915         case HCI_AUTO_CONN_DIRECT:
7916         case HCI_AUTO_CONN_ALWAYS:
7917                 if (!is_connected(hdev, addr, addr_type)) {
7918                         list_add(&params->action, &hdev->pend_le_conns);
7919                         __hci_update_background_scan(req);
7920                 }
7921                 break;
7922         }
7923
7924         params->auto_connect = auto_connect;
7925
7926         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
7927                auto_connect);
7928
7929         return 0;
7930 }
7931
7932 static void device_added(struct sock *sk, struct hci_dev *hdev,
7933                          bdaddr_t *bdaddr, u8 type, u8 action)
7934 {
7935         struct mgmt_ev_device_added ev;
7936
7937         bacpy(&ev.addr.bdaddr, bdaddr);
7938         ev.addr.type = type;
7939         ev.action = action;
7940
7941         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7942 }
7943
7944 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7945 {
7946         struct pending_cmd *cmd;
7947
7948         BT_DBG("status 0x%02x", status);
7949
7950         hci_dev_lock(hdev);
7951
7952         cmd = mgmt_pending_find(MGMT_OP_ADD_DEVICE, hdev);
7953         if (!cmd)
7954                 goto unlock;
7955
7956         cmd->cmd_complete(cmd, mgmt_status(status));
7957         mgmt_pending_remove(cmd);
7958
7959 unlock:
7960         hci_dev_unlock(hdev);
7961 }
7962
7963 static int add_device(struct sock *sk, struct hci_dev *hdev,
7964                       void *data, u16 len)
7965 {
7966         struct mgmt_cp_add_device *cp = data;
7967         struct pending_cmd *cmd;
7968         struct hci_request req;
7969         u8 auto_conn, addr_type;
7970         int err;
7971
7972         BT_DBG("%s", hdev->name);
7973
7974         if (!bdaddr_type_is_valid(cp->addr.type) ||
7975             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7976                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7977                                     MGMT_STATUS_INVALID_PARAMS,
7978                                     &cp->addr, sizeof(cp->addr));
7979
7980         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7981                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7982                                     MGMT_STATUS_INVALID_PARAMS,
7983                                     &cp->addr, sizeof(cp->addr));
7984
7985         hci_req_init(&req, hdev);
7986
7987         hci_dev_lock(hdev);
7988
7989         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
7990         if (!cmd) {
7991                 err = -ENOMEM;
7992                 goto unlock;
7993         }
7994
7995         cmd->cmd_complete = addr_cmd_complete;
7996
7997         if (cp->addr.type == BDADDR_BREDR) {
7998                 /* Only incoming connections action is supported for now */
7999                 if (cp->action != 0x01) {
8000                         err = cmd->cmd_complete(cmd,
8001                                                 MGMT_STATUS_INVALID_PARAMS);
8002                         mgmt_pending_remove(cmd);
8003                         goto unlock;
8004                 }
8005
8006                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
8007                                           cp->addr.type);
8008                 if (err)
8009                         goto unlock;
8010
8011                 __hci_update_page_scan(&req);
8012
8013                 goto added;
8014         }
8015
8016         if (cp->addr.type == BDADDR_LE_PUBLIC)
8017                 addr_type = ADDR_LE_DEV_PUBLIC;
8018         else
8019                 addr_type = ADDR_LE_DEV_RANDOM;
8020
8021         if (cp->action == 0x02)
8022                 auto_conn = HCI_AUTO_CONN_ALWAYS;
8023         else if (cp->action == 0x01)
8024                 auto_conn = HCI_AUTO_CONN_DIRECT;
8025         else
8026                 auto_conn = HCI_AUTO_CONN_REPORT;
8027
8028         /* If the connection parameters don't exist for this device,
8029          * they will be created and configured with defaults.
8030          */
8031         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
8032                                 auto_conn) < 0) {
8033                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
8034                 mgmt_pending_remove(cmd);
8035                 goto unlock;
8036         }
8037
8038 added:
8039         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
8040
8041         err = hci_req_run(&req, add_device_complete);
8042         if (err < 0) {
8043                 /* ENODATA means no HCI commands were needed (e.g. if
8044                  * the adapter is powered off).
8045                  */
8046                 if (err == -ENODATA)
8047                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
8048                 mgmt_pending_remove(cmd);
8049         }
8050
8051 unlock:
8052         hci_dev_unlock(hdev);
8053         return err;
8054 }
8055
8056 static void device_removed(struct sock *sk, struct hci_dev *hdev,
8057                            bdaddr_t *bdaddr, u8 type)
8058 {
8059         struct mgmt_ev_device_removed ev;
8060
8061         bacpy(&ev.addr.bdaddr, bdaddr);
8062         ev.addr.type = type;
8063
8064         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
8065 }
8066
8067 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8068 {
8069         struct pending_cmd *cmd;
8070
8071         BT_DBG("status 0x%02x", status);
8072
8073         hci_dev_lock(hdev);
8074
8075         cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
8076         if (!cmd)
8077                 goto unlock;
8078
8079         cmd->cmd_complete(cmd, mgmt_status(status));
8080         mgmt_pending_remove(cmd);
8081
8082 unlock:
8083         hci_dev_unlock(hdev);
8084 }
8085
8086 static int remove_device(struct sock *sk, struct hci_dev *hdev,
8087                          void *data, u16 len)
8088 {
8089         struct mgmt_cp_remove_device *cp = data;
8090         struct pending_cmd *cmd;
8091         struct hci_request req;
8092         int err;
8093
8094         BT_DBG("%s", hdev->name);
8095
8096         hci_req_init(&req, hdev);
8097
8098         hci_dev_lock(hdev);
8099
8100         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
8101         if (!cmd) {
8102                 err = -ENOMEM;
8103                 goto unlock;
8104         }
8105
8106         cmd->cmd_complete = addr_cmd_complete;
8107
8108         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8109                 struct hci_conn_params *params;
8110                 u8 addr_type;
8111
8112                 if (!bdaddr_type_is_valid(cp->addr.type)) {
8113                         err = cmd->cmd_complete(cmd,
8114                                                 MGMT_STATUS_INVALID_PARAMS);
8115                         mgmt_pending_remove(cmd);
8116                         goto unlock;
8117                 }
8118
8119                 if (cp->addr.type == BDADDR_BREDR) {
8120                         err = hci_bdaddr_list_del(&hdev->whitelist,
8121                                                   &cp->addr.bdaddr,
8122                                                   cp->addr.type);
8123                         if (err) {
8124                                 err = cmd->cmd_complete(cmd,
8125                                                         MGMT_STATUS_INVALID_PARAMS);
8126                                 mgmt_pending_remove(cmd);
8127                                 goto unlock;
8128                         }
8129
8130                         __hci_update_page_scan(&req);
8131
8132                         device_removed(sk, hdev, &cp->addr.bdaddr,
8133                                        cp->addr.type);
8134                         goto complete;
8135                 }
8136
8137                 if (cp->addr.type == BDADDR_LE_PUBLIC)
8138                         addr_type = ADDR_LE_DEV_PUBLIC;
8139                 else
8140                         addr_type = ADDR_LE_DEV_RANDOM;
8141
8142                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8143                                                 addr_type);
8144                 if (!params) {
8145                         err = cmd->cmd_complete(cmd,
8146                                                 MGMT_STATUS_INVALID_PARAMS);
8147                         mgmt_pending_remove(cmd);
8148                         goto unlock;
8149                 }
8150
8151                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
8152                         err = cmd->cmd_complete(cmd,
8153                                                 MGMT_STATUS_INVALID_PARAMS);
8154                         mgmt_pending_remove(cmd);
8155                         goto unlock;
8156                 }
8157
8158                 list_del(&params->action);
8159                 list_del(&params->list);
8160                 kfree(params);
8161                 __hci_update_background_scan(&req);
8162
8163                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8164         } else {
8165                 struct hci_conn_params *p, *tmp;
8166                 struct bdaddr_list *b, *btmp;
8167
8168                 if (cp->addr.type) {
8169                         err = cmd->cmd_complete(cmd,
8170                                                 MGMT_STATUS_INVALID_PARAMS);
8171                         mgmt_pending_remove(cmd);
8172                         goto unlock;
8173                 }
8174
8175                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
8176                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8177                         list_del(&b->list);
8178                         kfree(b);
8179                 }
8180
8181                 __hci_update_page_scan(&req);
8182
8183                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8184                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8185                                 continue;
8186                         device_removed(sk, hdev, &p->addr, p->addr_type);
8187                         list_del(&p->action);
8188                         list_del(&p->list);
8189                         kfree(p);
8190                 }
8191
8192                 BT_DBG("All LE connection parameters were removed");
8193
8194                 __hci_update_background_scan(&req);
8195         }
8196
8197 complete:
8198         err = hci_req_run(&req, remove_device_complete);
8199         if (err < 0) {
8200                 /* ENODATA means no HCI commands were needed (e.g. if
8201                  * the adapter is powered off).
