net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #include <net/bluetooth/sco.h>
  38 #endif
  39
  40 #include "hci_request.h"
  41 #include "smp.h"
  42 #include "mgmt_util.h"
  43 #include "mgmt_config.h"
  44 #include "msft.h"
  45 #include "eir.h"
  46 #include "aosp.h"
  47
  48 #define MGMT_VERSION    1
  49 #define MGMT_REVISION   22
  50
  51 static const u16 mgmt_commands[] = {
  52         MGMT_OP_READ_INDEX_LIST,
  53         MGMT_OP_READ_INFO,
  54         MGMT_OP_SET_POWERED,
  55         MGMT_OP_SET_DISCOVERABLE,
  56         MGMT_OP_SET_CONNECTABLE,
  57         MGMT_OP_SET_FAST_CONNECTABLE,
  58         MGMT_OP_SET_BONDABLE,
  59         MGMT_OP_SET_LINK_SECURITY,
  60         MGMT_OP_SET_SSP,
  61         MGMT_OP_SET_HS,
  62         MGMT_OP_SET_LE,
  63         MGMT_OP_SET_DEV_CLASS,
  64         MGMT_OP_SET_LOCAL_NAME,
  65         MGMT_OP_ADD_UUID,
  66         MGMT_OP_REMOVE_UUID,
  67         MGMT_OP_LOAD_LINK_KEYS,
  68         MGMT_OP_LOAD_LONG_TERM_KEYS,
  69         MGMT_OP_DISCONNECT,
  70         MGMT_OP_GET_CONNECTIONS,
  71         MGMT_OP_PIN_CODE_REPLY,
  72         MGMT_OP_PIN_CODE_NEG_REPLY,
  73         MGMT_OP_SET_IO_CAPABILITY,
  74         MGMT_OP_PAIR_DEVICE,
  75         MGMT_OP_CANCEL_PAIR_DEVICE,
  76         MGMT_OP_UNPAIR_DEVICE,
  77         MGMT_OP_USER_CONFIRM_REPLY,
  78         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  79         MGMT_OP_USER_PASSKEY_REPLY,
  80         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  81         MGMT_OP_READ_LOCAL_OOB_DATA,
  82         MGMT_OP_ADD_REMOTE_OOB_DATA,
  83         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  84         MGMT_OP_START_DISCOVERY,
  85         MGMT_OP_STOP_DISCOVERY,
  86         MGMT_OP_CONFIRM_NAME,
  87         MGMT_OP_BLOCK_DEVICE,
  88         MGMT_OP_UNBLOCK_DEVICE,
  89         MGMT_OP_SET_DEVICE_ID,
  90         MGMT_OP_SET_ADVERTISING,
  91         MGMT_OP_SET_BREDR,
  92         MGMT_OP_SET_STATIC_ADDRESS,
  93         MGMT_OP_SET_SCAN_PARAMS,
  94         MGMT_OP_SET_SECURE_CONN,
  95         MGMT_OP_SET_DEBUG_KEYS,
  96         MGMT_OP_SET_PRIVACY,
  97         MGMT_OP_LOAD_IRKS,
  98         MGMT_OP_GET_CONN_INFO,
  99         MGMT_OP_GET_CLOCK_INFO,
 100         MGMT_OP_ADD_DEVICE,
 101         MGMT_OP_REMOVE_DEVICE,
 102         MGMT_OP_LOAD_CONN_PARAM,
 103         MGMT_OP_READ_UNCONF_INDEX_LIST,
 104         MGMT_OP_READ_CONFIG_INFO,
 105         MGMT_OP_SET_EXTERNAL_CONFIG,
 106         MGMT_OP_SET_PUBLIC_ADDRESS,
 107         MGMT_OP_START_SERVICE_DISCOVERY,
 108         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 109         MGMT_OP_READ_EXT_INDEX_LIST,
 110         MGMT_OP_READ_ADV_FEATURES,
 111         MGMT_OP_ADD_ADVERTISING,
 112         MGMT_OP_REMOVE_ADVERTISING,
 113         MGMT_OP_GET_ADV_SIZE_INFO,
 114         MGMT_OP_START_LIMITED_DISCOVERY,
 115         MGMT_OP_READ_EXT_INFO,
 116         MGMT_OP_SET_APPEARANCE,
 117         MGMT_OP_GET_PHY_CONFIGURATION,
 118         MGMT_OP_SET_PHY_CONFIGURATION,
 119         MGMT_OP_SET_BLOCKED_KEYS,
 120         MGMT_OP_SET_WIDEBAND_SPEECH,
 121         MGMT_OP_READ_CONTROLLER_CAP,
 122         MGMT_OP_READ_EXP_FEATURES_INFO,
 123         MGMT_OP_SET_EXP_FEATURE,
 124         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 125         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 126         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 127         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 128         MGMT_OP_GET_DEVICE_FLAGS,
 129         MGMT_OP_SET_DEVICE_FLAGS,
 130         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 131         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 132         MGMT_OP_REMOVE_ADV_MONITOR,
 133         MGMT_OP_ADD_EXT_ADV_PARAMS,
 134         MGMT_OP_ADD_EXT_ADV_DATA,
 135         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 136         MGMT_OP_SET_MESH_RECEIVER,
 137         MGMT_OP_MESH_READ_FEATURES,
 138         MGMT_OP_MESH_SEND,
 139         MGMT_OP_MESH_SEND_CANCEL,
 140 };
 141
 142 static const u16 mgmt_events[] = {
 143         MGMT_EV_CONTROLLER_ERROR,
 144         MGMT_EV_INDEX_ADDED,
 145         MGMT_EV_INDEX_REMOVED,
 146         MGMT_EV_NEW_SETTINGS,
 147         MGMT_EV_CLASS_OF_DEV_CHANGED,
 148         MGMT_EV_LOCAL_NAME_CHANGED,
 149         MGMT_EV_NEW_LINK_KEY,
 150         MGMT_EV_NEW_LONG_TERM_KEY,
 151         MGMT_EV_DEVICE_CONNECTED,
 152         MGMT_EV_DEVICE_DISCONNECTED,
 153         MGMT_EV_CONNECT_FAILED,
 154         MGMT_EV_PIN_CODE_REQUEST,
 155         MGMT_EV_USER_CONFIRM_REQUEST,
 156         MGMT_EV_USER_PASSKEY_REQUEST,
 157         MGMT_EV_AUTH_FAILED,
 158         MGMT_EV_DEVICE_FOUND,
 159         MGMT_EV_DISCOVERING,
 160         MGMT_EV_DEVICE_BLOCKED,
 161         MGMT_EV_DEVICE_UNBLOCKED,
 162         MGMT_EV_DEVICE_UNPAIRED,
 163         MGMT_EV_PASSKEY_NOTIFY,
 164         MGMT_EV_NEW_IRK,
 165         MGMT_EV_NEW_CSRK,
 166         MGMT_EV_DEVICE_ADDED,
 167         MGMT_EV_DEVICE_REMOVED,
 168         MGMT_EV_NEW_CONN_PARAM,
 169         MGMT_EV_UNCONF_INDEX_ADDED,
 170         MGMT_EV_UNCONF_INDEX_REMOVED,
 171         MGMT_EV_NEW_CONFIG_OPTIONS,
 172         MGMT_EV_EXT_INDEX_ADDED,
 173         MGMT_EV_EXT_INDEX_REMOVED,
 174         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 175         MGMT_EV_ADVERTISING_ADDED,
 176         MGMT_EV_ADVERTISING_REMOVED,
 177         MGMT_EV_EXT_INFO_CHANGED,
 178         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 179         MGMT_EV_EXP_FEATURE_CHANGED,
 180         MGMT_EV_DEVICE_FLAGS_CHANGED,
 181         MGMT_EV_ADV_MONITOR_ADDED,
 182         MGMT_EV_ADV_MONITOR_REMOVED,
 183         MGMT_EV_CONTROLLER_SUSPEND,
 184         MGMT_EV_CONTROLLER_RESUME,
 185         MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
 186         MGMT_EV_ADV_MONITOR_DEVICE_LOST,
 187 };
 188
 189 static const u16 mgmt_untrusted_commands[] = {
 190         MGMT_OP_READ_INDEX_LIST,
 191         MGMT_OP_READ_INFO,
 192         MGMT_OP_READ_UNCONF_INDEX_LIST,
 193         MGMT_OP_READ_CONFIG_INFO,
 194         MGMT_OP_READ_EXT_INDEX_LIST,
 195         MGMT_OP_READ_EXT_INFO,
 196         MGMT_OP_READ_CONTROLLER_CAP,
 197         MGMT_OP_READ_EXP_FEATURES_INFO,
 198         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 199         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 200 };
 201
 202 static const u16 mgmt_untrusted_events[] = {
 203         MGMT_EV_INDEX_ADDED,
 204         MGMT_EV_INDEX_REMOVED,
 205         MGMT_EV_NEW_SETTINGS,
 206         MGMT_EV_CLASS_OF_DEV_CHANGED,
 207         MGMT_EV_LOCAL_NAME_CHANGED,
 208         MGMT_EV_UNCONF_INDEX_ADDED,
 209         MGMT_EV_UNCONF_INDEX_REMOVED,
 210         MGMT_EV_NEW_CONFIG_OPTIONS,
 211         MGMT_EV_EXT_INDEX_ADDED,
 212         MGMT_EV_EXT_INDEX_REMOVED,
 213         MGMT_EV_EXT_INFO_CHANGED,
 214         MGMT_EV_EXP_FEATURE_CHANGED,
 215 };
 216
 217 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 218
 219 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 220                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 221
 222 /* HCI to MGMT error code conversion table */
 223 static const u8 mgmt_status_table[] = {
 224         MGMT_STATUS_SUCCESS,
 225         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 226         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 227         MGMT_STATUS_FAILED,             /* Hardware Failure */
 228         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 229         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 230         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 231         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 232         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 233         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 234         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 235         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 236         MGMT_STATUS_BUSY,               /* Command Disallowed */
 237         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 238         MGMT_STATUS_REJECTED,           /* Rejected Security */
 239         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 240         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 241         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 242         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 243         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 244         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 245         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 246         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 247         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 248         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 249         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 250         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 251         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 252         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 253         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 254         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 255         MGMT_STATUS_FAILED,             /* Unspecified Error */
 256         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 257         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 258         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 259         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 260         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 261         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 262         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 263         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 264         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 265         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 266         MGMT_STATUS_FAILED,             /* Transaction Collision */
 267         MGMT_STATUS_FAILED,             /* Reserved for future use */
 268         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 269         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 270         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 271         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 272         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 273         MGMT_STATUS_FAILED,             /* Reserved for future use */
 274         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 275         MGMT_STATUS_FAILED,             /* Reserved for future use */
 276         MGMT_STATUS_FAILED,             /* Slot Violation */
 277         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 278         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 279         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 280         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 281         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 282         MGMT_STATUS_BUSY,               /* Controller Busy */
 283         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 284         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 285         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 286         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 287         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 288 };
 289
 290 static u8 mgmt_errno_status(int err)
 291 {
 292         switch (err) {
 293         case 0:
 294                 return MGMT_STATUS_SUCCESS;
 295         case -EPERM:
 296                 return MGMT_STATUS_REJECTED;
 297         case -EINVAL:
 298                 return MGMT_STATUS_INVALID_PARAMS;
 299         case -EOPNOTSUPP:
 300                 return MGMT_STATUS_NOT_SUPPORTED;
 301         case -EBUSY:
 302                 return MGMT_STATUS_BUSY;
 303         case -ETIMEDOUT:
 304                 return MGMT_STATUS_AUTH_FAILED;
 305         case -ENOMEM:
 306                 return MGMT_STATUS_NO_RESOURCES;
 307         case -EISCONN:
 308                 return MGMT_STATUS_ALREADY_CONNECTED;
 309         case -ENOTCONN:
 310                 return MGMT_STATUS_DISCONNECTED;
 311         }
 312
 313         return MGMT_STATUS_FAILED;
 314 }
 315
 316 static u8 mgmt_status(int err)
 317 {
 318         if (err < 0)
 319                 return mgmt_errno_status(err);
 320
 321         if (err < ARRAY_SIZE(mgmt_status_table))
 322                 return mgmt_status_table[err];
 323
 324         return MGMT_STATUS_FAILED;
 325 }
 326
 327 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 328                             u16 len, int flag)
 329 {
 330         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 331                                flag, NULL);
 332 }
 333
 334 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 335                               u16 len, int flag, struct sock *skip_sk)
 336 {
 337         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 338                                flag, skip_sk);
 339 }
 340
 341 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 342                       struct sock *skip_sk)
 343 {
 344         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 345                                HCI_SOCK_TRUSTED, skip_sk);
 346 }
 347
 348 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
 349 {
 350         return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
 351                                    skip_sk);
 352 }
 353
 354 static u8 le_addr_type(u8 mgmt_addr_type)
 355 {
 356         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 357                 return ADDR_LE_DEV_PUBLIC;
 358         else
 359                 return ADDR_LE_DEV_RANDOM;
 360 }
 361
 362 void mgmt_fill_version_info(void *ver)
 363 {
 364         struct mgmt_rp_read_version *rp = ver;
 365
 366         rp->version = MGMT_VERSION;
 367         rp->revision = cpu_to_le16(MGMT_REVISION);
 368 }
 369
 370 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 371                         u16 data_len)
 372 {
 373         struct mgmt_rp_read_version rp;
 374
 375         bt_dev_dbg(hdev, "sock %p", sk);
 376
 377         mgmt_fill_version_info(&rp);
 378
 379         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 380                                  &rp, sizeof(rp));
 381 }
 382
 383 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 384                          u16 data_len)
 385 {
 386         struct mgmt_rp_read_commands *rp;
 387         u16 num_commands, num_events;
 388         size_t rp_size;
 389         int i, err;
 390
 391         bt_dev_dbg(hdev, "sock %p", sk);
 392
 393         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 394                 num_commands = ARRAY_SIZE(mgmt_commands);
 395                 num_events = ARRAY_SIZE(mgmt_events);
 396         } else {
 397                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 398                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 399         }
 400
 401         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 402
 403         rp = kmalloc(rp_size, GFP_KERNEL);
 404         if (!rp)
 405                 return -ENOMEM;
 406
 407         rp->num_commands = cpu_to_le16(num_commands);
 408         rp->num_events = cpu_to_le16(num_events);
 409
 410         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 411                 __le16 *opcode = rp->opcodes;
 412
 413                 for (i = 0; i < num_commands; i++, opcode++)
 414                         put_unaligned_le16(mgmt_commands[i], opcode);
 415
 416                 for (i = 0; i < num_events; i++, opcode++)
 417                         put_unaligned_le16(mgmt_events[i], opcode);
 418         } else {
 419                 __le16 *opcode = rp->opcodes;
 420
 421                 for (i = 0; i < num_commands; i++, opcode++)
 422                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 423
 424                 for (i = 0; i < num_events; i++, opcode++)
 425                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 426         }
 427
 428         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 429                                 rp, rp_size);
 430         kfree(rp);
 431
 432         return err;
 433 }
 434
 435 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 436                            u16 data_len)
 437 {
 438         struct mgmt_rp_read_index_list *rp;
 439         struct hci_dev *d;
 440         size_t rp_len;
 441         u16 count;
 442         int err;
 443
 444         bt_dev_dbg(hdev, "sock %p", sk);
 445
 446         read_lock(&hci_dev_list_lock);
 447
 448         count = 0;
 449         list_for_each_entry(d, &hci_dev_list, list) {
 450                 if (d->dev_type == HCI_PRIMARY &&
 451                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 452                         count++;
 453         }
 454
 455         rp_len = sizeof(*rp) + (2 * count);
 456         rp = kmalloc(rp_len, GFP_ATOMIC);
 457         if (!rp) {
 458                 read_unlock(&hci_dev_list_lock);
 459                 return -ENOMEM;
 460         }
 461
 462         count = 0;
 463         list_for_each_entry(d, &hci_dev_list, list) {
 464                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 465                     hci_dev_test_flag(d, HCI_CONFIG) ||
 466                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 467                         continue;
 468
 469                 /* Devices marked as raw-only are neither configured
 470                  * nor unconfigured controllers.