8202                  */
8203                 if (err == -ENODATA)
8204                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
8205                 mgmt_pending_remove(cmd);
8206         }
8207
8208 unlock:
8209         hci_dev_unlock(hdev);
8210         return err;
8211 }
8212
8213 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
8214                            u16 len)
8215 {
8216         struct mgmt_cp_load_conn_param *cp = data;
8217         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8218                                      sizeof(struct mgmt_conn_param));
8219         u16 param_count, expected_len;
8220         int i;
8221
8222         if (!lmp_le_capable(hdev))
8223                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8224                                   MGMT_STATUS_NOT_SUPPORTED);
8225
8226         param_count = __le16_to_cpu(cp->param_count);
8227         if (param_count > max_param_count) {
8228                 BT_ERR("load_conn_param: too big param_count value %u",
8229                        param_count);
8230                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8231                                   MGMT_STATUS_INVALID_PARAMS);
8232         }
8233
8234         expected_len = sizeof(*cp) + param_count *
8235                                         sizeof(struct mgmt_conn_param);
8236         if (expected_len != len) {
8237                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
8238                        expected_len, len);
8239                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8240                                   MGMT_STATUS_INVALID_PARAMS);
8241         }
8242
8243         BT_DBG("%s param_count %u", hdev->name, param_count);
8244
8245         hci_dev_lock(hdev);
8246
8247         hci_conn_params_clear_disabled(hdev);
8248
8249         for (i = 0; i < param_count; i++) {
8250                 struct mgmt_conn_param *param = &cp->params[i];
8251                 struct hci_conn_params *hci_param;
8252                 u16 min, max, latency, timeout;
8253                 u8 addr_type;
8254
8255                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
8256                        param->addr.type);
8257
8258                 if (param->addr.type == BDADDR_LE_PUBLIC) {
8259                         addr_type = ADDR_LE_DEV_PUBLIC;
8260                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8261                         addr_type = ADDR_LE_DEV_RANDOM;
8262                 } else {
8263                         BT_ERR("Ignoring invalid connection parameters");
8264                         continue;
8265                 }
8266
8267                 min = le16_to_cpu(param->min_interval);
8268                 max = le16_to_cpu(param->max_interval);
8269                 latency = le16_to_cpu(param->latency);
8270                 timeout = le16_to_cpu(param->timeout);
8271
8272                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
8273                        min, max, latency, timeout);
8274
8275                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
8276                         BT_ERR("Ignoring invalid connection parameters");
8277                         continue;
8278                 }
8279
8280                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
8281                                                 addr_type);
8282                 if (!hci_param) {
8283                         BT_ERR("Failed to add connection parameters");
8284                         continue;
8285                 }
8286
8287                 hci_param->conn_min_interval = min;
8288                 hci_param->conn_max_interval = max;
8289                 hci_param->conn_latency = latency;
8290                 hci_param->supervision_timeout = timeout;
8291         }
8292
8293         hci_dev_unlock(hdev);
8294
8295         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
8296 }
8297
8298 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
8299                                void *data, u16 len)
8300 {
8301         struct mgmt_cp_set_external_config *cp = data;
8302         bool changed;
8303         int err;
8304
8305         BT_DBG("%s", hdev->name);
8306
8307         if (hdev_is_powered(hdev))
8308                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8309                                   MGMT_STATUS_REJECTED);
8310
8311         if (cp->config != 0x00 && cp->config != 0x01)
8312                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8313                                     MGMT_STATUS_INVALID_PARAMS);
8314
8315         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
8316                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8317                                   MGMT_STATUS_NOT_SUPPORTED);
8318
8319         hci_dev_lock(hdev);
8320
8321         if (cp->config)
8322                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
8323                                             &hdev->dev_flags);
8324         else
8325                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
8326                                              &hdev->dev_flags);
8327
8328         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
8329         if (err < 0)
8330                 goto unlock;
8331
8332         if (!changed)
8333                 goto unlock;
8334
8335         err = new_options(hdev, sk);
8336
8337         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
8338                 mgmt_index_removed(hdev);
8339
8340                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
8341                         set_bit(HCI_CONFIG, &hdev->dev_flags);
8342                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
8343
8344                         queue_work(hdev->req_workqueue, &hdev->power_on);
8345                 } else {
8346                         set_bit(HCI_RAW, &hdev->flags);
8347                         mgmt_index_added(hdev);
8348                 }
8349         }
8350
8351 unlock:
8352         hci_dev_unlock(hdev);
8353         return err;
8354 }
8355
8356 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8357                               void *data, u16 len)
8358 {
8359         struct mgmt_cp_set_public_address *cp = data;
8360         bool changed;
8361         int err;
8362
8363         BT_DBG("%s", hdev->name);
8364
8365         if (hdev_is_powered(hdev))
8366                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8367                                   MGMT_STATUS_REJECTED);
8368
8369         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8370                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8371                                   MGMT_STATUS_INVALID_PARAMS);
8372
8373         if (!hdev->set_bdaddr)
8374                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8375                                   MGMT_STATUS_NOT_SUPPORTED);
8376
8377         hci_dev_lock(hdev);
8378
8379         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8380         bacpy(&hdev->public_addr, &cp->bdaddr);
8381
8382         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8383         if (err < 0)
8384                 goto unlock;
8385
8386         if (!changed)
8387                 goto unlock;
8388
8389         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
8390                 err = new_options(hdev, sk);
8391
8392         if (is_configured(hdev)) {
8393                 mgmt_index_removed(hdev);
8394
8395                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
8396
8397                 set_bit(HCI_CONFIG, &hdev->dev_flags);
8398                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
8399
8400                 queue_work(hdev->req_workqueue, &hdev->power_on);
8401         }
8402
8403 unlock:
8404         hci_dev_unlock(hdev);
8405         return err;
8406 }
8407
8408 static const struct mgmt_handler {
8409         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
8410                      u16 data_len);
8411         bool var_len;
8412         size_t data_len;
8413 } mgmt_handlers[] = {
8414         { NULL }, /* 0x0000 (no command) */
8415         { read_version,           false, MGMT_READ_VERSION_SIZE },
8416         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
8417         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
8418         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
8419         { set_powered,            false, MGMT_SETTING_SIZE },
8420         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
8421         { set_connectable,        false, MGMT_SETTING_SIZE },
8422         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
8423         { set_bondable,           false, MGMT_SETTING_SIZE },
8424         { set_link_security,      false, MGMT_SETTING_SIZE },
8425         { set_ssp,                false, MGMT_SETTING_SIZE },
8426         { set_hs,                 false, MGMT_SETTING_SIZE },
8427         { set_le,                 false, MGMT_SETTING_SIZE },
8428         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
8429         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
8430         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
8431         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
8432         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
8433         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
8434         { disconnect,             false, MGMT_DISCONNECT_SIZE },
8435         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
8436         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
8437         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
8438         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
8439         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
8440         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
8441         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
8442         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
8443         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
8444         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
8445         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
8446         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
8447         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
8448         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
8449         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
8450         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
8451         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
8452         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
8453         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
8454         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
8455         { set_advertising,        false, MGMT_SETTING_SIZE },
8456         { set_bredr,              false, MGMT_SETTING_SIZE },
8457         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
8458         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
8459         { set_secure_conn,        false, MGMT_SETTING_SIZE },
8460         { set_debug_keys,         false, MGMT_SETTING_SIZE },
8461         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
8462         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
8463         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
8464         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
8465         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
8466         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
8467         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
8468         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
8469         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
8470         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
8471         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
8472         { start_service_discovery,true,  MGMT_START_SERVICE_DISCOVERY_SIZE },
8473 };
8474
8475 #ifdef CONFIG_TIZEN_WIP
8476 static const struct mgmt_handler tizen_mgmt_handlers[] = {
8477         { NULL }, /* 0x0000 (no command) */
8478         { set_advertising_params,  false, MGMT_SET_ADVERTISING_PARAMS_SIZE },
8479         { set_advertising_data,    true, MGMT_SET_ADV_MIN_APP_DATA_SIZE },
8480         { set_scan_rsp_data,       true, MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE },
8481         { add_white_list,          false, MGMT_ADD_DEV_WHITE_LIST_SIZE },
8482         { remove_from_white_list,  false, MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
8483         { clear_white_list,        false, MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
8484         { set_enable_rssi,         false, MGMT_SET_RSSI_ENABLE_SIZE },
8485         { get_raw_rssi,            false, MGMT_GET_RAW_RSSI_SIZE },
8486         { set_disable_threshold,   false, MGMT_SET_RSSI_DISABLE_SIZE },
8487         { start_le_discovery,      false, MGMT_START_LE_DISCOVERY_SIZE },
8488         { stop_le_discovery,       false, MGMT_STOP_LE_DISCOVERY_SIZE },
8489         { disable_le_auto_connect, false, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
8490         { le_conn_update,          false, MGMT_LE_CONN_UPDATE_SIZE},
8491         { set_manufacturer_data,   false, MGMT_SET_MANUFACTURER_DATA_SIZE},
8492         { le_set_scan_params,      false, MGMT_LE_SET_SCAN_PARAMS_SIZE },
8493         { set_voice_setting,       false, MGMT_SET_VOICE_SETTING_SIZE},
8494         { get_adv_tx_power,       false, MGMT_GET_ADV_TX_POWER_SIZE},
8495         { enable_bt_6lowpan,       false, MGMT_ENABLE_BT_6LOWPAN_SIZE },
8496         { connect_bt_6lowpan,      false, MGMT_CONNECT_6LOWPAN_SIZE },
8497         { disconnect_bt_6lowpan,   false, MGMT_DISCONNECT_6LOWPAN_SIZE },
8498         { read_maximum_le_data_length, false, MGMT_LE_READ_MAXIMUM_DATA_LENGTH_SIZE },
8499         { write_host_suggested_le_data_length, false,
8500                         MGMT_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH_SIZE },
8501         { read_host_suggested_data_length, false,
8502                                    MGMT_LE_READ_HOST_SUGGESTED_DATA_LENGTH_SIZE },
8503         { set_le_data_length_params, false,
8504                                    MGMT_LE_SET_DATA_LENGTH_SIZE },
8505         { set_dev_rpa_res_support, false, MGMT_OP_SET_DEV_RPA_RES_SUPPORT_SIZE },
8506         { set_irk,                 false, MGMT_SET_IRK_SIZE },
8507 };
8508 #endif
8509
8510 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
8511 {
8512         void *buf;
8513         u8 *cp;
8514         struct mgmt_hdr *hdr;
8515         u16 opcode, index, len;
8516         struct hci_dev *hdev = NULL;
8517         const struct mgmt_handler *handler;
8518         int err;
8519
8520         BT_DBG("got %zu bytes", msglen);
8521
8522         if (msglen < sizeof(*hdr))
8523                 return -EINVAL;
8524
8525         buf = kmalloc(msglen, GFP_KERNEL);
8526         if (!buf)
8527                 return -ENOMEM;
8528
8529 #ifdef CONFIG_TIZEN_WIP
8530         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
8531 #else
8532         if (memcpy_from_msg(buf, msg, msglen)) {
8533 #endif
8534                 err = -EFAULT;
8535                 goto done;
8536         }
8537
8538         hdr = buf;
8539         opcode = __le16_to_cpu(hdr->opcode);
8540         index = __le16_to_cpu(hdr->index);
8541         len = __le16_to_cpu(hdr->len);
8542
8543         if (len != msglen - sizeof(*hdr)) {
8544                 err = -EINVAL;
8545                 goto done;
8546         }
8547
8548         if (index != MGMT_INDEX_NONE) {
8549                 hdev = hci_dev_get(index);
8550                 if (!hdev) {
8551                         err = cmd_status(sk, index, opcode,
8552                                          MGMT_STATUS_INVALID_INDEX);
8553                         goto done;
8554                 }
8555
8556                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
8557                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
8558                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
8559                         err = cmd_status(sk, index, opcode,
8560                                          MGMT_STATUS_INVALID_INDEX);
8561                         goto done;
8562                 }
8563
8564                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
8565                     opcode != MGMT_OP_READ_CONFIG_INFO &&
8566                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
8567                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
8568                         err = cmd_status(sk, index, opcode,
8569                                          MGMT_STATUS_INVALID_INDEX);
8570                         goto done;
8571                 }
8572         }
8573
8574         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
8575             mgmt_handlers[opcode].func == NULL) {
8576 #ifdef CONFIG_TIZEN_WIP
8577                 u16 tizen_opcode = opcode - TIZEN_OP_CODE_BASE;
8578
8579                 if (tizen_opcode > 0 &&
8580                     tizen_opcode < ARRAY_SIZE(tizen_mgmt_handlers) &&
8581                     tizen_mgmt_handlers[tizen_opcode].func) {
8582
8583                     handler = &tizen_mgmt_handlers[tizen_opcode];
8584                     goto handle_mgmt;
8585                 }
8586 #endif
8587                 BT_DBG("Unknown op %u", opcode);
8588                 err = cmd_status(sk, index, opcode,
8589                                  MGMT_STATUS_UNKNOWN_COMMAND);
8590                 goto done;
8591         }
8592
8593         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
8594                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
8595                 err = cmd_status(sk, index, opcode,
8596                                  MGMT_STATUS_INVALID_INDEX);
8597                 goto done;
8598         }
8599
8600         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
8601                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
8602                 err = cmd_status(sk, index, opcode,
8603                                  MGMT_STATUS_INVALID_INDEX);
8604                 goto done;
8605         }
8606
8607         handler = &mgmt_handlers[opcode];
8608
8609 #ifdef CONFIG_TIZEN_WIP