 471                  */
 472                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 473                         continue;
 474
 475                 if (d->dev_type == HCI_PRIMARY &&
 476                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 477                         rp->index[count++] = cpu_to_le16(d->id);
 478                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 479                 }
 480         }
 481
 482         rp->num_controllers = cpu_to_le16(count);
 483         rp_len = sizeof(*rp) + (2 * count);
 484
 485         read_unlock(&hci_dev_list_lock);
 486
 487         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 488                                 0, rp, rp_len);
 489
 490         kfree(rp);
 491
 492         return err;
 493 }
 494
 495 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 496                                   void *data, u16 data_len)
 497 {
 498         struct mgmt_rp_read_unconf_index_list *rp;
 499         struct hci_dev *d;
 500         size_t rp_len;
 501         u16 count;
 502         int err;
 503
 504         bt_dev_dbg(hdev, "sock %p", sk);
 505
 506         read_lock(&hci_dev_list_lock);
 507
 508         count = 0;
 509         list_for_each_entry(d, &hci_dev_list, list) {
 510                 if (d->dev_type == HCI_PRIMARY &&
 511                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 512                         count++;
 513         }
 514
 515         rp_len = sizeof(*rp) + (2 * count);
 516         rp = kmalloc(rp_len, GFP_ATOMIC);
 517         if (!rp) {
 518                 read_unlock(&hci_dev_list_lock);
 519                 return -ENOMEM;
 520         }
 521
 522         count = 0;
 523         list_for_each_entry(d, &hci_dev_list, list) {
 524                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 525                     hci_dev_test_flag(d, HCI_CONFIG) ||
 526                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 527                         continue;
 528
 529                 /* Devices marked as raw-only are neither configured
 530                  * nor unconfigured controllers.
 531                  */
 532                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 533                         continue;
 534
 535                 if (d->dev_type == HCI_PRIMARY &&
 536                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 537                         rp->index[count++] = cpu_to_le16(d->id);
 538                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 539                 }
 540         }
 541
 542         rp->num_controllers = cpu_to_le16(count);
 543         rp_len = sizeof(*rp) + (2 * count);
 544
 545         read_unlock(&hci_dev_list_lock);
 546
 547         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 548                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 549
 550         kfree(rp);
 551
 552         return err;
 553 }
 554
 555 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 556                                void *data, u16 data_len)
 557 {
 558         struct mgmt_rp_read_ext_index_list *rp;
 559         struct hci_dev *d;
 560         u16 count;
 561         int err;
 562
 563         bt_dev_dbg(hdev, "sock %p", sk);
 564
 565         read_lock(&hci_dev_list_lock);
 566
 567         count = 0;
 568         list_for_each_entry(d, &hci_dev_list, list) {
 569                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 570                         count++;
 571         }
 572
 573         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 574         if (!rp) {
 575                 read_unlock(&hci_dev_list_lock);
 576                 return -ENOMEM;
 577         }
 578
 579         count = 0;
 580         list_for_each_entry(d, &hci_dev_list, list) {
 581                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 582                     hci_dev_test_flag(d, HCI_CONFIG) ||
 583                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 584                         continue;
 585
 586                 /* Devices marked as raw-only are neither configured
 587                  * nor unconfigured controllers.
 588                  */
 589                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 590                         continue;
 591
 592                 if (d->dev_type == HCI_PRIMARY) {
 593                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 594                                 rp->entry[count].type = 0x01;
 595                         else
 596                                 rp->entry[count].type = 0x00;
 597                 } else if (d->dev_type == HCI_AMP) {
 598                         rp->entry[count].type = 0x02;
 599                 } else {
 600                         continue;
 601                 }
 602
 603                 rp->entry[count].bus = d->bus;
 604                 rp->entry[count++].index = cpu_to_le16(d->id);
 605                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 606         }
 607
 608         rp->num_controllers = cpu_to_le16(count);
 609
 610         read_unlock(&hci_dev_list_lock);
 611
 612         /* If this command is called at least once, then all the
 613          * default index and unconfigured index events are disabled
 614          * and from now on only extended index events are used.
 615          */
 616         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 617         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 618         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 619
 620         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 621                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 622                                 struct_size(rp, entry, count));
 623
 624         kfree(rp);
 625
 626         return err;
 627 }
 628
 629 static bool is_configured(struct hci_dev *hdev)
 630 {
 631         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 632             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 633                 return false;
 634
 635         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 636              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 637             !bacmp(&hdev->public_addr, BDADDR_ANY))
 638                 return false;
 639
 640         return true;
 641 }
 642
 643 static __le32 get_missing_options(struct hci_dev *hdev)
 644 {
 645         u32 options = 0;
 646
 647         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 648             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 649                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 650
 651         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 652              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 653             !bacmp(&hdev->public_addr, BDADDR_ANY))
 654                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 655
 656         return cpu_to_le32(options);
 657 }
 658
 659 static int new_options(struct hci_dev *hdev, struct sock *skip)
 660 {
 661         __le32 options = get_missing_options(hdev);
 662
 663         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 664                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 665 }
 666
 667 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 668 {
 669         __le32 options = get_missing_options(hdev);
 670
 671         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 672                                  sizeof(options));
 673 }
 674
 675 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 676                             void *data, u16 data_len)
 677 {
 678         struct mgmt_rp_read_config_info rp;
 679         u32 options = 0;
 680
 681         bt_dev_dbg(hdev, "sock %p", sk);
 682
 683         hci_dev_lock(hdev);
 684
 685         memset(&rp, 0, sizeof(rp));
 686         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 687
 688         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 689                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 690
 691         if (hdev->set_bdaddr)
 692                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 693
 694         rp.supported_options = cpu_to_le32(options);
 695         rp.missing_options = get_missing_options(hdev);
 696
 697         hci_dev_unlock(hdev);
 698
 699         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 700                                  &rp, sizeof(rp));
 701 }
 702
 703 static u32 get_supported_phys(struct hci_dev *hdev)
 704 {
 705         u32 supported_phys = 0;
 706
 707         if (lmp_bredr_capable(hdev)) {
 708                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 709
 710                 if (hdev->features[0][0] & LMP_3SLOT)
 711                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 712
 713                 if (hdev->features[0][0] & LMP_5SLOT)
 714                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 715
 716                 if (lmp_edr_2m_capable(hdev)) {
 717                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 718
 719                         if (lmp_edr_3slot_capable(hdev))
 720                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 721
 722                         if (lmp_edr_5slot_capable(hdev))
 723                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 724
 725                         if (lmp_edr_3m_capable(hdev)) {
 726                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 727
 728                                 if (lmp_edr_3slot_capable(hdev))
 729                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 730
 731                                 if (lmp_edr_5slot_capable(hdev))
 732                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 733                         }
 734                 }
 735         }
 736
 737         if (lmp_le_capable(hdev)) {
 738                 supported_phys |= MGMT_PHY_LE_1M_TX;
 739                 supported_phys |= MGMT_PHY_LE_1M_RX;
 740
 741                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 742                         supported_phys |= MGMT_PHY_LE_2M_TX;
 743                         supported_phys |= MGMT_PHY_LE_2M_RX;
 744                 }
 745
 746                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 747                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 748                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 749                 }
 750         }
 751
 752         return supported_phys;
 753 }
 754
 755 static u32 get_selected_phys(struct hci_dev *hdev)
 756 {
 757         u32 selected_phys = 0;
 758
 759         if (lmp_bredr_capable(hdev)) {
 760                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 761
 762                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 763                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 764
 765                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 766                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 767
 768                 if (lmp_edr_2m_capable(hdev)) {
 769                         if (!(hdev->pkt_type & HCI_2DH1))
 770                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 771
 772                         if (lmp_edr_3slot_capable(hdev) &&
 773                             !(hdev->pkt_type & HCI_2DH3))
 774                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 775
 776                         if (lmp_edr_5slot_capable(hdev) &&
 777                             !(hdev->pkt_type & HCI_2DH5))
 778                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 779
 780                         if (lmp_edr_3m_capable(hdev)) {
 781                                 if (!(hdev->pkt_type & HCI_3DH1))
 782                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 783
 784                                 if (lmp_edr_3slot_capable(hdev) &&
 785                                     !(hdev->pkt_type & HCI_3DH3))
 786                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 787
 788                                 if (lmp_edr_5slot_capable(hdev) &&
 789                                     !(hdev->pkt_type & HCI_3DH5))
 790                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 791                         }
 792                 }
 793         }
 794
 795         if (lmp_le_capable(hdev)) {
 796                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 797                         selected_phys |= MGMT_PHY_LE_1M_TX;
 798
 799                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 800                         selected_phys |= MGMT_PHY_LE_1M_RX;
 801
 802                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 803                         selected_phys |= MGMT_PHY_LE_2M_TX;
 804
 805                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 806                         selected_phys |= MGMT_PHY_LE_2M_RX;
 807
 808                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 809                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 810
 811                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 812                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 813         }
 814
 815         return selected_phys;
 816 }
 817
 818 static u32 get_configurable_phys(struct hci_dev *hdev)
 819 {
 820         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 821                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 822 }
 823
 824 static u32 get_supported_settings(struct hci_dev *hdev)
 825 {
 826         u32 settings = 0;
 827
 828         settings |= MGMT_SETTING_POWERED;
 829         settings |= MGMT_SETTING_BONDABLE;
 830         settings |= MGMT_SETTING_DEBUG_KEYS;
 831         settings |= MGMT_SETTING_CONNECTABLE;
 832         settings |= MGMT_SETTING_DISCOVERABLE;
 833
 834         if (lmp_bredr_capable(hdev)) {
 835                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 836                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 837                 settings |= MGMT_SETTING_BREDR;
 838                 settings |= MGMT_SETTING_LINK_SECURITY;
 839
 840                 if (lmp_ssp_capable(hdev)) {
 841                         settings |= MGMT_SETTING_SSP;
 842                         if (IS_ENABLED(CONFIG_BT_HS))
 843                                 settings |= MGMT_SETTING_HS;
 844                 }
 845
 846                 if (lmp_sc_capable(hdev))
 847                         settings |= MGMT_SETTING_SECURE_CONN;
 848
 849                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 850                              &hdev->quirks))
 851                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 852         }
 853
 854         if (lmp_le_capable(hdev)) {
 855                 settings |= MGMT_SETTING_LE;
 856                 settings |= MGMT_SETTING_SECURE_CONN;
 857                 settings |= MGMT_SETTING_PRIVACY;
 858                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 859                 settings |= MGMT_SETTING_ADVERTISING;
 860         }
 861
 862         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 863             hdev->set_bdaddr)
 864                 settings |= MGMT_SETTING_CONFIGURATION;
 865
 866         if (cis_central_capable(hdev))
 867                 settings |= MGMT_SETTING_CIS_CENTRAL;
 868
 869         if (cis_peripheral_capable(hdev))
 870                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 871
 872         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 873
 874         return settings;
 875 }
 876
 877 static u32 get_current_settings(struct hci_dev *hdev)
 878 {
 879         u32 settings = 0;
 880
 881         if (hdev_is_powered(hdev))
 882                 settings |= MGMT_SETTING_POWERED;
 883
 884         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 885                 settings |= MGMT_SETTING_CONNECTABLE;
 886
 887         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 888                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 889
 890         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 891                 settings |= MGMT_SETTING_DISCOVERABLE;
 892
 893         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 894                 settings |= MGMT_SETTING_BONDABLE;
 895
 896         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 897                 settings |= MGMT_SETTING_BREDR;
 898
 899         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 900                 settings |= MGMT_SETTING_LE;
 901
 902         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 903                 settings |= MGMT_SETTING_LINK_SECURITY;
 904
 905         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 906                 settings |= MGMT_SETTING_SSP;
 907
 908         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 909                 settings |= MGMT_SETTING_HS;
 910
 911         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 912                 settings |= MGMT_SETTING_ADVERTISING;
 913
 914         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 915                 settings |= MGMT_SETTING_SECURE_CONN;
 916
 917         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 918                 settings |= MGMT_SETTING_DEBUG_KEYS;
 919
 920         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 921                 settings |= MGMT_SETTING_PRIVACY;
 922
 923         /* The current setting for static address has two purposes. The
 924          * first is to indicate if the static address will be used and
 925          * the second is to indicate if it is actually set.
 926          *
 927          * This means if the static address is not configured, this flag
 928          * will never be set. If the address is configured, then if the
 929          * address is actually used decides if the flag is set or not.
 930          *
 931          * For single mode LE only controllers and dual-mode controllers
 932          * with BR/EDR disabled, the existence of the static address will
 933          * be evaluated.
 934          */
 935         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 936             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 937             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 938                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 939                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 940         }
 941
 942         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 943                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 944
 945         if (cis_central_capable(hdev))
 946                 settings |= MGMT_SETTING_CIS_CENTRAL;
 947
 948         if (cis_peripheral_capable(hdev))
 949                 settings |= MGMT_SETTING_CIS_PERIPHERAL;
 950
 951         if (bis_capable(hdev))
 952                 settings |= MGMT_SETTING_ISO_BROADCASTER;
 953
 954         if (sync_recv_capable(hdev))
 955                 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER;
 956
 957         return settings;
 958 }
 959
 960 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 961 {
 962         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 963 }
 964
 965 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 966 {
 967         struct mgmt_pending_cmd *cmd;
 968
 969         /* If there's a pending mgmt command the flags will not yet have
 970          * their final values, so check for this first.
 971          */
 972         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 973         if (cmd) {
 974                 struct mgmt_mode *cp = cmd->param;
 975                 if (cp->val == 0x01)
 976                         return LE_AD_GENERAL;
 977                 else if (cp->val == 0x02)
 978                         return LE_AD_LIMITED;
 979         } else {
 980                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 981                         return LE_AD_LIMITED;
 982                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 983                         return LE_AD_GENERAL;
 984         }
 985
 986         return 0;
 987 }
 988
 989 bool mgmt_get_connectable(struct hci_dev *hdev)
 990 {
 991         struct mgmt_pending_cmd *cmd;
 992
 993         /* If there's a pending mgmt command the flag will not yet have
 994          * it's final value, so check for this first.
 995          */
 996         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 997         if (cmd) {
 998                 struct mgmt_mode *cp = cmd->param;
 999
1000                 return cp->val;
1001         }
1002
1003         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
1004 }
1005
1006 static int service_cache_sync(struct hci_dev *hdev, void *data)
1007 {
1008         hci_update_eir_sync(hdev);
1009         hci_update_class_sync(hdev);
1010
1011         return 0;
1012 }
1013
1014 static void service_cache_off(struct work_struct *work)
1015 {
1016         struct hci_dev *hdev = container_of(work, struct hci_dev,
1017                                             service_cache.work);
1018
1019         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1020                 return;
1021
1022         hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1023 }
1024
1025 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1026 {
1027         /* The generation of a new RPA and programming it into the
1028          * controller happens in the hci_req_enable_advertising()
1029          * function.
1030          */
1031         if (ext_adv_capable(hdev))
1032                 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1033         else
1034                 return hci_enable_advertising_sync(hdev);
1035 }
1036
1037 static void rpa_expired(struct work_struct *work)
1038 {
1039         struct hci_dev *hdev = container_of(work, struct hci_dev,
1040                                             rpa_expired.work);
1041
1042         bt_dev_dbg(hdev, "");
1043
1044         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1045
1046         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1047                 return;
1048
1049         hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1050 }
1051
1052 static void discov_off(struct work_struct *work)
1053 {
1054         struct hci_dev *hdev = container_of(work, struct hci_dev,
1055                                             discov_off.work);
1056
1057         bt_dev_dbg(hdev, "");
1058
1059         hci_dev_lock(hdev);
1060
1061         /* When discoverable timeout triggers, then just make sure
1062          * the limited discoverable flag is cleared. Even in the case
1063          * of a timeout triggered from general discoverable, it is
1064          * safe to unconditionally clear the flag.