8610 handle_mgmt:
8611 #endif
8612         if ((handler->var_len && len < handler->data_len) ||
8613             (!handler->var_len && len != handler->data_len)) {
8614                 err = cmd_status(sk, index, opcode,
8615                                  MGMT_STATUS_INVALID_PARAMS);
8616                 goto done;
8617         }
8618
8619         if (hdev)
8620                 mgmt_init_hdev(sk, hdev);
8621
8622         cp = buf + sizeof(*hdr);
8623
8624         err = handler->func(sk, hdev, cp, len);
8625         if (err < 0)
8626                 goto done;
8627
8628         err = msglen;
8629
8630 done:
8631         if (hdev)
8632                 hci_dev_put(hdev);
8633
8634         kfree(buf);
8635         return err;
8636 }
8637
8638 void mgmt_index_added(struct hci_dev *hdev)
8639 {
8640         if (hdev->dev_type != HCI_BREDR)
8641                 return;
8642
8643         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8644                 return;
8645
8646         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
8647                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
8648         else
8649                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
8650 }
8651
8652 void mgmt_index_removed(struct hci_dev *hdev)
8653 {
8654         u8 status = MGMT_STATUS_INVALID_INDEX;
8655
8656         if (hdev->dev_type != HCI_BREDR)
8657                 return;
8658
8659         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8660                 return;
8661
8662         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8663
8664         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
8665                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
8666         else
8667                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
8668 }
8669
8670 /* This function requires the caller holds hdev->lock */
8671 static void restart_le_actions(struct hci_request *req)
8672 {
8673         struct hci_dev *hdev = req->hdev;
8674         struct hci_conn_params *p;
8675
8676         list_for_each_entry(p, &hdev->le_conn_params, list) {
8677                 /* Needed for AUTO_OFF case where might not "really"
8678                  * have been powered off.
8679                  */
8680                 list_del_init(&p->action);
8681
8682                 switch (p->auto_connect) {
8683                 case HCI_AUTO_CONN_DIRECT:
8684                 case HCI_AUTO_CONN_ALWAYS:
8685                         list_add(&p->action, &hdev->pend_le_conns);
8686                         break;
8687                 case HCI_AUTO_CONN_REPORT:
8688                         list_add(&p->action, &hdev->pend_le_reports);
8689                         break;
8690                 default:
8691                         break;
8692                 }
8693         }
8694
8695         __hci_update_background_scan(req);
8696 }
8697
8698 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8699 {
8700         struct cmd_lookup match = { NULL, hdev };
8701
8702         BT_DBG("status 0x%02x", status);
8703
8704         if (!status) {
8705                 /* Register the available SMP channels (BR/EDR and LE) only
8706                  * when successfully powering on the controller. This late
8707                  * registration is required so that LE SMP can clearly
8708                  * decide if the public address or static address is used.
8709                  */
8710                 smp_register(hdev);
8711         }
8712
8713         hci_dev_lock(hdev);
8714
8715         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8716
8717         new_settings(hdev, match.sk);
8718
8719         hci_dev_unlock(hdev);
8720
8721         if (match.sk)
8722                 sock_put(match.sk);
8723 }
8724
8725 static int powered_update_hci(struct hci_dev *hdev)
8726 {
8727         struct hci_request req;
8728         u8 link_sec;
8729
8730         hci_req_init(&req, hdev);
8731
8732         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
8733             !lmp_host_ssp_capable(hdev)) {
8734                 u8 mode = 0x01;
8735
8736                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
8737
8738                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
8739                         u8 support = 0x01;
8740
8741                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
8742                                     sizeof(support), &support);
8743                 }
8744         }
8745
8746         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
8747             lmp_bredr_capable(hdev)) {
8748                 struct hci_cp_write_le_host_supported cp;
8749
8750                 cp.le = 0x01;
8751                 cp.simul = 0x00;
8752
8753                 /* Check first if we already have the right
8754                  * host state (host features set)
8755                  */
8756                 if (cp.le != lmp_host_le_capable(hdev) ||
8757                     cp.simul != lmp_host_le_br_capable(hdev))
8758                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
8759                                     sizeof(cp), &cp);
8760         }
8761
8762         if (lmp_le_capable(hdev)) {
8763                 /* Make sure the controller has a good default for
8764                  * advertising data. This also applies to the case
8765                  * where BR/EDR was toggled during the AUTO_OFF phase.
8766                  */
8767                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
8768                         update_adv_data(&req);
8769                         update_scan_rsp_data(&req);
8770                 }
8771
8772                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
8773                         enable_advertising(&req);
8774
8775                 restart_le_actions(&req);
8776         }
8777
8778         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
8779         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
8780                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
8781                             sizeof(link_sec), &link_sec);
8782
8783         if (lmp_bredr_capable(hdev)) {
8784                 write_fast_connectable(&req, false);
8785                 __hci_update_page_scan(&req);
8786                 update_class(&req);
8787                 update_name(&req);
8788                 update_eir(&req);
8789         }
8790
8791         return hci_req_run(&req, powered_complete);
8792 }
8793
8794 int mgmt_powered(struct hci_dev *hdev, u8 powered)
8795 {
8796         struct cmd_lookup match = { NULL, hdev };
8797         u8 status, zero_cod[] = { 0, 0, 0 };
8798         int err;
8799
8800         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
8801                 return 0;
8802
8803         if (powered) {
8804                 if (powered_update_hci(hdev) == 0)
8805                         return 0;
8806
8807                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
8808                                      &match);
8809                 goto new_settings;
8810         }
8811
8812         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8813
8814         /* If the power off is because of hdev unregistration let
8815          * use the appropriate INVALID_INDEX status. Otherwise use
8816          * NOT_POWERED. We cover both scenarios here since later in
8817          * mgmt_index_removed() any hci_conn callbacks will have already
8818          * been triggered, potentially causing misleading DISCONNECTED
8819          * status responses.
8820          */
8821         if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
8822                 status = MGMT_STATUS_INVALID_INDEX;
8823         else
8824                 status = MGMT_STATUS_NOT_POWERED;
8825
8826         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8827
8828         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
8829                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8830                            zero_cod, sizeof(zero_cod), NULL);
8831
8832 new_settings:
8833         err = new_settings(hdev, match.sk);
8834
8835         if (match.sk)
8836                 sock_put(match.sk);
8837
8838         return err;
8839 }
8840
8841 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
8842 {
8843         struct pending_cmd *cmd;
8844         u8 status;
8845
8846         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
8847         if (!cmd)
8848                 return;
8849
8850         if (err == -ERFKILL)
8851                 status = MGMT_STATUS_RFKILLED;
8852         else
8853                 status = MGMT_STATUS_FAILED;
8854
8855         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
8856
8857         mgmt_pending_remove(cmd);
8858 }
8859
8860 void mgmt_discoverable_timeout(struct hci_dev *hdev)
8861 {
8862         struct hci_request req;
8863
8864         hci_dev_lock(hdev);
8865
8866         /* When discoverable timeout triggers, then just make sure
8867          * the limited discoverable flag is cleared. Even in the case
8868          * of a timeout triggered from general discoverable, it is
8869          * safe to unconditionally clear the flag.
8870          */
8871         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
8872         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
8873
8874         hci_req_init(&req, hdev);
8875         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
8876                 u8 scan = SCAN_PAGE;
8877                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
8878                             sizeof(scan), &scan);
8879         }
8880         update_class(&req);
8881         update_adv_data(&req);
8882         hci_req_run(&req, NULL);
8883
8884         hdev->discov_timeout = 0;
8885
8886         new_settings(hdev, NULL);
8887
8888         hci_dev_unlock(hdev);
8889 }
8890
8891 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
8892                        bool persistent)
8893 {
8894         struct mgmt_ev_new_link_key ev;
8895
8896         memset(&ev, 0, sizeof(ev));
8897
8898         ev.store_hint = persistent;
8899         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8900         ev.key.addr.type = BDADDR_BREDR;
8901         ev.key.type = key->type;
8902         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
8903         ev.key.pin_len = key->pin_len;
8904
8905         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
8906 }
8907
8908 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
8909 {
8910         switch (ltk->type) {
8911         case SMP_LTK:
8912         case SMP_LTK_SLAVE:
8913                 if (ltk->authenticated)
8914                         return MGMT_LTK_AUTHENTICATED;
8915                 return MGMT_LTK_UNAUTHENTICATED;
8916         case SMP_LTK_P256:
8917                 if (ltk->authenticated)
8918                         return MGMT_LTK_P256_AUTH;
8919                 return MGMT_LTK_P256_UNAUTH;
8920         case SMP_LTK_P256_DEBUG:
8921                 return MGMT_LTK_P256_DEBUG;
8922         }
8923
8924         return MGMT_LTK_UNAUTHENTICATED;
8925 }
8926
8927 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
8928 {
8929         struct mgmt_ev_new_long_term_key ev;
8930
8931         memset(&ev, 0, sizeof(ev));
8932
8933         /* Devices using resolvable or non-resolvable random addresses
8934          * without providing an indentity resolving key don't require
8935          * to store long term keys. Their addresses will change the
8936          * next time around.
8937          *
8938          * Only when a remote device provides an identity address
8939          * make sure the long term key is stored. If the remote
8940          * identity is known, the long term keys are internally
8941          * mapped to the identity address. So allow static random
8942          * and public addresses here.
8943          */
8944         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8945             (key->bdaddr.b[5] & 0xc0) != 0xc0)
8946                 ev.store_hint = 0x00;
8947         else
8948                 ev.store_hint = persistent;
8949
8950         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8951         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
8952         ev.key.type = mgmt_ltk_type(key);
8953         ev.key.enc_size = key->enc_size;
8954         ev.key.ediv = key->ediv;
8955         ev.key.rand = key->rand;
8956
8957         if (key->type == SMP_LTK)
8958                 ev.key.master = 1;
8959
8960         memcpy(ev.key.val, key->val, sizeof(key->val));
8961
8962         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
8963 }
8964
8965 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
8966 {
8967         struct mgmt_ev_new_irk ev;
8968
8969         memset(&ev, 0, sizeof(ev));
8970
8971         /* For identity resolving keys from devices that are already
8972          * using a public address or static random address, do not
8973          * ask for storing this key. The identity resolving key really
8974          * is only mandatory for devices using resovlable random
8975          * addresses.
8976          *
8977          * Storing all identity resolving keys has the downside that
8978          * they will be also loaded on next boot of they system. More
8979          * identity resolving keys, means more time during scanning is
8980          * needed to actually resolve these addresses.
8981          */
8982         if (bacmp(&irk->rpa, BDADDR_ANY))
8983                 ev.store_hint = 0x01;
8984         else
8985                 ev.store_hint = 0x00;
8986
8987         bacpy(&ev.rpa, &irk->rpa);
8988         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
8989         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
8990         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
8991
8992         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
8993 }
8994
8995 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
8996                    bool persistent)
8997 {
8998         struct mgmt_ev_new_csrk ev;
8999
9000         memset(&ev, 0, sizeof(ev));
9001
9002         /* Devices using resolvable or non-resolvable random addresses
9003          * without providing an indentity resolving key don't require
9004          * to store signature resolving keys. Their addresses will change
9005          * the next time around.
9006          *
9007          * Only when a remote device provides an identity address
9008          * make sure the signature resolving key is stored. So allow
9009          * static random and public addresses here.
9010          */
9011         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9012             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9013                 ev.store_hint = 0x00;
9014         else
9015                 ev.store_hint = persistent;
9016
9017         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9018         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
9019         ev.key.master = csrk->master;
9020         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9021
9022         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9023 }
9024
9025 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9026                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
9027                          u16 max_interval, u16 latency, u16 timeout)
9028 {
9029         struct mgmt_ev_new_conn_param ev;
9030
9031         if (!hci_is_identity_address(bdaddr, bdaddr_type))
9032                 return;
9033
9034         memset(&ev, 0, sizeof(ev));
9035         bacpy(&ev.addr.bdaddr, bdaddr);
9036         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
9037         ev.store_hint = store_hint;
9038         ev.min_interval = cpu_to_le16(min_interval);
9039         ev.max_interval = cpu_to_le16(max_interval);
9040         ev.latency = cpu_to_le16(latency);
9041         ev.timeout = cpu_to_le16(timeout);
9042
9043         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
9044 }
9045
9046 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
9047                                   u8 data_len)
9048 {
9049         eir[eir_len++] = sizeof(type) + data_len;
9050         eir[eir_len++] = type;
9051         memcpy(&eir[eir_len], data, data_len);
9052         eir_len += data_len;
9053
9054         return eir_len;
9055 }
9056
9057 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
9058                            u32 flags, u8 *name, u8 name_len)
9059 {
9060         char buf[512];
9061         struct mgmt_ev_device_connected *ev = (void *) buf;
9062         u16 eir_len = 0;
9063
9064         bacpy(&ev->addr.bdaddr, &conn->dst);
9065         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9066
9067         ev->flags = __cpu_to_le32(flags);
9068
9069         /* We must ensure that the EIR Data fields are ordered and
9070          * unique. Keep it simple for now and avoid the problem by not
9071          * adding any BR/EDR data to the LE adv.