1065          */
1066         hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1067         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1068         hdev->discov_timeout = 0;
1069
1070         hci_update_discoverable(hdev);
1071
1072         mgmt_new_settings(hdev);
1073
1074         hci_dev_unlock(hdev);
1075 }
1076
1077 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1078
1079 static void mesh_send_complete(struct hci_dev *hdev,
1080                                struct mgmt_mesh_tx *mesh_tx, bool silent)
1081 {
1082         u8 handle = mesh_tx->handle;
1083
1084         if (!silent)
1085                 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1086                            sizeof(handle), NULL);
1087
1088         mgmt_mesh_remove(mesh_tx);
1089 }
1090
1091 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1092 {
1093         struct mgmt_mesh_tx *mesh_tx;
1094
1095         hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1096         hci_disable_advertising_sync(hdev);
1097         mesh_tx = mgmt_mesh_next(hdev, NULL);
1098
1099         if (mesh_tx)
1100                 mesh_send_complete(hdev, mesh_tx, false);
1101
1102         return 0;
1103 }
1104
1105 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1106 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
1107 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1108 {
1109         struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1110
1111         if (!mesh_tx)
1112                 return;
1113
1114         err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1115                                  mesh_send_start_complete);
1116
1117         if (err < 0)
1118                 mesh_send_complete(hdev, mesh_tx, false);
1119         else
1120                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1121 }
1122
1123 static void mesh_send_done(struct work_struct *work)
1124 {
1125         struct hci_dev *hdev = container_of(work, struct hci_dev,
1126                                             mesh_send_done.work);
1127
1128         if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1129                 return;
1130
1131         hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1132 }
1133
1134 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1135 {
1136         if (hci_dev_test_flag(hdev, HCI_MGMT))
1137                 return;
1138
1139         BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1140
1141         INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1142         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1143         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1144         INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1145
1146         /* Non-mgmt controlled devices get this bit set
1147          * implicitly so that pairing works for them, however
1148          * for mgmt we require user-space to explicitly enable
1149          * it
1150          */
1151         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1152
1153         hci_dev_set_flag(hdev, HCI_MGMT);
1154 }
1155
1156 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1157                                 void *data, u16 data_len)
1158 {
1159         struct mgmt_rp_read_info rp;
1160
1161         bt_dev_dbg(hdev, "sock %p", sk);
1162
1163         hci_dev_lock(hdev);
1164
1165         memset(&rp, 0, sizeof(rp));
1166
1167         bacpy(&rp.bdaddr, &hdev->bdaddr);
1168
1169         rp.version = hdev->hci_ver;
1170         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1171
1172         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1173         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1174
1175         memcpy(rp.dev_class, hdev->dev_class, 3);
1176
1177         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1178         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1179
1180         hci_dev_unlock(hdev);
1181
1182         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1183                                  sizeof(rp));
1184 }
1185
1186 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1187 {
1188         u16 eir_len = 0;
1189         size_t name_len;
1190
1191         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1192                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1193                                           hdev->dev_class, 3);
1194
1195         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1196                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1197                                           hdev->appearance);
1198
1199         name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1200         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1201                                   hdev->dev_name, name_len);
1202
1203         name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1204         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1205                                   hdev->short_name, name_len);
1206
1207         return eir_len;
1208 }
1209
1210 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1211                                     void *data, u16 data_len)
1212 {
1213         char buf[512];
1214         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1215         u16 eir_len;
1216
1217         bt_dev_dbg(hdev, "sock %p", sk);
1218
1219         memset(&buf, 0, sizeof(buf));
1220
1221         hci_dev_lock(hdev);
1222
1223         bacpy(&rp->bdaddr, &hdev->bdaddr);
1224
1225         rp->version = hdev->hci_ver;
1226         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1227
1228         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1229         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1230
1231
1232         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1233         rp->eir_len = cpu_to_le16(eir_len);
1234
1235         hci_dev_unlock(hdev);
1236
1237         /* If this command is called at least once, then the events
1238          * for class of device and local name changes are disabled
1239          * and only the new extended controller information event
1240          * is used.
1241          */
1242         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1243         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1244         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1245
1246         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1247                                  sizeof(*rp) + eir_len);
1248 }
1249
1250 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1251 {
1252         char buf[512];
1253         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1254         u16 eir_len;
1255
1256         memset(buf, 0, sizeof(buf));
1257
1258         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1259         ev->eir_len = cpu_to_le16(eir_len);
1260
1261         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1262                                   sizeof(*ev) + eir_len,
1263                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1264 }
1265
1266 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1267 {
1268         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1269
1270         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1271                                  sizeof(settings));
1272 }
1273
1274 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1275 {
1276         struct mgmt_ev_advertising_added ev;
1277
1278         ev.instance = instance;
1279
1280         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1281 }
1282
1283 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1284                               u8 instance)
1285 {
1286         struct mgmt_ev_advertising_removed ev;
1287
1288         ev.instance = instance;
1289
1290         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1291 }
1292
1293 static void cancel_adv_timeout(struct hci_dev *hdev)
1294 {
1295         if (hdev->adv_instance_timeout) {
1296                 hdev->adv_instance_timeout = 0;
1297                 cancel_delayed_work(&hdev->adv_instance_expire);
1298         }
1299 }
1300
1301 /* This function requires the caller holds hdev->lock */
1302 static void restart_le_actions(struct hci_dev *hdev)
1303 {
1304         struct hci_conn_params *p;
1305
1306         list_for_each_entry(p, &hdev->le_conn_params, list) {
1307                 /* Needed for AUTO_OFF case where might not "really"
1308                  * have been powered off.
1309                  */
1310                 hci_pend_le_list_del_init(p);
1311
1312                 switch (p->auto_connect) {
1313                 case HCI_AUTO_CONN_DIRECT:
1314                 case HCI_AUTO_CONN_ALWAYS:
1315                         hci_pend_le_list_add(p, &hdev->pend_le_conns);
1316                         break;
1317                 case HCI_AUTO_CONN_REPORT:
1318                         hci_pend_le_list_add(p, &hdev->pend_le_reports);
1319                         break;
1320                 default:
1321                         break;
1322                 }
1323         }
1324 }
1325
1326 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1327 {
1328         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1329
1330         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1331                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1332 }
1333
1334 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1335 {
1336         struct mgmt_pending_cmd *cmd = data;
1337         struct mgmt_mode *cp;
1338
1339         /* Make sure cmd still outstanding. */
1340         if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
1341                 return;
1342
1343         cp = cmd->param;
1344
1345         bt_dev_dbg(hdev, "err %d", err);
1346
1347         if (!err) {
1348                 if (cp->val) {
1349                         hci_dev_lock(hdev);
1350                         restart_le_actions(hdev);
1351                         hci_update_passive_scan(hdev);
1352                         hci_dev_unlock(hdev);
1353                 }
1354
1355                 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1356
1357                 /* Only call new_setting for power on as power off is deferred
1358                  * to hdev->power_off work which does call hci_dev_do_close.
1359                  */
1360                 if (cp->val)
1361                         new_settings(hdev, cmd->sk);
1362         } else {
1363                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1364                                 mgmt_status(err));
1365         }
1366
1367         mgmt_pending_remove(cmd);
1368 }
1369
1370 static int set_powered_sync(struct hci_dev *hdev, void *data)
1371 {
1372         struct mgmt_pending_cmd *cmd = data;
1373         struct mgmt_mode *cp = cmd->param;
1374
1375         BT_DBG("%s", hdev->name);
1376
1377         return hci_set_powered_sync(hdev, cp->val);
1378 }
1379
1380 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1381                        u16 len)
1382 {
1383         struct mgmt_mode *cp = data;
1384         struct mgmt_pending_cmd *cmd;
1385         int err;
1386
1387         bt_dev_dbg(hdev, "sock %p", sk);
1388
1389         if (cp->val != 0x00 && cp->val != 0x01)
1390                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1391                                        MGMT_STATUS_INVALID_PARAMS);
1392
1393         hci_dev_lock(hdev);
1394
1395         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1396                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1397                                       MGMT_STATUS_BUSY);
1398                 goto failed;
1399         }
1400
1401         if (!!cp->val == hdev_is_powered(hdev)) {
1402                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1403                 goto failed;
1404         }
1405
1406         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1407         if (!cmd) {
1408                 err = -ENOMEM;
1409                 goto failed;
1410         }
1411
1412         /* Cancel potentially blocking sync operation before power off */
1413         if (cp->val == 0x00) {
1414                 __hci_cmd_sync_cancel(hdev, -EHOSTDOWN);
1415                 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1416                                          mgmt_set_powered_complete);
1417         } else {
1418                 /* Use hci_cmd_sync_submit since hdev might not be running */
1419                 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd,
1420                                           mgmt_set_powered_complete);
1421         }
1422
1423         if (err < 0)
1424                 mgmt_pending_remove(cmd);
1425
1426 failed:
1427         hci_dev_unlock(hdev);
1428         return err;
1429 }
1430
1431 int mgmt_new_settings(struct hci_dev *hdev)
1432 {
1433         return new_settings(hdev, NULL);
1434 }
1435
1436 struct cmd_lookup {
1437         struct sock *sk;
1438         struct hci_dev *hdev;
1439         u8 mgmt_status;
1440 };
1441
1442 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1443 {
1444         struct cmd_lookup *match = data;
1445
1446         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1447
1448         list_del(&cmd->list);
1449
1450         if (match->sk == NULL) {
1451                 match->sk = cmd->sk;
1452                 sock_hold(match->sk);
1453         }
1454
1455         mgmt_pending_free(cmd);
1456 }
1457
1458 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1459 {
1460         u8 *status = data;
1461
1462         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1463         mgmt_pending_remove(cmd);
1464 }
1465
1466 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1467 {
1468         if (cmd->cmd_complete) {
1469                 u8 *status = data;
1470
1471                 cmd->cmd_complete(cmd, *status);
1472                 mgmt_pending_remove(cmd);
1473
1474                 return;
1475         }
1476
1477         cmd_status_rsp(cmd, data);
1478 }
1479
1480 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1481 {
1482         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1483                                  cmd->param, cmd->param_len);
1484 }
1485
1486 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1487 {
1488         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1489                                  cmd->param, sizeof(struct mgmt_addr_info));
1490 }
1491
1492 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1493 {
1494         if (!lmp_bredr_capable(hdev))
1495                 return MGMT_STATUS_NOT_SUPPORTED;
1496         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1497                 return MGMT_STATUS_REJECTED;
1498         else
1499                 return MGMT_STATUS_SUCCESS;
1500 }
1501
1502 static u8 mgmt_le_support(struct hci_dev *hdev)
1503 {
1504         if (!lmp_le_capable(hdev))
1505                 return MGMT_STATUS_NOT_SUPPORTED;
1506         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1507                 return MGMT_STATUS_REJECTED;
1508         else
1509                 return MGMT_STATUS_SUCCESS;
1510 }
1511
1512 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1513                                            int err)
1514 {
1515         struct mgmt_pending_cmd *cmd = data;
1516
1517         bt_dev_dbg(hdev, "err %d", err);
1518
1519         /* Make sure cmd still outstanding. */
1520         if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
1521                 return;
1522
1523         hci_dev_lock(hdev);
1524
1525         if (err) {
1526                 u8 mgmt_err = mgmt_status(err);
1527                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1528                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1529                 goto done;
1530         }
1531
1532         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1533             hdev->discov_timeout > 0) {
1534                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1535                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1536         }
1537
1538         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1539         new_settings(hdev, cmd->sk);
1540
1541 done:
1542         mgmt_pending_remove(cmd);
1543         hci_dev_unlock(hdev);
1544 }
1545
1546 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1547 {
1548         BT_DBG("%s", hdev->name);
1549
1550         return hci_update_discoverable_sync(hdev);
1551 }
1552
1553 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1554                             u16 len)
1555 {
1556         struct mgmt_cp_set_discoverable *cp = data;
1557         struct mgmt_pending_cmd *cmd;
1558         u16 timeout;
1559         int err;
1560
1561         bt_dev_dbg(hdev, "sock %p", sk);
1562
1563         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1564             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1565                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1566                                        MGMT_STATUS_REJECTED);
1567
1568         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1569                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1570                                        MGMT_STATUS_INVALID_PARAMS);
1571
1572         timeout = __le16_to_cpu(cp->timeout);
1573
1574         /* Disabling discoverable requires that no timeout is set,
1575          * and enabling limited discoverable requires a timeout.
1576          */
1577         if ((cp->val == 0x00 && timeout > 0) ||
1578             (cp->val == 0x02 && timeout == 0))
1579                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1580                                        MGMT_STATUS_INVALID_PARAMS);
1581
1582         hci_dev_lock(hdev);
1583
1584         if (!hdev_is_powered(hdev) && timeout > 0) {
1585                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1586                                       MGMT_STATUS_NOT_POWERED);
1587                 goto failed;
1588         }
1589
1590         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1591             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1592                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1593                                       MGMT_STATUS_BUSY);
1594                 goto failed;
1595         }
1596
1597         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1598                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1599                                       MGMT_STATUS_REJECTED);
1600                 goto failed;
1601         }
1602
1603         if (hdev->advertising_paused) {
1604                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1605                                       MGMT_STATUS_BUSY);
1606                 goto failed;
1607         }
1608
1609         if (!hdev_is_powered(hdev)) {
1610                 bool changed = false;
1611
1612                 /* Setting limited discoverable when powered off is
1613                  * not a valid operation since it requires a timeout
1614                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1615                  */
1616                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1617                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1618                         changed = true;
1619                 }
1620
1621                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1622                 if (err < 0)
1623                         goto failed;
1624
1625                 if (changed)
1626                         err = new_settings(hdev, sk);
1627
1628                 goto failed;
1629         }
1630
1631         /* If the current mode is the same, then just update the timeout
1632          * value with the new value. And if only the timeout gets updated,
1633          * then no need for any HCI transactions.
1634          */
1635         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1636             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1637                                                    HCI_LIMITED_DISCOVERABLE)) {
1638                 cancel_delayed_work(&hdev->discov_off);
1639                 hdev->discov_timeout = timeout;
1640
1641                 if (cp->val && hdev->discov_timeout > 0) {
1642                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1643                         queue_delayed_work(hdev->req_workqueue,
1644                                            &hdev->discov_off, to);
1645                 }
1646
1647                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1648                 goto failed;
1649         }
1650
1651         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1652         if (!cmd) {
1653                 err = -ENOMEM;
1654                 goto failed;
1655         }
1656
1657         /* Cancel any potential discoverable timeout that might be
1658          * still active and store new timeout value. The arming of
1659          * the timeout happens in the complete handler.
1660          */
1661         cancel_delayed_work(&hdev->discov_off);
1662         hdev->discov_timeout = timeout;
1663
1664         if (cp->val)
1665                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1666         else
1667                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1668
1669         /* Limited discoverable mode */
1670         if (cp->val == 0x02)
1671                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1672         else
1673                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1674
1675         err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1676                                  mgmt_set_discoverable_complete);
1677
1678         if (err < 0)
1679                 mgmt_pending_remove(cmd);
1680
1681 failed:
1682         hci_dev_unlock(hdev);
1683         return err;
1684 }
1685
1686 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1687                                           int err)
1688 {
1689         struct mgmt_pending_cmd *cmd = data;
1690
1691         bt_dev_dbg(hdev, "err %d", err);
1692
1693         /* Make sure cmd still outstanding. */
1694         if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
1695                 return;
1696
1697         hci_dev_lock(hdev);
1698
1699         if (err) {
1700                 u8 mgmt_err = mgmt_status(err);
1701                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1702                 goto done;
1703         }
1704
1705         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1706         new_settings(hdev, cmd->sk);
1707
1708 done:
1709         if (cmd)
1710                 mgmt_pending_remove(cmd);
1711
1712         hci_dev_unlock(hdev);
1713 }
1714
1715 static int set_connectable_update_settings(struct hci_dev *hdev,
1716                                            struct sock *sk, u8 val)
1717 {
1718         bool changed = false;
1719         int err;
1720
1721         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1722                 changed = true;
1723
1724         if (val) {
1725                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1726         } else {
1727                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1728                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1729         }
1730
1731         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1732         if (err < 0)
1733                 return err;
1734
1735         if (changed) {
1736                 hci_update_scan(hdev);
1737                 hci_update_passive_scan(hdev);
1738                 return new_settings(hdev, sk);
1739         }
1740
1741         return 0;
1742 }
1743
1744 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1745 {
1746         BT_DBG("%s", hdev->name);
1747
1748         return hci_update_connectable_sync(hdev);
1749 }
1750
1751 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1752                            u16 len)
1753 {
1754         struct mgmt_mode *cp = data;
1755         struct mgmt_pending_cmd *cmd;
1756         int err;
1757
1758         bt_dev_dbg(hdev, "sock %p", sk);
1759
1760         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1761             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1762                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1763                                        MGMT_STATUS_REJECTED);
1764
1765         if (cp->val != 0x00 && cp->val != 0x01)
1766                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1767                                        MGMT_STATUS_INVALID_PARAMS);
1768
1769         hci_dev_lock(hdev);
1770
1771         if (!hdev_is_powered(hdev)) {
1772                 err = set_connectable_update_settings(hdev, sk, cp->val);
1773                 goto failed;
1774         }
1775
1776         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1777             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1778                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1779                                       MGMT_STATUS_BUSY);
1780                 goto failed;
1781         }
1782
1783         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1784         if (!cmd) {
1785                 err = -ENOMEM;
1786                 goto failed;
1787         }
1788
1789         if (cp->val) {
1790                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1791         } else {
1792                 if (hdev->discov_timeout > 0)
1793                         cancel_delayed_work(&hdev->discov_off);
1794
1795                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1796                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1797                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1798         }
1799
1800         err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1801                                  mgmt_set_connectable_complete);
1802
1803         if (err < 0)
1804                 mgmt_pending_remove(cmd);
1805
1806 failed:
1807         hci_dev_unlock(hdev);
1808         return err;
1809 }
1810
1811 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1812                         u16 len)
1813 {
1814         struct mgmt_mode *cp = data;
1815         bool changed;
1816         int err;
1817
1818         bt_dev_dbg(hdev, "sock %p", sk);
1819
1820         if (cp->val != 0x00 && cp->val != 0x01)
1821                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1822                                        MGMT_STATUS_INVALID_PARAMS);
1823
1824         hci_dev_lock(hdev);
1825
1826         if (cp->val)
1827                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1828         else
1829                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1830
1831         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1832         if (err < 0)
1833                 goto unlock;
1834
1835         if (changed) {
1836                 /* In limited privacy mode the change of bondable mode
1837                  * may affect the local advertising address.
1838                  */
1839                 hci_update_discoverable(hdev);
1840
1841                 err = new_settings(hdev, sk);
1842         }
1843
1844 unlock:
1845         hci_dev_unlock(hdev);
1846         return err;
1847 }
1848
1849 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1850                              u16 len)
1851 {
1852         struct mgmt_mode *cp = data;
1853         struct mgmt_pending_cmd *cmd;
1854         u8 val, status;
1855         int err;
1856
1857         bt_dev_dbg(hdev, "sock %p", sk);
1858
1859         status = mgmt_bredr_support(hdev);
1860         if (status)
1861                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1862                                        status);
1863
1864         if (cp->val != 0x00 && cp->val != 0x01)
1865                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1866                                        MGMT_STATUS_INVALID_PARAMS);
1867
1868         hci_dev_lock(hdev);
1869
1870         if (!hdev_is_powered(hdev)) {
1871                 bool changed = false;
1872
1873                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1874                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1875                         changed = true;
1876                 }
1877
1878                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1879                 if (err < 0)
1880                         goto failed;
1881
1882                 if (changed)
1883                         err = new_settings(hdev, sk);
1884
1885                 goto failed;
1886         }
1887
1888         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1889                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1890                                       MGMT_STATUS_BUSY);
1891                 goto failed;
1892         }
1893
1894         val = !!cp->val;
1895
1896         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1897                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1898                 goto failed;
1899         }
1900
1901         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1902         if (!cmd) {
1903                 err = -ENOMEM;
1904                 goto failed;
1905         }
1906
1907         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1908         if (err < 0) {
1909                 mgmt_pending_remove(cmd);
1910                 goto failed;
1911         }
1912
1913 failed:
1914         hci_dev_unlock(hdev);
1915         return err;
1916 }
1917
1918 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1919 {
1920         struct cmd_lookup match = { NULL, hdev };
1921         struct mgmt_pending_cmd *cmd = data;
1922         struct mgmt_mode *cp = cmd->param;
1923         u8 enable = cp->val;
1924         bool changed;
1925
1926         /* Make sure cmd still outstanding. */
1927         if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
1928                 return;
1929
1930         if (err) {
1931                 u8 mgmt_err = mgmt_status(err);
1932
1933                 if (enable && hci_dev_test_and_clear_flag(hdev,
1934                                                           HCI_SSP_ENABLED)) {
1935                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1936                         new_settings(hdev, NULL);
1937                 }
1938
1939                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
1940                                      &mgmt_err);
1941                 return;
1942         }
1943
1944         if (enable) {
1945                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1946         } else {
1947                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1948
1949                 if (!changed)
1950                         changed = hci_dev_test_and_clear_flag(hdev,
1951                                                               HCI_HS_ENABLED);
1952                 else
1953                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1954         }
1955
1956         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
1957
1958         if (changed)
1959                 new_settings(hdev, match.sk);
1960
1961         if (match.sk)
1962                 sock_put(match.sk);
1963
1964         hci_update_eir_sync(hdev);
1965 }
1966
1967 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1968 {
1969         struct mgmt_pending_cmd *cmd = data;
1970         struct mgmt_mode *cp = cmd->param;
1971         bool changed = false;
1972         int err;
1973
1974         if (cp->val)
1975                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1976
1977         err = hci_write_ssp_mode_sync(hdev, cp->val);
1978
1979         if (!err && changed)
1980                 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
1981
1982         return err;
1983 }
1984
1985 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1986 {
1987         struct mgmt_mode *cp = data;
1988         struct mgmt_pending_cmd *cmd;
1989         u8 status;
1990         int err;
1991
1992         bt_dev_dbg(hdev, "sock %p", sk);
1993
1994         status = mgmt_bredr_support(hdev);
1995         if (status)
1996                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1997
1998         if (!lmp_ssp_capable(hdev))
1999                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2000                                        MGMT_STATUS_NOT_SUPPORTED);
2001
2002         if (cp->val != 0x00 && cp->val != 0x01)
2003                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2004                                        MGMT_STATUS_INVALID_PARAMS);
2005
2006         hci_dev_lock(hdev);
2007
2008         if (!hdev_is_powered(hdev)) {
2009                 bool changed;
2010
2011                 if (cp->val) {
2012                         changed = !hci_dev_test_and_set_flag(hdev,
2013                                                              HCI_SSP_ENABLED);
2014                 } else {
2015                         changed = hci_dev_test_and_clear_flag(hdev,
2016                                                               HCI_SSP_ENABLED);
2017                         if (!changed)
2018                                 changed = hci_dev_test_and_clear_flag(hdev,
2019                                                                       HCI_HS_ENABLED);
2020                         else
2021                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
2022                 }
2023
2024                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2025                 if (err < 0)
2026                         goto failed;
2027
2028                 if (changed)
2029                         err = new_settings(hdev, sk);
2030
2031                 goto failed;
2032         }
2033
2034         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2035                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2036                                       MGMT_STATUS_BUSY);
2037                 goto failed;
2038         }
2039
2040         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2041                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2042                 goto failed;
2043         }
2044
2045         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2046         if (!cmd)
2047                 err = -ENOMEM;
2048         else
2049                 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2050                                          set_ssp_complete);
2051
2052         if (err < 0) {
2053                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2054                                       MGMT_STATUS_FAILED);
2055
2056                 if (cmd)
2057                         mgmt_pending_remove(cmd);
2058         }
2059
2060 failed:
2061         hci_dev_unlock(hdev);
2062         return err;
2063 }
2064
2065 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2066 {
2067         struct mgmt_mode *cp = data;
2068         bool changed;
2069         u8 status;
2070         int err;
2071
2072         bt_dev_dbg(hdev, "sock %p", sk);
2073
2074         if (!IS_ENABLED(CONFIG_BT_HS))
2075                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2076                                        MGMT_STATUS_NOT_SUPPORTED);
2077
2078         status = mgmt_bredr_support(hdev);
2079         if (status)
2080                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2081
2082         if (!lmp_ssp_capable(hdev))
2083                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2084                                        MGMT_STATUS_NOT_SUPPORTED);
2085
2086         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
2087                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2088                                        MGMT_STATUS_REJECTED);
2089
2090         if (cp->val != 0x00 && cp->val != 0x01)
2091                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2092                                        MGMT_STATUS_INVALID_PARAMS);
2093
2094         hci_dev_lock(hdev);
2095
2096         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2097                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2098                                       MGMT_STATUS_BUSY);
2099                 goto unlock;
2100         }
2101
2102         if (cp->val) {
2103                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
2104         } else {
2105                 if (hdev_is_powered(hdev)) {
2106                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2107                                               MGMT_STATUS_REJECTED);
2108                         goto unlock;
2109                 }
2110
2111                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
2112         }
2113
2114         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2115         if (err < 0)
2116                 goto unlock;
2117
2118         if (changed)
2119                 err = new_settings(hdev, sk);
2120
2121 unlock:
2122         hci_dev_unlock(hdev);
2123         return err;
2124 }
2125
2126 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2127 {
2128         struct cmd_lookup match = { NULL, hdev };
2129         u8 status = mgmt_status(err);
2130
2131         bt_dev_dbg(hdev, "err %d", err);
2132
2133         if (status) {
2134                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2135                                                         &status);
2136                 return;
2137         }
2138
2139         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2140
2141         new_settings(hdev, match.sk);
2142
2143         if (match.sk)
2144                 sock_put(match.sk);
2145 }
2146
2147 static int set_le_sync(struct hci_dev *hdev, void *data)
2148 {
2149         struct mgmt_pending_cmd *cmd = data;
2150         struct mgmt_mode *cp = cmd->param;
2151         u8 val = !!cp->val;
2152         int err;
2153
2154         if (!val) {
2155                 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2156
2157                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2158                         hci_disable_advertising_sync(hdev);
2159
2160                 if (ext_adv_capable(hdev))
2161                         hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2162         } else {
2163                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2164         }
2165
2166         err = hci_write_le_host_supported_sync(hdev, val, 0);
2167
2168         /* Make sure the controller has a good default for
2169          * advertising data. Restrict the update to when LE
2170          * has actually been enabled. During power on, the
2171          * update in powered_update_hci will take care of it.
2172          */
2173         if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2174                 if (ext_adv_capable(hdev)) {
2175                         int status;
2176
2177                         status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2178                         if (!status)
2179                                 hci_update_scan_rsp_data_sync(hdev, 0x00);
2180                 } else {
2181                         hci_update_adv_data_sync(hdev, 0x00);
2182                         hci_update_scan_rsp_data_sync(hdev, 0x00);
2183                 }
2184
2185                 hci_update_passive_scan(hdev);
2186         }
2187
2188         return err;
2189 }
2190
2191 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2192 {
2193         struct mgmt_pending_cmd *cmd = data;
2194         u8 status = mgmt_status(err);
2195         struct sock *sk = cmd->sk;
2196
2197         if (status) {
2198                 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev,
2199                                      cmd_status_rsp, &status);
2200                 return;
2201         }
2202
2203         mgmt_pending_remove(cmd);
2204         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2205 }
2206
2207 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2208 {
2209         struct mgmt_pending_cmd *cmd = data;
2210         struct mgmt_cp_set_mesh *cp = cmd->param;
2211         size_t len = cmd->param_len;
2212
2213         memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2214
2215         if (cp->enable)
2216                 hci_dev_set_flag(hdev, HCI_MESH);
2217         else
2218                 hci_dev_clear_flag(hdev, HCI_MESH);
2219
2220         len -= sizeof(*cp);
2221
2222         /* If filters don't fit, forward all adv pkts */
2223         if (len <= sizeof(hdev->mesh_ad_types))
2224                 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2225
2226         hci_update_passive_scan_sync(hdev);
2227         return 0;
2228 }
2229
2230 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2231 {
2232         struct mgmt_cp_set_mesh *cp = data;
2233         struct mgmt_pending_cmd *cmd;
2234         int err = 0;
2235
2236         bt_dev_dbg(hdev, "sock %p", sk);
2237
2238         if (!lmp_le_capable(hdev) ||
2239             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2240                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2241                                        MGMT_STATUS_NOT_SUPPORTED);
2242
2243         if (cp->enable != 0x00 && cp->enable != 0x01)
2244                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2245                                        MGMT_STATUS_INVALID_PARAMS);
2246
2247         hci_dev_lock(hdev);
2248
2249         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2250         if (!cmd)
2251                 err = -ENOMEM;
2252         else
2253                 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2254                                          set_mesh_complete);
2255
2256         if (err < 0) {
2257                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2258                                       MGMT_STATUS_FAILED);
2259
2260                 if (cmd)
2261                         mgmt_pending_remove(cmd);
2262         }
2263
2264         hci_dev_unlock(hdev);
2265         return err;
2266 }
2267
2268 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2269 {
2270         struct mgmt_mesh_tx *mesh_tx = data;
2271         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2272         unsigned long mesh_send_interval;
2273         u8 mgmt_err = mgmt_status(err);
2274
2275         /* Report any errors here, but don't report completion */
2276
2277         if (mgmt_err) {
2278                 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2279                 /* Send Complete Error Code for handle */
2280                 mesh_send_complete(hdev, mesh_tx, false);
2281                 return;
2282         }
2283
2284         mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2285         queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2286                            mesh_send_interval);
2287 }
2288
2289 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2290 {
2291         struct mgmt_mesh_tx *mesh_tx = data;
2292         struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2293         struct adv_info *adv, *next_instance;
2294         u8 instance = hdev->le_num_of_adv_sets + 1;
2295         u16 timeout, duration;
2296         int err = 0;
2297
2298         if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2299                 return MGMT_STATUS_BUSY;
2300
2301         timeout = 1000;
2302         duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2303         adv = hci_add_adv_instance(hdev, instance, 0,
2304                                    send->adv_data_len, send->adv_data,
2305                                    0, NULL,
2306                                    timeout, duration,
2307                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
2308                                    hdev->le_adv_min_interval,
2309                                    hdev->le_adv_max_interval,
2310                                    mesh_tx->handle);
2311
2312         if (!IS_ERR(adv))
2313                 mesh_tx->instance = instance;
2314         else
2315                 err = PTR_ERR(adv);
2316
2317         if (hdev->cur_adv_instance == instance) {
2318                 /* If the currently advertised instance is being changed then
2319                  * cancel the current advertising and schedule the next
2320                  * instance. If there is only one instance then the overridden
2321                  * advertising data will be visible right away.
2322                  */
2323                 cancel_adv_timeout(hdev);
2324
2325                 next_instance = hci_get_next_instance(hdev, instance);
2326                 if (next_instance)
2327                         instance = next_instance->instance;
2328                 else
2329                         instance = 0;
2330         } else if (hdev->adv_instance_timeout) {
2331                 /* Immediately advertise the new instance if no other, or
2332                  * let it go naturally from queue if ADV is already happening
2333                  */
2334                 instance = 0;
2335         }
2336
2337         if (instance)
2338                 return hci_schedule_adv_instance_sync(hdev, instance, true);
2339
2340         return err;
2341 }
2342
2343 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2344 {
2345         struct mgmt_rp_mesh_read_features *rp = data;
2346
2347         if (rp->used_handles >= rp->max_handles)
2348                 return;
2349
2350         rp->handles[rp->used_handles++] = mesh_tx->handle;
2351 }
2352
2353 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2354                          void *data, u16 len)
2355 {
2356         struct mgmt_rp_mesh_read_features rp;
2357
2358         if (!lmp_le_capable(hdev) ||
2359             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2360                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2361                                        MGMT_STATUS_NOT_SUPPORTED);
2362
2363         memset(&rp, 0, sizeof(rp));
2364         rp.index = cpu_to_le16(hdev->id);
2365         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2366                 rp.max_handles = MESH_HANDLES_MAX;
2367
2368         hci_dev_lock(hdev);
2369
2370         if (rp.max_handles)
2371                 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2372
2373         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2374                           rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2375
2376         hci_dev_unlock(hdev);
2377         return 0;
2378 }
2379
2380 static int send_cancel(struct hci_dev *hdev, void *data)
2381 {
2382         struct mgmt_pending_cmd *cmd = data;
2383         struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2384         struct mgmt_mesh_tx *mesh_tx;
2385
2386         if (!cancel->handle) {
2387                 do {
2388                         mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2389
2390                         if (mesh_tx)
2391                                 mesh_send_complete(hdev, mesh_tx, false);
2392                 } while (mesh_tx);
2393         } else {
2394                 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2395
2396                 if (mesh_tx && mesh_tx->sk == cmd->sk)
2397                         mesh_send_complete(hdev, mesh_tx, false);
2398         }
2399
2400         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2401                           0, NULL, 0);
2402         mgmt_pending_free(cmd);
2403
2404         return 0;
2405 }
2406
2407 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2408                             void *data, u16 len)
2409 {
2410         struct mgmt_pending_cmd *cmd;
2411         int err;
2412
2413         if (!lmp_le_capable(hdev) ||
2414             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2415                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2416                                        MGMT_STATUS_NOT_SUPPORTED);
2417
2418         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2419                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2420                                        MGMT_STATUS_REJECTED);
2421
2422         hci_dev_lock(hdev);
2423         cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2424         if (!cmd)
2425                 err = -ENOMEM;
2426         else
2427                 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL);
2428
2429         if (err < 0) {
2430                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2431                                       MGMT_STATUS_FAILED);
2432
2433                 if (cmd)
2434                         mgmt_pending_free(cmd);
2435         }
2436
2437         hci_dev_unlock(hdev);
2438         return err;
2439 }
2440
2441 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2442 {
2443         struct mgmt_mesh_tx *mesh_tx;
2444         struct mgmt_cp_mesh_send *send = data;
2445         struct mgmt_rp_mesh_read_features rp;
2446         bool sending;
2447         int err = 0;
2448
2449         if (!lmp_le_capable(hdev) ||
2450             !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2451                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2452                                        MGMT_STATUS_NOT_SUPPORTED);
2453         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2454             len <= MGMT_MESH_SEND_SIZE ||
2455             len > (MGMT_MESH_SEND_SIZE + 31))
2456                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2457                                        MGMT_STATUS_REJECTED);
2458
2459         hci_dev_lock(hdev);
2460
2461         memset(&rp, 0, sizeof(rp));
2462         rp.max_handles = MESH_HANDLES_MAX;
2463
2464         mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2465
2466         if (rp.max_handles <= rp.used_handles) {
2467                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2468                                       MGMT_STATUS_BUSY);
2469                 goto done;
2470         }
2471
2472         sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2473         mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2474
2475         if (!mesh_tx)
2476                 err = -ENOMEM;
2477         else if (!sending)
2478                 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2479                                          mesh_send_start_complete);
2480
2481         if (err < 0) {
2482                 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2483                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2484                                       MGMT_STATUS_FAILED);
2485
2486                 if (mesh_tx) {
2487                         if (sending)
2488                                 mgmt_mesh_remove(mesh_tx);
2489                 }
2490         } else {
2491                 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2492
2493                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2494                                   &mesh_tx->handle, 1);
2495         }
2496
2497 done:
2498         hci_dev_unlock(hdev);
2499         return err;
2500 }
2501
2502 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2503 {
2504         struct mgmt_mode *cp = data;
2505         struct mgmt_pending_cmd *cmd;
2506         int err;
2507         u8 val, enabled;
2508
2509         bt_dev_dbg(hdev, "sock %p", sk);
2510
2511         if (!lmp_le_capable(hdev))
2512                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2513                                        MGMT_STATUS_NOT_SUPPORTED);
2514
2515         if (cp->val != 0x00 && cp->val != 0x01)
2516                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2517                                        MGMT_STATUS_INVALID_PARAMS);
2518
2519         /* Bluetooth single mode LE only controllers or dual-mode
2520          * controllers configured as LE only devices, do not allow
2521          * switching LE off. These have either LE enabled explicitly
2522          * or BR/EDR has been previously switched off.