9072          */
9073         if (conn->le_adv_data_len > 0) {
9074                 memcpy(&ev->eir[eir_len],
9075                        conn->le_adv_data, conn->le_adv_data_len);
9076                 eir_len = conn->le_adv_data_len;
9077         } else {
9078                 if (name_len > 0)
9079                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
9080                                                   name, name_len);
9081
9082                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
9083                         eir_len = eir_append_data(ev->eir, eir_len,
9084                                                   EIR_CLASS_OF_DEV,
9085                                                   conn->dev_class, 3);
9086         }
9087
9088         ev->eir_len = cpu_to_le16(eir_len);
9089
9090         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
9091                     sizeof(*ev) + eir_len, NULL);
9092 }
9093
9094 #ifdef CONFIG_TIZEN_WIP
9095 /* BEGIN TIZEN_Bluetooth :: name update changes */
9096 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
9097                             u8 name_len)
9098 {
9099         char buf[512];
9100         struct mgmt_ev_device_name_update *ev = (void *) buf;
9101         u16 eir_len = 0;
9102
9103         if (name_len <= 0)
9104                 return -EINVAL;
9105
9106         bacpy(&ev->addr.bdaddr, bdaddr);
9107         ev->addr.type = BDADDR_BREDR;
9108
9109         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9110                                   name_len);
9111
9112         ev->eir_len = cpu_to_le16(eir_len);
9113
9114         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
9115                           sizeof(*ev) + eir_len, NULL);
9116 }
9117 /* END TIZEN_Bluetooth :: name update changes */
9118 #endif
9119
9120 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
9121 {
9122         struct sock **sk = data;
9123
9124         cmd->cmd_complete(cmd, 0);
9125
9126         *sk = cmd->sk;
9127         sock_hold(*sk);
9128
9129         mgmt_pending_remove(cmd);
9130 }
9131
9132 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
9133 {
9134         struct hci_dev *hdev = data;
9135         struct mgmt_cp_unpair_device *cp = cmd->param;
9136
9137         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
9138
9139         cmd->cmd_complete(cmd, 0);
9140         mgmt_pending_remove(cmd);
9141 }
9142
9143 bool mgmt_powering_down(struct hci_dev *hdev)
9144 {
9145         struct pending_cmd *cmd;
9146         struct mgmt_mode *cp;
9147
9148         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
9149         if (!cmd)
9150                 return false;
9151
9152         cp = cmd->param;
9153         if (!cp->val)
9154                 return true;
9155
9156         return false;
9157 }
9158
9159 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
9160                               u8 link_type, u8 addr_type, u8 reason,
9161                               bool mgmt_connected)
9162 {
9163         struct mgmt_ev_device_disconnected ev;
9164         struct sock *sk = NULL;
9165
9166         /* The connection is still in hci_conn_hash so test for 1
9167          * instead of 0 to know if this is the last one.
9168          */
9169         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
9170                 cancel_delayed_work(&hdev->power_off);
9171                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
9172         }
9173
9174         if (!mgmt_connected)
9175                 return;
9176
9177         if (link_type != ACL_LINK && link_type != LE_LINK)
9178                 return;
9179
9180         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
9181
9182         bacpy(&ev.addr.bdaddr, bdaddr);
9183         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9184         ev.reason = reason;
9185
9186         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
9187
9188         if (sk)
9189                 sock_put(sk);
9190
9191         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9192                              hdev);
9193 }
9194
9195 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
9196                             u8 link_type, u8 addr_type, u8 status)
9197 {
9198         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
9199         struct mgmt_cp_disconnect *cp;
9200         struct pending_cmd *cmd;
9201
9202         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
9203                              hdev);
9204
9205         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
9206         if (!cmd)
9207                 return;
9208
9209         cp = cmd->param;
9210
9211         if (bacmp(bdaddr, &cp->addr.bdaddr))
9212                 return;
9213
9214         if (cp->addr.type != bdaddr_type)
9215                 return;
9216
9217         cmd->cmd_complete(cmd, mgmt_status(status));
9218         mgmt_pending_remove(cmd);
9219 }
9220
9221 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9222                          u8 addr_type, u8 status)
9223 {
9224         struct mgmt_ev_connect_failed ev;
9225
9226         /* The connection is still in hci_conn_hash so test for 1
9227          * instead of 0 to know if this is the last one.
9228          */
9229         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
9230                 cancel_delayed_work(&hdev->power_off);
9231                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
9232         }
9233
9234         bacpy(&ev.addr.bdaddr, bdaddr);
9235         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9236         ev.status = mgmt_status(status);
9237
9238         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
9239 }
9240 #ifdef CONFIG_TIZEN_WIP
9241 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
9242 {
9243         struct mgmt_ev_hardware_error ev;
9244
9245         ev.error_code = err_code;
9246         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
9247 }
9248
9249 void mgmt_tx_timeout_error(struct hci_dev *hdev)
9250 {
9251         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
9252 }
9253 #endif
9254
9255 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
9256 {
9257         struct mgmt_ev_pin_code_request ev;
9258
9259         bacpy(&ev.addr.bdaddr, bdaddr);
9260         ev.addr.type = BDADDR_BREDR;
9261         ev.secure = secure;
9262
9263         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
9264 }
9265
9266 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9267                                   u8 status)
9268 {
9269         struct pending_cmd *cmd;
9270
9271         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
9272         if (!cmd)
9273                 return;
9274
9275         cmd->cmd_complete(cmd, mgmt_status(status));
9276         mgmt_pending_remove(cmd);
9277 }
9278
9279 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9280                                       u8 status)
9281 {
9282         struct pending_cmd *cmd;
9283
9284         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
9285         if (!cmd)
9286                 return;
9287
9288         cmd->cmd_complete(cmd, mgmt_status(status));
9289         mgmt_pending_remove(cmd);
9290 }
9291
9292 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9293                               u8 link_type, u8 addr_type, u32 value,
9294                               u8 confirm_hint)
9295 {
9296         struct mgmt_ev_user_confirm_request ev;
9297
9298         BT_DBG("%s", hdev->name);
9299
9300         bacpy(&ev.addr.bdaddr, bdaddr);
9301         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9302         ev.confirm_hint = confirm_hint;
9303         ev.value = cpu_to_le32(value);
9304
9305         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
9306                           NULL);
9307 }
9308
9309 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9310                               u8 link_type, u8 addr_type)
9311 {
9312         struct mgmt_ev_user_passkey_request ev;
9313
9314         BT_DBG("%s", hdev->name);
9315
9316         bacpy(&ev.addr.bdaddr, bdaddr);
9317         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9318
9319         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
9320                           NULL);
9321 }
9322
9323 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9324                                       u8 link_type, u8 addr_type, u8 status,
9325                                       u8 opcode)
9326 {
9327         struct pending_cmd *cmd;
9328
9329         cmd = mgmt_pending_find(opcode, hdev);
9330         if (!cmd)
9331                 return -ENOENT;
9332
9333         cmd->cmd_complete(cmd, mgmt_status(status));
9334         mgmt_pending_remove(cmd);
9335
9336         return 0;
9337 }
9338
9339 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9340                                      u8 link_type, u8 addr_type, u8 status)
9341 {
9342         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9343                                           status, MGMT_OP_USER_CONFIRM_REPLY);
9344 }
9345
9346 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9347                                          u8 link_type, u8 addr_type, u8 status)
9348 {
9349         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9350                                           status,
9351                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
9352 }
9353
9354 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9355                                      u8 link_type, u8 addr_type, u8 status)
9356 {
9357         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9358                                           status, MGMT_OP_USER_PASSKEY_REPLY);
9359 }
9360
9361 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9362                                          u8 link_type, u8 addr_type, u8 status)
9363 {
9364         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9365                                           status,
9366                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
9367 }
9368
9369 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9370                              u8 link_type, u8 addr_type, u32 passkey,
9371                              u8 entered)
9372 {
9373         struct mgmt_ev_passkey_notify ev;
9374
9375         BT_DBG("%s", hdev->name);
9376
9377         bacpy(&ev.addr.bdaddr, bdaddr);
9378         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9379         ev.passkey = __cpu_to_le32(passkey);
9380         ev.entered = entered;
9381
9382         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9383 }
9384
9385 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
9386 {
9387         struct mgmt_ev_auth_failed ev;
9388         struct pending_cmd *cmd;
9389         u8 status = mgmt_status(hci_status);
9390
9391         bacpy(&ev.addr.bdaddr, &conn->dst);
9392         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9393         ev.status = status;
9394
9395         cmd = find_pairing(conn);
9396
9397         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9398                     cmd ? cmd->sk : NULL);
9399
9400         if (cmd) {
9401                 cmd->cmd_complete(cmd, status);
9402                 mgmt_pending_remove(cmd);
9403         }
9404 }
9405
9406 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9407 {
9408         struct cmd_lookup match = { NULL, hdev };
9409         bool changed;
9410
9411         if (status) {
9412                 u8 mgmt_err = mgmt_status(status);
9413                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9414                                      cmd_status_rsp, &mgmt_err);
9415                 return;
9416         }
9417
9418         if (test_bit(HCI_AUTH, &hdev->flags))
9419                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
9420                                             &hdev->dev_flags);
9421         else
9422                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
9423                                              &hdev->dev_flags);
9424
9425         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
9426                              &match);
9427
9428         if (changed)
9429                 new_settings(hdev, match.sk);
9430
9431         if (match.sk)
9432                 sock_put(match.sk);
9433 }
9434
9435 static void clear_eir(struct hci_request *req)
9436 {
9437         struct hci_dev *hdev = req->hdev;
9438         struct hci_cp_write_eir cp;
9439
9440         if (!lmp_ext_inq_capable(hdev))
9441                 return;
9442
9443         memset(hdev->eir, 0, sizeof(hdev->eir));
9444
9445         memset(&cp, 0, sizeof(cp));
9446
9447         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
9448 }
9449
9450 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
9451 {
9452         struct cmd_lookup match = { NULL, hdev };
9453         struct hci_request req;
9454         bool changed = false;
9455
9456         if (status) {
9457                 u8 mgmt_err = mgmt_status(status);
9458
9459                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
9460                                                  &hdev->dev_flags)) {
9461                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
9462                         new_settings(hdev, NULL);
9463                 }
9464
9465                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
9466                                      &mgmt_err);
9467                 return;
9468         }
9469
9470         if (enable) {
9471                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
9472         } else {
9473                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
9474                 if (!changed)
9475                         changed = test_and_clear_bit(HCI_HS_ENABLED,
9476                                                      &hdev->dev_flags);
9477                 else
9478                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
9479         }
9480
9481         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
9482
9483         if (changed)
9484                 new_settings(hdev, match.sk);
9485
9486         if (match.sk)
9487                 sock_put(match.sk);
9488
9489         hci_req_init(&req, hdev);
9490
9491         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
9492                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
9493                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
9494                                     sizeof(enable), &enable);
9495                 update_eir(&req);
9496         } else {
9497                 clear_eir(&req);
9498         }
9499
9500         hci_req_run(&req, NULL);
9501 }
9502
9503 static void sk_lookup(struct pending_cmd *cmd, void *data)
9504 {
9505         struct cmd_lookup *match = data;
9506
9507         if (match->sk == NULL) {
9508                 match->sk = cmd->sk;
9509                 sock_hold(match->sk);
9510         }
9511 }
9512
9513 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
9514                                     u8 status)
9515 {
9516         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
9517
9518         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
9519         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
9520         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
9521
9522         if (!status)
9523                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
9524                            NULL);
9525
9526         if (match.sk)
9527                 sock_put(match.sk);
9528 }
9529
9530 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
9531 {
9532         struct mgmt_cp_set_local_name ev;
9533         struct pending_cmd *cmd;
9534
9535         if (status)
9536                 return;
9537
9538         memset(&ev, 0, sizeof(ev));
9539         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
9540         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
9541
9542         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
9543         if (!cmd) {
9544                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
9545
9546                 /* If this is a HCI command related to powering on the
9547                  * HCI dev don't send any mgmt signals.
9548                  */
9549                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
9550                         return;
9551         }
9552
9553         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
9554                    cmd ? cmd->sk : NULL);
9555 }
9556
9557 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
9558                                        u8 *rand192, u8 *hash256, u8 *rand256,
9559                                        u8 status)
9560 {
9561         struct pending_cmd *cmd;
9562
9563         BT_DBG("%s status %u", hdev->name, status);
9564
9565         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
9566         if (!cmd)
9567                 return;
9568
9569         if (status) {
9570                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
9571                            mgmt_status(status));
9572         } else {
9573                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
9574                         struct mgmt_rp_read_local_oob_ext_data rp;
9575
9576                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
9577                         memcpy(rp.rand192, rand192, sizeof(rp.rand192));
9578
9579                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
9580                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
9581
9582                         cmd_complete(cmd->sk, hdev->id,
9583                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
9584                                      &rp, sizeof(rp));
9585                 } else {
9586                         struct mgmt_rp_read_local_oob_data rp;
9587
9588                         memcpy(rp.hash, hash192, sizeof(rp.hash));
9589                         memcpy(rp.rand, rand192, sizeof(rp.rand));
9590
9591                         cmd_complete(cmd->sk, hdev->id,
9592                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
9593                                      &rp, sizeof(rp));
9594                 }
9595         }
9596
9597         mgmt_pending_remove(cmd);
9598 }
9599
9600 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
9601 {
9602         int i;
9603
9604         for (i = 0; i < uuid_count; i++) {
9605                 if (!memcmp(uuid, uuids[i], 16))
9606                         return true;
9607         }
9608
9609         return false;
9610 }
9611
9612 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
9613 {
9614         u16 parsed = 0;
9615
9616         while (parsed < eir_len) {
9617                 u8 field_len = eir[0];
9618                 u8 uuid[16];
9619                 int i;
9620
9621                 if (field_len == 0)
9622                         break;
9623
9624                 if (eir_len - parsed < field_len + 1)
9625                         break;
9626
9627                 switch (eir[1]) {
9628                 case EIR_UUID16_ALL:
9629                 case EIR_UUID16_SOME:
9630                         for (i = 0; i + 3 <= field_len; i += 2) {
9631                                 memcpy(uuid, bluetooth_base_uuid, 16);
9632                                 uuid[13] = eir[i + 3];
9633                                 uuid[12] = eir[i + 2];
9634                                 if (has_uuid(uuid, uuid_count, uuids))
9635                                         return true;
9636                         }
9637                         break;
9638                 case EIR_UUID32_ALL:
9639                 case EIR_UUID32_SOME:
9640                         for (i = 0; i + 5 <= field_len; i += 4) {
9641                                 memcpy(uuid, bluetooth_base_uuid, 16);
9642                                 uuid[15] = eir[i + 5];
9643                                 uuid[14] = eir[i + 4];
9644                                 uuid[13] = eir[i + 3];
9645                                 uuid[12] = eir[i + 2];
9646                                 if (has_uuid(uuid, uuid_count, uuids))
9647                                         return true;
9648                         }
9649                         break;
9650                 case EIR_UUID128_ALL:
9651                 case EIR_UUID128_SOME:
9652                         for (i = 0; i + 17 <= field_len; i += 16) {
9653                                 memcpy(uuid, eir + i + 2, 16);
9654                                 if (has_uuid(uuid, uuid_count, uuids))
9655                                         return true;
9656                         }
9657                         break;
9658                 }
9659
9660                 parsed += field_len + 1;
9661                 eir += field_len + 1;
9662         }
9663
9664         return false;
9665 }
9666
9667 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9668                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9669                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9670 {
9671         char buf[512];
9672         struct mgmt_ev_device_found *ev = (void *) buf;
9673         size_t ev_size;
9674         bool match;
9675
9676         /* Don't send events for a non-kernel initiated discovery. With
9677          * LE one exception is if we have pend_le_reports > 0 in which
9678          * case we're doing passive scanning and want these events.