2523          *
2524          * When trying to enable an already enabled LE, then gracefully
2525          * send a positive response. Trying to disable it however will
2526          * result into rejection.
2527          */
2528         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2529                 if (cp->val == 0x01)
2530                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2531
2532                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2533                                        MGMT_STATUS_REJECTED);
2534         }
2535
2536         hci_dev_lock(hdev);
2537
2538         val = !!cp->val;
2539         enabled = lmp_host_le_capable(hdev);
2540
2541         if (!hdev_is_powered(hdev) || val == enabled) {
2542                 bool changed = false;
2543
2544                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2545                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2546                         changed = true;
2547                 }
2548
2549                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2550                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2551                         changed = true;
2552                 }
2553
2554                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2555                 if (err < 0)
2556                         goto unlock;
2557
2558                 if (changed)
2559                         err = new_settings(hdev, sk);
2560
2561                 goto unlock;
2562         }
2563
2564         if (pending_find(MGMT_OP_SET_LE, hdev) ||
2565             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2566                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2567                                       MGMT_STATUS_BUSY);
2568                 goto unlock;
2569         }
2570
2571         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2572         if (!cmd)
2573                 err = -ENOMEM;
2574         else
2575                 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2576                                          set_le_complete);
2577
2578         if (err < 0) {
2579                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2580                                       MGMT_STATUS_FAILED);
2581
2582                 if (cmd)
2583                         mgmt_pending_remove(cmd);
2584         }
2585
2586 unlock:
2587         hci_dev_unlock(hdev);
2588         return err;
2589 }
2590
2591 /* This is a helper function to test for pending mgmt commands that can
2592  * cause CoD or EIR HCI commands. We can only allow one such pending
2593  * mgmt command at a time since otherwise we cannot easily track what
2594  * the current values are, will be, and based on that calculate if a new
2595  * HCI command needs to be sent and if yes with what value.
2596  */
2597 static bool pending_eir_or_class(struct hci_dev *hdev)
2598 {
2599         struct mgmt_pending_cmd *cmd;
2600
2601         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2602                 switch (cmd->opcode) {
2603                 case MGMT_OP_ADD_UUID:
2604                 case MGMT_OP_REMOVE_UUID:
2605                 case MGMT_OP_SET_DEV_CLASS:
2606                 case MGMT_OP_SET_POWERED:
2607                         return true;
2608                 }
2609         }
2610
2611         return false;
2612 }
2613
2614 static const u8 bluetooth_base_uuid[] = {
2615                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2616                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2617 };
2618
2619 static u8 get_uuid_size(const u8 *uuid)
2620 {
2621         u32 val;
2622
2623         if (memcmp(uuid, bluetooth_base_uuid, 12))
2624                 return 128;
2625
2626         val = get_unaligned_le32(&uuid[12]);
2627         if (val > 0xffff)
2628                 return 32;
2629
2630         return 16;
2631 }
2632
2633 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2634 {
2635         struct mgmt_pending_cmd *cmd = data;
2636
2637         bt_dev_dbg(hdev, "err %d", err);
2638
2639         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2640                           mgmt_status(err), hdev->dev_class, 3);
2641
2642         mgmt_pending_free(cmd);
2643 }
2644
2645 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2646 {
2647         int err;
2648
2649         err = hci_update_class_sync(hdev);
2650         if (err)
2651                 return err;
2652
2653         return hci_update_eir_sync(hdev);
2654 }
2655
2656 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2657 {
2658         struct mgmt_cp_add_uuid *cp = data;
2659         struct mgmt_pending_cmd *cmd;
2660         struct bt_uuid *uuid;
2661         int err;
2662
2663         bt_dev_dbg(hdev, "sock %p", sk);
2664
2665         hci_dev_lock(hdev);
2666
2667         if (pending_eir_or_class(hdev)) {
2668                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2669                                       MGMT_STATUS_BUSY);
2670                 goto failed;
2671         }
2672
2673         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2674         if (!uuid) {
2675                 err = -ENOMEM;
2676                 goto failed;
2677         }
2678
2679         memcpy(uuid->uuid, cp->uuid, 16);
2680         uuid->svc_hint = cp->svc_hint;
2681         uuid->size = get_uuid_size(cp->uuid);
2682
2683         list_add_tail(&uuid->list, &hdev->uuids);
2684
2685         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2686         if (!cmd) {
2687                 err = -ENOMEM;
2688                 goto failed;
2689         }
2690
2691         err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete);
2692         if (err < 0) {
2693                 mgmt_pending_free(cmd);
2694                 goto failed;
2695         }
2696
2697 failed:
2698         hci_dev_unlock(hdev);
2699         return err;
2700 }
2701
2702 static bool enable_service_cache(struct hci_dev *hdev)
2703 {
2704         if (!hdev_is_powered(hdev))
2705                 return false;
2706
2707         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2708                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2709                                    CACHE_TIMEOUT);
2710                 return true;
2711         }
2712
2713         return false;
2714 }
2715
2716 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2717 {
2718         int err;
2719
2720         err = hci_update_class_sync(hdev);
2721         if (err)
2722                 return err;
2723
2724         return hci_update_eir_sync(hdev);
2725 }
2726
2727 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2728                        u16 len)
2729 {
2730         struct mgmt_cp_remove_uuid *cp = data;
2731         struct mgmt_pending_cmd *cmd;
2732         struct bt_uuid *match, *tmp;
2733         static const u8 bt_uuid_any[] = {
2734                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2735         };
2736         int err, found;
2737
2738         bt_dev_dbg(hdev, "sock %p", sk);
2739
2740         hci_dev_lock(hdev);
2741
2742         if (pending_eir_or_class(hdev)) {
2743                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2744                                       MGMT_STATUS_BUSY);
2745                 goto unlock;
2746         }
2747
2748         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2749                 hci_uuids_clear(hdev);
2750
2751                 if (enable_service_cache(hdev)) {
2752                         err = mgmt_cmd_complete(sk, hdev->id,
2753                                                 MGMT_OP_REMOVE_UUID,
2754                                                 0, hdev->dev_class, 3);
2755                         goto unlock;
2756                 }
2757
2758                 goto update_class;
2759         }
2760
2761         found = 0;
2762
2763         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2764                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2765                         continue;
2766
2767                 list_del(&match->list);
2768                 kfree(match);
2769                 found++;
2770         }
2771
2772         if (found == 0) {
2773                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2774                                       MGMT_STATUS_INVALID_PARAMS);
2775                 goto unlock;
2776         }
2777
2778 update_class:
2779         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2780         if (!cmd) {
2781                 err = -ENOMEM;
2782                 goto unlock;
2783         }
2784
2785         err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd,
2786                                  mgmt_class_complete);
2787         if (err < 0)
2788                 mgmt_pending_free(cmd);
2789
2790 unlock:
2791         hci_dev_unlock(hdev);
2792         return err;
2793 }
2794
2795 static int set_class_sync(struct hci_dev *hdev, void *data)
2796 {
2797         int err = 0;
2798
2799         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2800                 cancel_delayed_work_sync(&hdev->service_cache);
2801                 err = hci_update_eir_sync(hdev);
2802         }
2803
2804         if (err)
2805                 return err;
2806
2807         return hci_update_class_sync(hdev);
2808 }
2809
2810 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2811                          u16 len)
2812 {
2813         struct mgmt_cp_set_dev_class *cp = data;
2814         struct mgmt_pending_cmd *cmd;
2815         int err;
2816
2817         bt_dev_dbg(hdev, "sock %p", sk);
2818
2819         if (!lmp_bredr_capable(hdev))
2820                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2821                                        MGMT_STATUS_NOT_SUPPORTED);
2822
2823         hci_dev_lock(hdev);
2824
2825         if (pending_eir_or_class(hdev)) {
2826                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2827                                       MGMT_STATUS_BUSY);
2828                 goto unlock;
2829         }
2830
2831         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2832                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2833                                       MGMT_STATUS_INVALID_PARAMS);
2834                 goto unlock;
2835         }
2836
2837         hdev->major_class = cp->major;
2838         hdev->minor_class = cp->minor;
2839
2840         if (!hdev_is_powered(hdev)) {
2841                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2842                                         hdev->dev_class, 3);
2843                 goto unlock;
2844         }
2845
2846         cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2847         if (!cmd) {
2848                 err = -ENOMEM;
2849                 goto unlock;
2850         }
2851
2852         err = hci_cmd_sync_queue(hdev, set_class_sync, cmd,
2853                                  mgmt_class_complete);
2854         if (err < 0)
2855                 mgmt_pending_free(cmd);
2856
2857 unlock:
2858         hci_dev_unlock(hdev);
2859         return err;
2860 }
2861
2862 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2863                           u16 len)
2864 {
2865         struct mgmt_cp_load_link_keys *cp = data;
2866         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2867                                    sizeof(struct mgmt_link_key_info));
2868         u16 key_count, expected_len;
2869         bool changed;
2870         int i;
2871
2872         bt_dev_dbg(hdev, "sock %p", sk);
2873
2874         if (!lmp_bredr_capable(hdev))
2875                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2876                                        MGMT_STATUS_NOT_SUPPORTED);
2877
2878         key_count = __le16_to_cpu(cp->key_count);
2879         if (key_count > max_key_count) {
2880                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2881                            key_count);
2882                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2883                                        MGMT_STATUS_INVALID_PARAMS);
2884         }
2885
2886         expected_len = struct_size(cp, keys, key_count);
2887         if (expected_len != len) {
2888                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2889                            expected_len, len);
2890                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2891                                        MGMT_STATUS_INVALID_PARAMS);
2892         }
2893
2894         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2895                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2896                                        MGMT_STATUS_INVALID_PARAMS);
2897
2898         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2899                    key_count);
2900
2901         for (i = 0; i < key_count; i++) {
2902                 struct mgmt_link_key_info *key = &cp->keys[i];
2903
2904                 /* Considering SMP over BREDR/LE, there is no need to check addr_type */
2905                 if (key->type > 0x08)
2906                         return mgmt_cmd_status(sk, hdev->id,
2907                                                MGMT_OP_LOAD_LINK_KEYS,
2908                                                MGMT_STATUS_INVALID_PARAMS);
2909         }
2910
2911         hci_dev_lock(hdev);
2912
2913         hci_link_keys_clear(hdev);
2914
2915         if (cp->debug_keys)
2916                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2917         else
2918                 changed = hci_dev_test_and_clear_flag(hdev,
2919                                                       HCI_KEEP_DEBUG_KEYS);
2920
2921         if (changed)
2922                 new_settings(hdev, NULL);
2923
2924         for (i = 0; i < key_count; i++) {
2925                 struct mgmt_link_key_info *key = &cp->keys[i];
2926
2927                 if (hci_is_blocked_key(hdev,
2928                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2929                                        key->val)) {
2930                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2931                                     &key->addr.bdaddr);
2932                         continue;
2933                 }
2934
2935                 /* Always ignore debug keys and require a new pairing if
2936                  * the user wants to use them.
2937                  */
2938                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2939                         continue;
2940
2941                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2942                                  key->type, key->pin_len, NULL);
2943         }
2944
2945         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2946
2947         hci_dev_unlock(hdev);
2948
2949         return 0;
2950 }
2951
2952 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2953                            u8 addr_type, struct sock *skip_sk)
2954 {
2955         struct mgmt_ev_device_unpaired ev;
2956
2957         bacpy(&ev.addr.bdaddr, bdaddr);
2958         ev.addr.type = addr_type;
2959
2960         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2961                           skip_sk);
2962 }
2963
2964 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
2965 {
2966         struct mgmt_pending_cmd *cmd = data;
2967         struct mgmt_cp_unpair_device *cp = cmd->param;
2968
2969         if (!err)
2970                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2971
2972         cmd->cmd_complete(cmd, err);
2973         mgmt_pending_free(cmd);
2974 }
2975
2976 static int unpair_device_sync(struct hci_dev *hdev, void *data)
2977 {
2978         struct mgmt_pending_cmd *cmd = data;
2979         struct mgmt_cp_unpair_device *cp = cmd->param;
2980         struct hci_conn *conn;
2981
2982         if (cp->addr.type == BDADDR_BREDR)
2983                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2984                                                &cp->addr.bdaddr);
2985         else
2986                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2987                                                le_addr_type(cp->addr.type));
2988
2989         if (!conn)
2990                 return 0;
2991
2992         return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM);
2993 }
2994
2995 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2996                          u16 len)
2997 {
2998         struct mgmt_cp_unpair_device *cp = data;
2999         struct mgmt_rp_unpair_device rp;
3000         struct hci_conn_params *params;
3001         struct mgmt_pending_cmd *cmd;
3002         struct hci_conn *conn;
3003         u8 addr_type;
3004         int err;
3005
3006         memset(&rp, 0, sizeof(rp));
3007         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3008         rp.addr.type = cp->addr.type;
3009
3010         if (!bdaddr_type_is_valid(cp->addr.type))
3011                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3012                                          MGMT_STATUS_INVALID_PARAMS,
3013                                          &rp, sizeof(rp));
3014
3015         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
3016                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3017                                          MGMT_STATUS_INVALID_PARAMS,
3018                                          &rp, sizeof(rp));
3019
3020         hci_dev_lock(hdev);
3021
3022         if (!hdev_is_powered(hdev)) {
3023                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3024                                         MGMT_STATUS_NOT_POWERED, &rp,
3025                                         sizeof(rp));
3026                 goto unlock;
3027         }
3028
3029         if (cp->addr.type == BDADDR_BREDR) {
3030                 /* If disconnection is requested, then look up the
3031                  * connection. If the remote device is connected, it
3032                  * will be later used to terminate the link.
3033                  *
3034                  * Setting it to NULL explicitly will cause no
3035                  * termination of the link.
3036                  */
3037                 if (cp->disconnect)
3038                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3039                                                        &cp->addr.bdaddr);
3040                 else
3041                         conn = NULL;
3042
3043                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3044                 if (err < 0) {
3045                         err = mgmt_cmd_complete(sk, hdev->id,
3046                                                 MGMT_OP_UNPAIR_DEVICE,
3047                                                 MGMT_STATUS_NOT_PAIRED, &rp,
3048                                                 sizeof(rp));
3049                         goto unlock;
3050                 }
3051
3052                 goto done;
3053         }
3054
3055         /* LE address type */
3056         addr_type = le_addr_type(cp->addr.type);
3057
3058         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3059         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3060         if (err < 0) {
3061                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3062                                         MGMT_STATUS_NOT_PAIRED, &rp,
3063                                         sizeof(rp));
3064                 goto unlock;
3065         }
3066
3067         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3068         if (!conn) {
3069                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3070                 goto done;
3071         }
3072
3073
3074         /* Defer clearing up the connection parameters until closing to
3075          * give a chance of keeping them if a repairing happens.
3076          */
3077         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3078
3079         /* Disable auto-connection parameters if present */
3080         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3081         if (params) {
3082                 if (params->explicit_connect)
3083                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3084                 else
3085                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3086         }
3087
3088         /* If disconnection is not requested, then clear the connection
3089          * variable so that the link is not terminated.
3090          */
3091         if (!cp->disconnect)
3092                 conn = NULL;
3093
3094 done:
3095         /* If the connection variable is set, then termination of the
3096          * link is requested.
3097          */
3098         if (!conn) {
3099                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3100                                         &rp, sizeof(rp));
3101                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3102                 goto unlock;
3103         }
3104
3105         cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3106                                sizeof(*cp));
3107         if (!cmd) {
3108                 err = -ENOMEM;
3109                 goto unlock;
3110         }
3111
3112         cmd->cmd_complete = addr_cmd_complete;
3113
3114         err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3115                                  unpair_device_complete);
3116         if (err < 0)
3117                 mgmt_pending_free(cmd);
3118
3119 unlock:
3120         hci_dev_unlock(hdev);
3121         return err;
3122 }
3123
3124 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3125                       u16 len)
3126 {
3127         struct mgmt_cp_disconnect *cp = data;
3128         struct mgmt_rp_disconnect rp;
3129         struct mgmt_pending_cmd *cmd;
3130         struct hci_conn *conn;
3131         int err;
3132
3133         bt_dev_dbg(hdev, "sock %p", sk);
3134
3135         memset(&rp, 0, sizeof(rp));
3136         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3137         rp.addr.type = cp->addr.type;
3138
3139         if (!bdaddr_type_is_valid(cp->addr.type))
3140                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3141                                          MGMT_STATUS_INVALID_PARAMS,
3142                                          &rp, sizeof(rp));
3143
3144         hci_dev_lock(hdev);
3145
3146         if (!test_bit(HCI_UP, &hdev->flags)) {
3147                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3148                                         MGMT_STATUS_NOT_POWERED, &rp,
3149                                         sizeof(rp));
3150                 goto failed;
3151         }
3152
3153         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
3154                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3155                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3156                 goto failed;
3157         }
3158
3159         if (cp->addr.type == BDADDR_BREDR)
3160                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3161                                                &cp->addr.bdaddr);
3162         else
3163                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3164                                                le_addr_type(cp->addr.type));
3165
3166         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
3167                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3168                                         MGMT_STATUS_NOT_CONNECTED, &rp,
3169                                         sizeof(rp));
3170                 goto failed;
3171         }
3172
3173         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3174         if (!cmd) {
3175                 err = -ENOMEM;
3176                 goto failed;
3177         }
3178
3179         cmd->cmd_complete = generic_cmd_complete;
3180
3181         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
3182         if (err < 0)
3183                 mgmt_pending_remove(cmd);
3184
3185 failed:
3186         hci_dev_unlock(hdev);
3187         return err;
3188 }
3189
3190 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3191 {
3192         switch (link_type) {
3193         case LE_LINK:
3194                 switch (addr_type) {
3195                 case ADDR_LE_DEV_PUBLIC:
3196                         return BDADDR_LE_PUBLIC;
3197
3198                 default:
3199                         /* Fallback to LE Random address type */
3200                         return BDADDR_LE_RANDOM;
3201                 }
3202
3203         default:
3204                 /* Fallback to BR/EDR type */
3205                 return BDADDR_BREDR;
3206         }
3207 }
3208
3209 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3210                            u16 data_len)
3211 {
3212         struct mgmt_rp_get_connections *rp;
3213         struct hci_conn *c;
3214         int err;
3215         u16 i;
3216
3217         bt_dev_dbg(hdev, "sock %p", sk);
3218
3219         hci_dev_lock(hdev);
3220
3221         if (!hdev_is_powered(hdev)) {
3222                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3223                                       MGMT_STATUS_NOT_POWERED);
3224                 goto unlock;
3225         }
3226
3227         i = 0;
3228         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3229                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3230                         i++;
3231         }
3232
3233         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
3234         if (!rp) {
3235                 err = -ENOMEM;
3236                 goto unlock;
3237         }
3238
3239         i = 0;
3240         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3241                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3242                         continue;
3243                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3244                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3245                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3246                         continue;
3247                 i++;
3248         }
3249
3250         rp->conn_count = cpu_to_le16(i);
3251
3252         /* Recalculate length in case of filtered SCO connections, etc */
3253         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3254                                 struct_size(rp, addr, i));
3255
3256         kfree(rp);
3257
3258 unlock:
3259         hci_dev_unlock(hdev);
3260         return err;
3261 }
3262
3263 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3264                                    struct mgmt_cp_pin_code_neg_reply *cp)
3265 {
3266         struct mgmt_pending_cmd *cmd;
3267         int err;
3268
3269         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3270                                sizeof(*cp));
3271         if (!cmd)
3272                 return -ENOMEM;
3273
3274         cmd->cmd_complete = addr_cmd_complete;
3275
3276         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3277                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3278         if (err < 0)
3279                 mgmt_pending_remove(cmd);
3280
3281         return err;
3282 }
3283
3284 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3285                           u16 len)
3286 {
3287         struct hci_conn *conn;
3288         struct mgmt_cp_pin_code_reply *cp = data;
3289         struct hci_cp_pin_code_reply reply;
3290         struct mgmt_pending_cmd *cmd;
3291         int err;
3292
3293         bt_dev_dbg(hdev, "sock %p", sk);
3294
3295         hci_dev_lock(hdev);
3296
3297         if (!hdev_is_powered(hdev)) {
3298                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3299                                       MGMT_STATUS_NOT_POWERED);
3300                 goto failed;
3301         }
3302
3303         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3304         if (!conn) {
3305                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3306                                       MGMT_STATUS_NOT_CONNECTED);
3307                 goto failed;
3308         }
3309
3310         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3311                 struct mgmt_cp_pin_code_neg_reply ncp;
3312
3313                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3314
3315                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3316
3317                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3318                 if (err >= 0)
3319                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3320                                               MGMT_STATUS_INVALID_PARAMS);
3321
3322                 goto failed;
3323         }
3324
3325         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3326         if (!cmd) {
3327                 err = -ENOMEM;
3328                 goto failed;
3329         }
3330
3331         cmd->cmd_complete = addr_cmd_complete;
3332
3333         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3334         reply.pin_len = cp->pin_len;
3335         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3336
3337         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3338         if (err < 0)
3339                 mgmt_pending_remove(cmd);
3340
3341 failed:
3342         hci_dev_unlock(hdev);
3343         return err;
3344 }
3345
3346 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3347                              u16 len)
3348 {
3349         struct mgmt_cp_set_io_capability *cp = data;
3350
3351         bt_dev_dbg(hdev, "sock %p", sk);
3352
3353         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3354                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3355                                        MGMT_STATUS_INVALID_PARAMS);
3356
3357         hci_dev_lock(hdev);
3358
3359         hdev->io_capability = cp->io_capability;
3360
3361         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3362
3363         hci_dev_unlock(hdev);
3364
3365         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3366                                  NULL, 0);
3367 }
3368
3369 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
3370 {
3371         struct hci_dev *hdev = conn->hdev;
3372         struct mgmt_pending_cmd *cmd;
3373
3374         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3375                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3376                         continue;
3377
3378                 if (cmd->user_data != conn)
3379                         continue;
3380
3381                 return cmd;
3382         }
3383
3384         return NULL;
3385 }
3386
3387 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3388 {
3389         struct mgmt_rp_pair_device rp;
3390         struct hci_conn *conn = cmd->user_data;
3391         int err;
3392
3393         bacpy(&rp.addr.bdaddr, &conn->dst);
3394         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3395
3396         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3397                                 status, &rp, sizeof(rp));
3398
3399         /* So we don't get further callbacks for this connection */
3400         conn->connect_cfm_cb = NULL;
3401         conn->security_cfm_cb = NULL;
3402         conn->disconn_cfm_cb = NULL;
3403
3404         hci_conn_drop(conn);
3405
3406         /* The device is paired so there is no need to remove
3407          * its connection parameters anymore.
3408          */
3409         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3410
3411         hci_conn_put(conn);
3412
3413         return err;
3414 }
3415
3416 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3417 {
3418         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3419         struct mgmt_pending_cmd *cmd;
3420
3421         cmd = find_pairing(conn);
3422         if (cmd) {
3423                 cmd->cmd_complete(cmd, status);
3424                 mgmt_pending_remove(cmd);
3425         }
3426 }
3427
3428 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3429 {
3430         struct mgmt_pending_cmd *cmd;
3431
3432         BT_DBG("status %u", status);
3433
3434         cmd = find_pairing(conn);
3435         if (!cmd) {
3436                 BT_DBG("Unable to find a pending command");
3437                 return;
3438         }
3439
3440         cmd->cmd_complete(cmd, mgmt_status(status));
3441         mgmt_pending_remove(cmd);
3442 }
3443
3444 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3445 {
3446         struct mgmt_pending_cmd *cmd;
3447
3448         BT_DBG("status %u", status);
3449
3450         if (!status)
3451                 return;
3452
3453         cmd = find_pairing(conn);
3454         if (!cmd) {
3455                 BT_DBG("Unable to find a pending command");
3456                 return;
3457         }
3458
3459         cmd->cmd_complete(cmd, mgmt_status(status));
3460         mgmt_pending_remove(cmd);
3461 }
3462
3463 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3464                        u16 len)
3465 {
3466         struct mgmt_cp_pair_device *cp = data;
3467         struct mgmt_rp_pair_device rp;
3468         struct mgmt_pending_cmd *cmd;
3469         u8 sec_level, auth_type;
3470         struct hci_conn *conn;
3471         int err;
3472
3473         bt_dev_dbg(hdev, "sock %p", sk);
3474
3475         memset(&rp, 0, sizeof(rp));
3476         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3477         rp.addr.type = cp->addr.type;
3478
3479         if (!bdaddr_type_is_valid(cp->addr.type))
3480                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3481                                          MGMT_STATUS_INVALID_PARAMS,
3482                                          &rp, sizeof(rp));
3483
3484         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3485                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3486                                          MGMT_STATUS_INVALID_PARAMS,
3487                                          &rp, sizeof(rp));
3488
3489         hci_dev_lock(hdev);
3490
3491         if (!hdev_is_powered(hdev)) {
3492                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3493                                         MGMT_STATUS_NOT_POWERED, &rp,
3494                                         sizeof(rp));
3495                 goto unlock;
3496         }
3497
3498         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3499                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3500                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
3501                                         sizeof(rp));
3502                 goto unlock;
3503         }
3504
3505         sec_level = BT_SECURITY_MEDIUM;
3506         auth_type = HCI_AT_DEDICATED_BONDING;
3507
3508         if (cp->addr.type == BDADDR_BREDR) {
3509                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3510                                        auth_type, CONN_REASON_PAIR_DEVICE);
3511         } else {
3512                 u8 addr_type = le_addr_type(cp->addr.type);
3513                 struct hci_conn_params *p;
3514
3515                 /* When pairing a new device, it is expected to remember
3516                  * this device for future connections. Adding the connection
3517                  * parameter information ahead of time allows tracking
3518                  * of the peripheral preferred values and will speed up any
3519                  * further connection establishment.
3520                  *
3521                  * If connection parameters already exist, then they
3522                  * will be kept and this function does nothing.
3523                  */
3524                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3525
3526                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3527                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
3528
3529                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3530                                            sec_level, HCI_LE_CONN_TIMEOUT,
3531                                            CONN_REASON_PAIR_DEVICE);
3532         }
3533
3534         if (IS_ERR(conn)) {
3535                 int status;
3536
3537                 if (PTR_ERR(conn) == -EBUSY)
3538                         status = MGMT_STATUS_BUSY;
3539                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3540                         status = MGMT_STATUS_NOT_SUPPORTED;
3541                 else if (PTR_ERR(conn) == -ECONNREFUSED)
3542                         status = MGMT_STATUS_REJECTED;
3543                 else
3544                         status = MGMT_STATUS_CONNECT_FAILED;
3545
3546                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3547                                         status, &rp, sizeof(rp));
3548                 goto unlock;
3549         }
3550
3551         if (conn->connect_cfm_cb) {
3552                 hci_conn_drop(conn);
3553                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3554                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3555                 goto unlock;
3556         }
3557
3558         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3559         if (!cmd) {
3560                 err = -ENOMEM;
3561                 hci_conn_drop(conn);
3562                 goto unlock;
3563         }
3564
3565         cmd->cmd_complete = pairing_complete;
3566
3567         /* For LE, just connecting isn't a proof that the pairing finished */
3568         if (cp->addr.type == BDADDR_BREDR) {
3569                 conn->connect_cfm_cb = pairing_complete_cb;
3570                 conn->security_cfm_cb = pairing_complete_cb;
3571                 conn->disconn_cfm_cb = pairing_complete_cb;
3572         } else {
3573                 conn->connect_cfm_cb = le_pairing_complete_cb;
3574                 conn->security_cfm_cb = le_pairing_complete_cb;
3575                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3576         }
3577
3578         conn->io_capability = cp->io_cap;
3579         cmd->user_data = hci_conn_get(conn);
3580
3581         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3582             hci_conn_security(conn, sec_level, auth_type, true)) {
3583                 cmd->cmd_complete(cmd, 0);
3584                 mgmt_pending_remove(cmd);
3585         }
3586
3587         err = 0;
3588
3589 unlock:
3590         hci_dev_unlock(hdev);
3591         return err;
3592 }
3593
3594 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3595                               u16 len)
3596 {
3597         struct mgmt_addr_info *addr = data;
3598         struct mgmt_pending_cmd *cmd;
3599         struct hci_conn *conn;
3600         int err;
3601
3602         bt_dev_dbg(hdev, "sock %p", sk);
3603
3604         hci_dev_lock(hdev);
3605
3606         if (!hdev_is_powered(hdev)) {
3607                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3608                                       MGMT_STATUS_NOT_POWERED);
3609                 goto unlock;
3610         }
3611
3612         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3613         if (!cmd) {
3614                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3615                                       MGMT_STATUS_INVALID_PARAMS);
3616                 goto unlock;
3617         }
3618
3619         conn = cmd->user_data;
3620
3621         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3622                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3623                                       MGMT_STATUS_INVALID_PARAMS);
3624                 goto unlock;
3625         }
3626
3627         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3628         mgmt_pending_remove(cmd);
3629
3630         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3631                                 addr, sizeof(*addr));
3632
3633         /* Since user doesn't want to proceed with the connection, abort any
3634          * ongoing pairing and then terminate the link if it was created
3635          * because of the pair device action.
3636          */
3637         if (addr->type == BDADDR_BREDR)
3638                 hci_remove_link_key(hdev, &addr->bdaddr);
3639         else
3640                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3641                                               le_addr_type(addr->type));
3642
3643         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3644                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3645
3646 unlock:
3647         hci_dev_unlock(hdev);
3648         return err;
3649 }
3650
3651 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3652                              struct mgmt_addr_info *addr, u16 mgmt_op,
3653                              u16 hci_op, __le32 passkey)
3654 {
3655         struct mgmt_pending_cmd *cmd;
3656         struct hci_conn *conn;
3657         int err;
3658
3659         hci_dev_lock(hdev);
3660
3661         if (!hdev_is_powered(hdev)) {
3662                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3663                                         MGMT_STATUS_NOT_POWERED, addr,
3664                                         sizeof(*addr));
3665                 goto done;
3666         }
3667
3668         if (addr->type == BDADDR_BREDR)
3669                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3670         else
3671                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3672                                                le_addr_type(addr->type));
3673
3674         if (!conn) {
3675                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3676                                         MGMT_STATUS_NOT_CONNECTED, addr,
3677                                         sizeof(*addr));
3678                 goto done;
3679         }
3680
3681         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3682                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3683                 if (!err)
3684                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3685                                                 MGMT_STATUS_SUCCESS, addr,
3686                                                 sizeof(*addr));
3687                 else
3688                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3689                                                 MGMT_STATUS_FAILED, addr,
3690                                                 sizeof(*addr));
3691
3692                 goto done;
3693         }
3694
3695         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3696         if (!cmd) {
3697                 err = -ENOMEM;
3698                 goto done;
3699         }
3700
3701         cmd->cmd_complete = addr_cmd_complete;
3702
3703         /* Continue with pairing via HCI */
3704         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3705                 struct hci_cp_user_passkey_reply cp;
3706
3707                 bacpy(&cp.bdaddr, &addr->bdaddr);
3708                 cp.passkey = passkey;
3709                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3710         } else
3711                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3712                                    &addr->bdaddr);
3713
3714         if (err < 0)
3715                 mgmt_pending_remove(cmd);
3716
3717 done:
3718         hci_dev_unlock(hdev);
3719         return err;
3720 }
3721
3722 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3723                               void *data, u16 len)
3724 {
3725         struct mgmt_cp_pin_code_neg_reply *cp = data;
3726
3727         bt_dev_dbg(hdev, "sock %p", sk);
3728
3729         return user_pairing_resp(sk, hdev, &cp->addr,
3730                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3731                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3732 }
3733
3734 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3735                               u16 len)
3736 {
3737         struct mgmt_cp_user_confirm_reply *cp = data;
3738
3739         bt_dev_dbg(hdev, "sock %p", sk);
3740
3741         if (len != sizeof(*cp))
3742                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3743                                        MGMT_STATUS_INVALID_PARAMS);
3744
3745         return user_pairing_resp(sk, hdev, &cp->addr,
3746                                  MGMT_OP_USER_CONFIRM_REPLY,
3747                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3748 }
3749
3750 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3751                                   void *data, u16 len)
3752 {
3753         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3754
3755         bt_dev_dbg(hdev, "sock %p", sk);
3756
3757         return user_pairing_resp(sk, hdev, &cp->addr,
3758                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3759                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3760 }
3761
3762 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3763                               u16 len)
3764 {
3765         struct mgmt_cp_user_passkey_reply *cp = data;
3766
3767         bt_dev_dbg(hdev, "sock %p", sk);
3768
3769         return user_pairing_resp(sk, hdev, &cp->addr,
3770                                  MGMT_OP_USER_PASSKEY_REPLY,
3771                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3772 }
3773
3774 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3775                                   void *data, u16 len)
3776 {
3777         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3778
3779         bt_dev_dbg(hdev, "sock %p", sk);
3780
3781         return user_pairing_resp(sk, hdev, &cp->addr,
3782                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3783                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3784 }
3785
3786 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
3787 {
3788         struct adv_info *adv_instance;
3789
3790         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3791         if (!adv_instance)
3792                 return 0;
3793
3794         /* stop if current instance doesn't need to be changed */
3795         if (!(adv_instance->flags & flags))
3796                 return 0;
3797
3798         cancel_adv_timeout(hdev);
3799
3800         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3801         if (!adv_instance)
3802                 return 0;
3803
3804         hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
3805
3806         return 0;
3807 }
3808
3809 static int name_changed_sync(struct hci_dev *hdev, void *data)
3810 {
3811         return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3812 }
3813
3814 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
3815 {
3816         struct mgmt_pending_cmd *cmd = data;
3817         struct mgmt_cp_set_local_name *cp = cmd->param;
3818         u8 status = mgmt_status(err);
3819
3820         bt_dev_dbg(hdev, "err %d", err);
3821
3822         if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
3823                 return;
3824
3825         if (status) {
3826                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3827                                 status);
3828         } else {
3829                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3830                                   cp, sizeof(*cp));
3831
3832                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3833                         hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
3834         }
3835
3836         mgmt_pending_remove(cmd);
3837 }
3838
3839 static int set_name_sync(struct hci_dev *hdev, void *data)
3840 {
3841         if (lmp_bredr_capable(hdev)) {
3842                 hci_update_name_sync(hdev);
3843                 hci_update_eir_sync(hdev);
3844         }
3845
3846         /* The name is stored in the scan response data and so
3847          * no need to update the advertising data here.