9679          */
9680         if (!hci_discovery_active(hdev)) {
9681                 if (link_type == ACL_LINK)
9682                         return;
9683                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
9684                         return;
9685         }
9686
9687         /* When using service discovery with a RSSI threshold, then check
9688          * if such a RSSI threshold is specified. If a RSSI threshold has
9689          * been specified, then all results with a RSSI smaller than the
9690          * RSSI threshold will be dropped.
9691          *
9692          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
9693          * the results are also dropped.
9694          */
9695         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9696             (rssi < hdev->discovery.rssi || rssi == HCI_RSSI_INVALID))
9697                 return;
9698
9699         /* Make sure that the buffer is big enough. The 5 extra bytes
9700          * are for the potential CoD field.
9701          */
9702         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9703                 return;
9704
9705         memset(buf, 0, sizeof(buf));
9706
9707         /* In case of device discovery with BR/EDR devices (pre 1.2), the
9708          * RSSI value was reported as 0 when not available. This behavior
9709          * is kept when using device discovery. This is required for full
9710          * backwards compatibility with the API.
9711          *
9712          * However when using service discovery, the value 127 will be
9713          * returned when the RSSI is not available.
9714          */
9715         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
9716             link_type == ACL_LINK)
9717                 rssi = 0;
9718
9719         bacpy(&ev->addr.bdaddr, bdaddr);
9720         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9721         ev->rssi = rssi;
9722         ev->flags = cpu_to_le32(flags);
9723
9724         if (eir_len > 0) {
9725                 /* When using service discovery and a list of UUID is
9726                  * provided, results with no matching UUID should be
9727                  * dropped. In case there is a match the result is
9728                  * kept and checking possible scan response data
9729                  * will be skipped.
9730                  */
9731                 if (hdev->discovery.uuid_count > 0)
9732                         match = eir_has_uuids(eir, eir_len,
9733                                               hdev->discovery.uuid_count,
9734                                               hdev->discovery.uuids);
9735                 else
9736                         match = true;
9737
9738                 if (!match && !scan_rsp_len)
9739                         return;
9740
9741                 /* Copy EIR or advertising data into event */
9742                 memcpy(ev->eir, eir, eir_len);
9743         } else {
9744                 /* When using service discovery and a list of UUID is
9745                  * provided, results with empty EIR or advertising data
9746                  * should be dropped since they do not match any UUID.
9747                  */
9748                 if (hdev->discovery.uuid_count > 0 && !scan_rsp_len)
9749                         return;
9750
9751                 match = false;
9752         }
9753
9754         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
9755                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9756                                           dev_class, 3);
9757
9758         if (scan_rsp_len > 0) {
9759                 /* When using service discovery and a list of UUID is
9760                  * provided, results with no matching UUID should be
9761                  * dropped if there is no previous match from the
9762                  * advertising data.
9763                  */
9764                 if (hdev->discovery.uuid_count > 0) {
9765                         if (!match && !eir_has_uuids(scan_rsp, scan_rsp_len,
9766                                                      hdev->discovery.uuid_count,
9767                                                      hdev->discovery.uuids))
9768                                 return;
9769                 }
9770
9771                 /* Append scan response data to event */
9772                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9773         } else {
9774                 /* When using service discovery and a list of UUID is
9775                  * provided, results with empty scan response and no
9776                  * previous matched advertising data should be dropped.
9777                  */
9778                 if (hdev->discovery.uuid_count > 0 && !match)
9779                         return;
9780         }
9781
9782         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9783         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9784
9785         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9786 }
9787
9788 #ifdef CONFIG_TIZEN_WIP /* TIZEN_Bluetooth :: Pass adv type */
9789 void mgmt_le_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9790                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9791                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, u8 adv_type)
9792 {
9793         char buf[512];
9794         struct mgmt_ev_le_device_found *ev = (void *) buf;
9795         size_t ev_size;
9796
9797         if (!hci_discovery_active(hdev) && !hci_le_discovery_active(hdev))
9798                 return;
9799
9800         /* Make sure that the buffer is big enough. The 5 extra bytes
9801          * are for the potential CoD field.
9802          */
9803         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9804                 return;
9805
9806         memset(buf, 0, sizeof(buf));
9807
9808         bacpy(&ev->addr.bdaddr, bdaddr);
9809         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9810         ev->rssi = rssi;
9811         ev->flags = cpu_to_le32(flags);
9812         ev->adv_type = adv_type;
9813
9814         if (eir_len > 0)
9815                 memcpy(ev->eir, eir, eir_len);
9816
9817         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
9818                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9819                                           dev_class, 3);
9820
9821         if (scan_rsp_len > 0)
9822                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9823
9824         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9825         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9826
9827         mgmt_event(MGMT_EV_LE_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9828 }
9829 #endif
9830
9831 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9832                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
9833 {
9834         struct mgmt_ev_device_found *ev;
9835         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
9836         u16 eir_len;
9837
9838         ev = (struct mgmt_ev_device_found *) buf;
9839
9840         memset(buf, 0, sizeof(buf));
9841
9842         bacpy(&ev->addr.bdaddr, bdaddr);
9843         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9844         ev->rssi = rssi;
9845
9846         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9847                                   name_len);
9848
9849         ev->eir_len = cpu_to_le16(eir_len);
9850
9851         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
9852 }
9853
9854 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
9855 {
9856         struct mgmt_ev_discovering ev;
9857
9858         BT_DBG("%s discovering %u", hdev->name, discovering);
9859
9860         memset(&ev, 0, sizeof(ev));
9861         ev.type = hdev->discovery.type;
9862         ev.discovering = discovering;
9863
9864         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9865 }
9866
9867 #ifdef CONFIG_TIZEN_WIP
9868 /* BEGIN TIZEN_Bluetooth :: Seperate LE discovery */
9869 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
9870 {
9871         struct mgmt_ev_discovering ev;
9872         struct pending_cmd *cmd;
9873
9874         BT_DBG("%s le discovering %u", hdev->name, discovering);
9875
9876         if (discovering)
9877                 cmd = mgmt_pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
9878         else
9879                 cmd = mgmt_pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
9880
9881         if (cmd != NULL) {
9882                 u8 type = hdev->le_discovery.type;
9883
9884                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
9885                              sizeof(type));
9886                 mgmt_pending_remove(cmd);
9887         }
9888
9889         memset(&ev, 0, sizeof(ev));
9890         ev.type = hdev->le_discovery.type;
9891         ev.discovering = discovering;
9892
9893         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9894 }
9895 /* END TIZEN_Bluetooth */
9896 #endif
9897
9898 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
9899 {
9900         BT_DBG("%s status %u", hdev->name, status);
9901 }
9902
9903 void mgmt_reenable_advertising(struct hci_dev *hdev)
9904 {
9905         struct hci_request req;
9906
9907         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
9908                 return;
9909
9910         hci_req_init(&req, hdev);
9911         enable_advertising(&req);
9912         hci_req_run(&req, adv_enable_complete);
9913 }