3848          */
3849         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3850                 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
3851
3852         return 0;
3853 }
3854
3855 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3856                           u16 len)
3857 {
3858         struct mgmt_cp_set_local_name *cp = data;
3859         struct mgmt_pending_cmd *cmd;
3860         int err;
3861
3862         bt_dev_dbg(hdev, "sock %p", sk);
3863
3864         hci_dev_lock(hdev);
3865
3866         /* If the old values are the same as the new ones just return a
3867          * direct command complete event.
3868          */
3869         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3870             !memcmp(hdev->short_name, cp->short_name,
3871                     sizeof(hdev->short_name))) {
3872                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3873                                         data, len);
3874                 goto failed;
3875         }
3876
3877         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3878
3879         if (!hdev_is_powered(hdev)) {
3880                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3881
3882                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3883                                         data, len);
3884                 if (err < 0)
3885                         goto failed;
3886
3887                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3888                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3889                 ext_info_changed(hdev, sk);
3890
3891                 goto failed;
3892         }
3893
3894         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3895         if (!cmd)
3896                 err = -ENOMEM;
3897         else
3898                 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
3899                                          set_name_complete);
3900
3901         if (err < 0) {
3902                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3903                                       MGMT_STATUS_FAILED);
3904
3905                 if (cmd)
3906                         mgmt_pending_remove(cmd);
3907
3908                 goto failed;
3909         }
3910
3911         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3912
3913 failed:
3914         hci_dev_unlock(hdev);
3915         return err;
3916 }
3917
3918 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
3919 {
3920         return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
3921 }
3922
3923 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3924                           u16 len)
3925 {
3926         struct mgmt_cp_set_appearance *cp = data;
3927         u16 appearance;
3928         int err;
3929
3930         bt_dev_dbg(hdev, "sock %p", sk);
3931
3932         if (!lmp_le_capable(hdev))
3933                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3934                                        MGMT_STATUS_NOT_SUPPORTED);
3935
3936         appearance = le16_to_cpu(cp->appearance);
3937
3938         hci_dev_lock(hdev);
3939
3940         if (hdev->appearance != appearance) {
3941                 hdev->appearance = appearance;
3942
3943                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3944                         hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
3945                                            NULL);
3946
3947                 ext_info_changed(hdev, sk);
3948         }
3949
3950         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3951                                 0);
3952
3953         hci_dev_unlock(hdev);
3954
3955         return err;
3956 }
3957
3958 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3959                                  void *data, u16 len)
3960 {
3961         struct mgmt_rp_get_phy_configuration rp;
3962
3963         bt_dev_dbg(hdev, "sock %p", sk);
3964
3965         hci_dev_lock(hdev);
3966
3967         memset(&rp, 0, sizeof(rp));
3968
3969         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3970         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3971         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3972
3973         hci_dev_unlock(hdev);
3974
3975         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3976                                  &rp, sizeof(rp));
3977 }
3978
3979 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3980 {
3981         struct mgmt_ev_phy_configuration_changed ev;
3982
3983         memset(&ev, 0, sizeof(ev));
3984
3985         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3986
3987         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3988                           sizeof(ev), skip);
3989 }
3990
3991 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
3992 {
3993         struct mgmt_pending_cmd *cmd = data;
3994         struct sk_buff *skb = cmd->skb;
3995         u8 status = mgmt_status(err);
3996
3997         if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
3998                 return;
3999
4000         if (!status) {
4001                 if (!skb)
4002                         status = MGMT_STATUS_FAILED;
4003                 else if (IS_ERR(skb))
4004                         status = mgmt_status(PTR_ERR(skb));
4005                 else
4006                         status = mgmt_status(skb->data[0]);
4007         }
4008
4009         bt_dev_dbg(hdev, "status %d", status);
4010
4011         if (status) {
4012                 mgmt_cmd_status(cmd->sk, hdev->id,
4013                                 MGMT_OP_SET_PHY_CONFIGURATION, status);
4014         } else {
4015                 mgmt_cmd_complete(cmd->sk, hdev->id,
4016                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
4017                                   NULL, 0);
4018
4019                 mgmt_phy_configuration_changed(hdev, cmd->sk);
4020         }
4021
4022         if (skb && !IS_ERR(skb))
4023                 kfree_skb(skb);
4024
4025         mgmt_pending_remove(cmd);
4026 }
4027
4028 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4029 {
4030         struct mgmt_pending_cmd *cmd = data;
4031         struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4032         struct hci_cp_le_set_default_phy cp_phy;
4033         u32 selected_phys = __le32_to_cpu(cp->selected_phys);
4034
4035         memset(&cp_phy, 0, sizeof(cp_phy));
4036
4037         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4038                 cp_phy.all_phys |= 0x01;
4039
4040         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4041                 cp_phy.all_phys |= 0x02;
4042
4043         if (selected_phys & MGMT_PHY_LE_1M_TX)
4044                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4045
4046         if (selected_phys & MGMT_PHY_LE_2M_TX)
4047                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4048
4049         if (selected_phys & MGMT_PHY_LE_CODED_TX)
4050                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4051
4052         if (selected_phys & MGMT_PHY_LE_1M_RX)
4053                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4054
4055         if (selected_phys & MGMT_PHY_LE_2M_RX)
4056                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4057
4058         if (selected_phys & MGMT_PHY_LE_CODED_RX)
4059                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4060
4061         cmd->skb =  __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4062                                    sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4063
4064         return 0;
4065 }
4066
4067 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4068                                  void *data, u16 len)
4069 {
4070         struct mgmt_cp_set_phy_configuration *cp = data;
4071         struct mgmt_pending_cmd *cmd;
4072         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4073         u16 pkt_type = (HCI_DH1 | HCI_DM1);
4074         bool changed = false;
4075         int err;
4076
4077         bt_dev_dbg(hdev, "sock %p", sk);
4078
4079         configurable_phys = get_configurable_phys(hdev);
4080         supported_phys = get_supported_phys(hdev);
4081         selected_phys = __le32_to_cpu(cp->selected_phys);
4082
4083         if (selected_phys & ~supported_phys)
4084                 return mgmt_cmd_status(sk, hdev->id,
4085                                        MGMT_OP_SET_PHY_CONFIGURATION,
4086                                        MGMT_STATUS_INVALID_PARAMS);
4087
4088         unconfigure_phys = supported_phys & ~configurable_phys;
4089
4090         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4091                 return mgmt_cmd_status(sk, hdev->id,
4092                                        MGMT_OP_SET_PHY_CONFIGURATION,
4093                                        MGMT_STATUS_INVALID_PARAMS);
4094
4095         if (selected_phys == get_selected_phys(hdev))
4096                 return mgmt_cmd_complete(sk, hdev->id,
4097                                          MGMT_OP_SET_PHY_CONFIGURATION,
4098                                          0, NULL, 0);
4099
4100         hci_dev_lock(hdev);
4101
4102         if (!hdev_is_powered(hdev)) {
4103                 err = mgmt_cmd_status(sk, hdev->id,
4104                                       MGMT_OP_SET_PHY_CONFIGURATION,
4105                                       MGMT_STATUS_REJECTED);
4106                 goto unlock;
4107         }
4108
4109         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4110                 err = mgmt_cmd_status(sk, hdev->id,
4111                                       MGMT_OP_SET_PHY_CONFIGURATION,
4112                                       MGMT_STATUS_BUSY);
4113                 goto unlock;
4114         }
4115
4116         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4117                 pkt_type |= (HCI_DH3 | HCI_DM3);
4118         else
4119                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4120
4121         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4122                 pkt_type |= (HCI_DH5 | HCI_DM5);
4123         else
4124                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4125
4126         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4127                 pkt_type &= ~HCI_2DH1;
4128         else
4129                 pkt_type |= HCI_2DH1;
4130
4131         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4132                 pkt_type &= ~HCI_2DH3;
4133         else
4134                 pkt_type |= HCI_2DH3;
4135
4136         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4137                 pkt_type &= ~HCI_2DH5;
4138         else
4139                 pkt_type |= HCI_2DH5;
4140
4141         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4142                 pkt_type &= ~HCI_3DH1;
4143         else
4144                 pkt_type |= HCI_3DH1;
4145
4146         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4147                 pkt_type &= ~HCI_3DH3;
4148         else
4149                 pkt_type |= HCI_3DH3;
4150
4151         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4152                 pkt_type &= ~HCI_3DH5;
4153         else
4154                 pkt_type |= HCI_3DH5;
4155
4156         if (pkt_type != hdev->pkt_type) {
4157                 hdev->pkt_type = pkt_type;
4158                 changed = true;
4159         }
4160
4161         if ((selected_phys & MGMT_PHY_LE_MASK) ==
4162             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4163                 if (changed)
4164                         mgmt_phy_configuration_changed(hdev, sk);
4165
4166                 err = mgmt_cmd_complete(sk, hdev->id,
4167                                         MGMT_OP_SET_PHY_CONFIGURATION,
4168                                         0, NULL, 0);
4169
4170                 goto unlock;
4171         }
4172
4173         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4174                                len);
4175         if (!cmd)
4176                 err = -ENOMEM;
4177         else
4178                 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4179                                          set_default_phy_complete);
4180
4181         if (err < 0) {
4182                 err = mgmt_cmd_status(sk, hdev->id,
4183                                       MGMT_OP_SET_PHY_CONFIGURATION,
4184                                       MGMT_STATUS_FAILED);
4185
4186                 if (cmd)
4187                         mgmt_pending_remove(cmd);
4188         }
4189
4190 unlock:
4191         hci_dev_unlock(hdev);
4192
4193         return err;
4194 }
4195
4196 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4197                             u16 len)
4198 {
4199         int err = MGMT_STATUS_SUCCESS;
4200         struct mgmt_cp_set_blocked_keys *keys = data;
4201         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4202                                    sizeof(struct mgmt_blocked_key_info));
4203         u16 key_count, expected_len;
4204         int i;
4205
4206         bt_dev_dbg(hdev, "sock %p", sk);
4207
4208         key_count = __le16_to_cpu(keys->key_count);
4209         if (key_count > max_key_count) {
4210                 bt_dev_err(hdev, "too big key_count value %u", key_count);
4211                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4212                                        MGMT_STATUS_INVALID_PARAMS);
4213         }
4214
4215         expected_len = struct_size(keys, keys, key_count);
4216         if (expected_len != len) {
4217                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4218                            expected_len, len);
4219                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4220                                        MGMT_STATUS_INVALID_PARAMS);
4221         }
4222
4223         hci_dev_lock(hdev);
4224
4225         hci_blocked_keys_clear(hdev);
4226
4227         for (i = 0; i < key_count; ++i) {
4228                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
4229
4230                 if (!b) {
4231                         err = MGMT_STATUS_NO_RESOURCES;
4232                         break;
4233                 }
4234
4235                 b->type = keys->keys[i].type;
4236                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4237                 list_add_rcu(&b->list, &hdev->blocked_keys);
4238         }
4239         hci_dev_unlock(hdev);
4240
4241         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4242                                 err, NULL, 0);
4243 }
4244
4245 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4246                                void *data, u16 len)
4247 {
4248         struct mgmt_mode *cp = data;
4249         int err;
4250         bool changed = false;
4251
4252         bt_dev_dbg(hdev, "sock %p", sk);
4253
4254         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
4255                 return mgmt_cmd_status(sk, hdev->id,
4256                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4257                                        MGMT_STATUS_NOT_SUPPORTED);
4258
4259         if (cp->val != 0x00 && cp->val != 0x01)
4260                 return mgmt_cmd_status(sk, hdev->id,
4261                                        MGMT_OP_SET_WIDEBAND_SPEECH,
4262                                        MGMT_STATUS_INVALID_PARAMS);
4263
4264         hci_dev_lock(hdev);
4265
4266         if (hdev_is_powered(hdev) &&
4267             !!cp->val != hci_dev_test_flag(hdev,
4268                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
4269                 err = mgmt_cmd_status(sk, hdev->id,
4270                                       MGMT_OP_SET_WIDEBAND_SPEECH,
4271                                       MGMT_STATUS_REJECTED);
4272                 goto unlock;
4273         }
4274
4275         if (cp->val)
4276                 changed = !hci_dev_test_and_set_flag(hdev,
4277                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4278         else
4279                 changed = hci_dev_test_and_clear_flag(hdev,
4280                                                    HCI_WIDEBAND_SPEECH_ENABLED);
4281
4282         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4283         if (err < 0)
4284                 goto unlock;
4285
4286         if (changed)
4287                 err = new_settings(hdev, sk);
4288
4289 unlock:
4290         hci_dev_unlock(hdev);
4291         return err;
4292 }
4293
4294 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4295                                void *data, u16 data_len)
4296 {
4297         char buf[20];
4298         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4299         u16 cap_len = 0;
4300         u8 flags = 0;
4301         u8 tx_power_range[2];
4302
4303         bt_dev_dbg(hdev, "sock %p", sk);
4304
4305         memset(&buf, 0, sizeof(buf));
4306
4307         hci_dev_lock(hdev);
4308
4309         /* When the Read Simple Pairing Options command is supported, then
4310          * the remote public key validation is supported.
4311          *
4312          * Alternatively, when Microsoft extensions are available, they can
4313          * indicate support for public key validation as well.
4314          */
4315         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4316                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
4317
4318         flags |= 0x02;          /* Remote public key validation (LE) */
4319
4320         /* When the Read Encryption Key Size command is supported, then the
4321          * encryption key size is enforced.
4322          */
4323         if (hdev->commands[20] & 0x10)
4324                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
4325
4326         flags |= 0x08;          /* Encryption key size enforcement (LE) */
4327
4328         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4329                                   &flags, 1);
4330
4331         /* When the Read Simple Pairing Options command is supported, then
4332          * also max encryption key size information is provided.
4333          */
4334         if (hdev->commands[41] & 0x08)
4335                 cap_len = eir_append_le16(rp->cap, cap_len,
4336                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
4337                                           hdev->max_enc_key_size);
4338
4339         cap_len = eir_append_le16(rp->cap, cap_len,
4340                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4341                                   SMP_MAX_ENC_KEY_SIZE);
4342
4343         /* Append the min/max LE tx power parameters if we were able to fetch
4344          * it from the controller
4345          */
4346         if (hdev->commands[38] & 0x80) {
4347                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4348                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4349                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4350                                           tx_power_range, 2);
4351         }
4352
4353         rp->cap_len = cpu_to_le16(cap_len);
4354
4355         hci_dev_unlock(hdev);
4356
4357         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4358                                  rp, sizeof(*rp) + cap_len);
4359 }
4360
4361 #ifdef CONFIG_BT_FEATURE_DEBUG
4362 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4363 static const u8 debug_uuid[16] = {
4364         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4365         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4366 };
4367 #endif
4368
4369 /* 330859bc-7506-492d-9370-9a6f0614037f */
4370 static const u8 quality_report_uuid[16] = {
4371         0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4372         0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4373 };
4374
4375 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4376 static const u8 offload_codecs_uuid[16] = {
4377         0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4378         0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4379 };
4380
4381 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4382 static const u8 le_simultaneous_roles_uuid[16] = {
4383         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4384         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4385 };
4386
4387 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
4388 static const u8 rpa_resolution_uuid[16] = {
4389         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
4390         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
4391 };
4392
4393 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4394 static const u8 iso_socket_uuid[16] = {
4395         0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4396         0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4397 };
4398
4399 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4400 static const u8 mgmt_mesh_uuid[16] = {
4401         0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4402         0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4403 };
4404
4405 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4406                                   void *data, u16 data_len)
4407 {
4408         struct mgmt_rp_read_exp_features_info *rp;
4409         size_t len;
4410         u16 idx = 0;
4411         u32 flags;
4412         int status;
4413
4414         bt_dev_dbg(hdev, "sock %p", sk);
4415
4416         /* Enough space for 7 features */
4417         len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4418         rp = kzalloc(len, GFP_KERNEL);
4419         if (!rp)
4420                 return -ENOMEM;
4421
4422 #ifdef CONFIG_BT_FEATURE_DEBUG
4423         if (!hdev) {
4424                 flags = bt_dbg_get() ? BIT(0) : 0;
4425
4426                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4427                 rp->features[idx].flags = cpu_to_le32(flags);
4428                 idx++;
4429         }
4430 #endif
4431
4432         if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4433                 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4434                         flags = BIT(0);
4435                 else
4436                         flags = 0;
4437
4438                 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4439                 rp->features[idx].flags = cpu_to_le32(flags);
4440                 idx++;
4441         }
4442
4443         if (hdev && ll_privacy_capable(hdev)) {
4444                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
4445                         flags = BIT(0) | BIT(1);
4446                 else
4447                         flags = BIT(1);
4448
4449                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
4450                 rp->features[idx].flags = cpu_to_le32(flags);
4451                 idx++;
4452         }
4453
4454         if (hdev && (aosp_has_quality_report(hdev) ||
4455                      hdev->set_quality_report)) {
4456                 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4457                         flags = BIT(0);
4458                 else
4459                         flags = 0;
4460
4461                 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4462                 rp->features[idx].flags = cpu_to_le32(flags);
4463                 idx++;
4464         }
4465
4466         if (hdev && hdev->get_data_path_id) {
4467                 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4468                         flags = BIT(0);
4469                 else
4470                         flags = 0;
4471
4472                 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4473                 rp->features[idx].flags = cpu_to_le32(flags);
4474                 idx++;
4475         }
4476
4477         if (IS_ENABLED(CONFIG_BT_LE)) {
4478                 flags = iso_enabled() ? BIT(0) : 0;
4479                 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4480                 rp->features[idx].flags = cpu_to_le32(flags);
4481                 idx++;
4482         }
4483
4484         if (hdev && lmp_le_capable(hdev)) {
4485                 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4486                         flags = BIT(0);
4487                 else
4488                         flags = 0;
4489
4490                 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4491                 rp->features[idx].flags = cpu_to_le32(flags);
4492                 idx++;
4493         }
4494
4495         rp->feature_count = cpu_to_le16(idx);
4496
4497         /* After reading the experimental features information, enable
4498          * the events to update client on any future change.
4499          */
4500         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4501
4502         status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4503                                    MGMT_OP_READ_EXP_FEATURES_INFO,
4504                                    0, rp, sizeof(*rp) + (20 * idx));
4505
4506         kfree(rp);
4507         return status;
4508 }
4509
4510 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
4511                                           struct sock *skip)
4512 {
4513         struct mgmt_ev_exp_feature_changed ev;
4514
4515         memset(&ev, 0, sizeof(ev));
4516         memcpy(ev.uuid, rpa_resolution_uuid, 16);
4517         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
4518
4519         // Do we need to be atomic with the conn_flags?
4520         if (enabled && privacy_mode_capable(hdev))
4521                 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY;
4522         else
4523                 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY;
4524
4525         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4526                                   &ev, sizeof(ev),
4527                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4528
4529 }
4530
4531 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4532                                bool enabled, struct sock *skip)
4533 {
4534         struct mgmt_ev_exp_feature_changed ev;
4535
4536         memset(&ev, 0, sizeof(ev));
4537         memcpy(ev.uuid, uuid, 16);
4538         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4539
4540         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4541                                   &ev, sizeof(ev),
4542                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4543 }
4544
4545 #define EXP_FEAT(_uuid, _set_func)      \
4546 {                                       \
4547         .uuid = _uuid,                  \
4548         .set_func = _set_func,          \
4549 }
4550
4551 /* The zero key uuid is special. Multiple exp features are set through it. */
4552 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4553                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4554 {
4555         struct mgmt_rp_set_exp_feature rp;
4556
4557         memset(rp.uuid, 0, 16);
4558         rp.flags = cpu_to_le32(0);
4559
4560 #ifdef CONFIG_BT_FEATURE_DEBUG
4561         if (!hdev) {
4562                 bool changed = bt_dbg_get();
4563
4564                 bt_dbg_set(false);
4565
4566                 if (changed)
4567                         exp_feature_changed(NULL, ZERO_KEY, false, sk);
4568         }
4569 #endif
4570
4571         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
4572                 bool changed;
4573
4574                 changed = hci_dev_test_and_clear_flag(hdev,
4575                                                       HCI_ENABLE_LL_PRIVACY);
4576                 if (changed)
4577                         exp_feature_changed(hdev, rpa_resolution_uuid, false,
4578                                             sk);
4579         }
4580
4581         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4582
4583         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4584                                  MGMT_OP_SET_EXP_FEATURE, 0,
4585                                  &rp, sizeof(rp));
4586 }
4587
4588 #ifdef CONFIG_BT_FEATURE_DEBUG
4589 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4590                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4591 {
4592         struct mgmt_rp_set_exp_feature rp;
4593
4594         bool val, changed;
4595         int err;
4596
4597         /* Command requires to use the non-controller index */
4598         if (hdev)
4599                 return mgmt_cmd_status(sk, hdev->id,
4600                                        MGMT_OP_SET_EXP_FEATURE,
4601                                        MGMT_STATUS_INVALID_INDEX);
4602
4603         /* Parameters are limited to a single octet */
4604         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4605                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4606                                        MGMT_OP_SET_EXP_FEATURE,
4607                                        MGMT_STATUS_INVALID_PARAMS);
4608
4609         /* Only boolean on/off is supported */
4610         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4611                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4612                                        MGMT_OP_SET_EXP_FEATURE,
4613                                        MGMT_STATUS_INVALID_PARAMS);
4614
4615         val = !!cp->param[0];
4616         changed = val ? !bt_dbg_get() : bt_dbg_get();
4617         bt_dbg_set(val);
4618
4619         memcpy(rp.uuid, debug_uuid, 16);
4620         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4621
4622         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4623
4624         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4625                                 MGMT_OP_SET_EXP_FEATURE, 0,
4626                                 &rp, sizeof(rp));
4627
4628         if (changed)
4629                 exp_feature_changed(hdev, debug_uuid, val, sk);
4630
4631         return err;
4632 }
4633 #endif
4634
4635 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4636                               struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4637 {
4638         struct mgmt_rp_set_exp_feature rp;
4639         bool val, changed;
4640         int err;
4641
4642         /* Command requires to use the controller index */
4643         if (!hdev)
4644                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4645                                        MGMT_OP_SET_EXP_FEATURE,
4646                                        MGMT_STATUS_INVALID_INDEX);
4647
4648         /* Parameters are limited to a single octet */
4649         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4650                 return mgmt_cmd_status(sk, hdev->id,
4651                                        MGMT_OP_SET_EXP_FEATURE,
4652                                        MGMT_STATUS_INVALID_PARAMS);
4653
4654         /* Only boolean on/off is supported */
4655         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4656                 return mgmt_cmd_status(sk, hdev->id,
4657                                        MGMT_OP_SET_EXP_FEATURE,
4658                                        MGMT_STATUS_INVALID_PARAMS);
4659
4660         val = !!cp->param[0];
4661
4662         if (val) {
4663                 changed = !hci_dev_test_and_set_flag(hdev,
4664                                                      HCI_MESH_EXPERIMENTAL);
4665         } else {
4666                 hci_dev_clear_flag(hdev, HCI_MESH);
4667                 changed = hci_dev_test_and_clear_flag(hdev,
4668                                                       HCI_MESH_EXPERIMENTAL);
4669         }
4670
4671         memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4672         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4673
4674         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4675
4676         err = mgmt_cmd_complete(sk, hdev->id,
4677                                 MGMT_OP_SET_EXP_FEATURE, 0,
4678                                 &rp, sizeof(rp));
4679
4680         if (changed)
4681                 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4682
4683         return err;
4684 }
4685
4686 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
4687                                    struct mgmt_cp_set_exp_feature *cp,
4688                                    u16 data_len)
4689 {
4690         struct mgmt_rp_set_exp_feature rp;
4691         bool val, changed;
4692         int err;
4693         u32 flags;
4694
4695         /* Command requires to use the controller index */
4696         if (!hdev)
4697                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4698                                        MGMT_OP_SET_EXP_FEATURE,
4699                                        MGMT_STATUS_INVALID_INDEX);
4700
4701         /* Changes can only be made when controller is powered down */
4702         if (hdev_is_powered(hdev))
4703                 return mgmt_cmd_status(sk, hdev->id,
4704                                        MGMT_OP_SET_EXP_FEATURE,
4705                                        MGMT_STATUS_REJECTED);
4706
4707         /* Parameters are limited to a single octet */
4708         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4709                 return mgmt_cmd_status(sk, hdev->id,
4710                                        MGMT_OP_SET_EXP_FEATURE,
4711                                        MGMT_STATUS_INVALID_PARAMS);
4712
4713         /* Only boolean on/off is supported */
4714         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4715                 return mgmt_cmd_status(sk, hdev->id,
4716                                        MGMT_OP_SET_EXP_FEATURE,
4717                                        MGMT_STATUS_INVALID_PARAMS);
4718
4719         val = !!cp->param[0];
4720
4721         if (val) {
4722                 changed = !hci_dev_test_and_set_flag(hdev,
4723                                                      HCI_ENABLE_LL_PRIVACY);
4724                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4725
4726                 /* Enable LL privacy + supported settings changed */
4727                 flags = BIT(0) | BIT(1);
4728         } else {
4729                 changed = hci_dev_test_and_clear_flag(hdev,
4730                                                       HCI_ENABLE_LL_PRIVACY);
4731
4732                 /* Disable LL privacy + supported settings changed */
4733                 flags = BIT(1);
4734         }
4735
4736         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4737         rp.flags = cpu_to_le32(flags);
4738
4739         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4740
4741         err = mgmt_cmd_complete(sk, hdev->id,
4742                                 MGMT_OP_SET_EXP_FEATURE, 0,
4743                                 &rp, sizeof(rp));
4744
4745         if (changed)
4746                 exp_ll_privacy_feature_changed(val, hdev, sk);
4747
4748         return err;
4749 }
4750
4751 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4752                                    struct mgmt_cp_set_exp_feature *cp,
4753                                    u16 data_len)
4754 {
4755         struct mgmt_rp_set_exp_feature rp;
4756         bool val, changed;
4757         int err;
4758
4759         /* Command requires to use a valid controller index */
4760         if (!hdev)
4761                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4762                                        MGMT_OP_SET_EXP_FEATURE,
4763                                        MGMT_STATUS_INVALID_INDEX);
4764
4765         /* Parameters are limited to a single octet */
4766         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4767                 return mgmt_cmd_status(sk, hdev->id,
4768                                        MGMT_OP_SET_EXP_FEATURE,
4769                                        MGMT_STATUS_INVALID_PARAMS);
4770
4771         /* Only boolean on/off is supported */
4772         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4773                 return mgmt_cmd_status(sk, hdev->id,
4774                                        MGMT_OP_SET_EXP_FEATURE,
4775                                        MGMT_STATUS_INVALID_PARAMS);
4776
4777         hci_req_sync_lock(hdev);
4778
4779         val = !!cp->param[0];
4780         changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4781
4782         if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4783                 err = mgmt_cmd_status(sk, hdev->id,
4784                                       MGMT_OP_SET_EXP_FEATURE,
4785                                       MGMT_STATUS_NOT_SUPPORTED);
4786                 goto unlock_quality_report;
4787         }
4788
4789         if (changed) {
4790                 if (hdev->set_quality_report)
4791                         err = hdev->set_quality_report(hdev, val);
4792                 else
4793                         err = aosp_set_quality_report(hdev, val);
4794
4795                 if (err) {
4796                         err = mgmt_cmd_status(sk, hdev->id,
4797                                               MGMT_OP_SET_EXP_FEATURE,
4798                                               MGMT_STATUS_FAILED);
4799                         goto unlock_quality_report;
4800                 }
4801
4802                 if (val)
4803                         hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4804                 else
4805                         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4806         }
4807
4808         bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4809
4810         memcpy(rp.uuid, quality_report_uuid, 16);
4811         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4812         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4813
4814         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4815                                 &rp, sizeof(rp));
4816
4817         if (changed)
4818                 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4819
4820 unlock_quality_report:
4821         hci_req_sync_unlock(hdev);
4822         return err;
4823 }
4824
4825 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4826                                   struct mgmt_cp_set_exp_feature *cp,
4827                                   u16 data_len)
4828 {
4829         bool val, changed;
4830         int err;
4831         struct mgmt_rp_set_exp_feature rp;
4832
4833         /* Command requires to use a valid controller index */
4834         if (!hdev)
4835                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4836                                        MGMT_OP_SET_EXP_FEATURE,
4837                                        MGMT_STATUS_INVALID_INDEX);
4838
4839         /* Parameters are limited to a single octet */
4840         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4841                 return mgmt_cmd_status(sk, hdev->id,
4842                                        MGMT_OP_SET_EXP_FEATURE,
4843                                        MGMT_STATUS_INVALID_PARAMS);
4844
4845         /* Only boolean on/off is supported */
4846         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4847                 return mgmt_cmd_status(sk, hdev->id,
4848                                        MGMT_OP_SET_EXP_FEATURE,
4849                                        MGMT_STATUS_INVALID_PARAMS);
4850
4851         val = !!cp->param[0];
4852         changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4853
4854         if (!hdev->get_data_path_id) {
4855                 return mgmt_cmd_status(sk, hdev->id,
4856                                        MGMT_OP_SET_EXP_FEATURE,
4857                                        MGMT_STATUS_NOT_SUPPORTED);
4858         }
4859
4860         if (changed) {
4861                 if (val)
4862                         hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4863                 else
4864                         hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4865         }
4866
4867         bt_dev_info(hdev, "offload codecs enable %d changed %d",
4868                     val, changed);
4869
4870         memcpy(rp.uuid, offload_codecs_uuid, 16);
4871         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4872         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4873         err = mgmt_cmd_complete(sk, hdev->id,
4874                                 MGMT_OP_SET_EXP_FEATURE, 0,
4875                                 &rp, sizeof(rp));
4876
4877         if (changed)
4878                 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
4879
4880         return err;
4881 }
4882
4883 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
4884                                           struct mgmt_cp_set_exp_feature *cp,
4885                                           u16 data_len)
4886 {
4887         bool val, changed;
4888         int err;
4889         struct mgmt_rp_set_exp_feature rp;
4890
4891         /* Command requires to use a valid controller index */
4892         if (!hdev)
4893                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4894                                        MGMT_OP_SET_EXP_FEATURE,
4895                                        MGMT_STATUS_INVALID_INDEX);
4896
4897         /* Parameters are limited to a single octet */
4898         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4899                 return mgmt_cmd_status(sk, hdev->id,
4900                                        MGMT_OP_SET_EXP_FEATURE,
4901                                        MGMT_STATUS_INVALID_PARAMS);
4902
4903         /* Only boolean on/off is supported */
4904         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4905                 return mgmt_cmd_status(sk, hdev->id,
4906                                        MGMT_OP_SET_EXP_FEATURE,
4907                                        MGMT_STATUS_INVALID_PARAMS);
4908
4909         val = !!cp->param[0];
4910         changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
4911
4912         if (!hci_dev_le_state_simultaneous(hdev)) {
4913                 return mgmt_cmd_status(sk, hdev->id,
4914                                        MGMT_OP_SET_EXP_FEATURE,
4915                                        MGMT_STATUS_NOT_SUPPORTED);
4916         }
4917
4918         if (changed) {
4919                 if (val)
4920                         hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4921                 else
4922                         hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
4923         }
4924
4925         bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
4926                     val, changed);
4927
4928         memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
4929         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4930         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4931         err = mgmt_cmd_complete(sk, hdev->id,
4932                                 MGMT_OP_SET_EXP_FEATURE, 0,
4933                                 &rp, sizeof(rp));
4934
4935         if (changed)
4936                 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
4937
4938         return err;
4939 }
4940
4941 #ifdef CONFIG_BT_LE
4942 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
4943                                struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4944 {
4945         struct mgmt_rp_set_exp_feature rp;
4946         bool val, changed = false;
4947         int err;
4948
4949         /* Command requires to use the non-controller index */
4950         if (hdev)
4951                 return mgmt_cmd_status(sk, hdev->id,
4952                                        MGMT_OP_SET_EXP_FEATURE,
4953                                        MGMT_STATUS_INVALID_INDEX);
4954
4955         /* Parameters are limited to a single octet */
4956         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4957                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4958                                        MGMT_OP_SET_EXP_FEATURE,
4959                                        MGMT_STATUS_INVALID_PARAMS);
4960
4961         /* Only boolean on/off is supported */
4962         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4963                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4964                                        MGMT_OP_SET_EXP_FEATURE,
4965                                        MGMT_STATUS_INVALID_PARAMS);
4966
4967         val = cp->param[0] ? true : false;
4968         if (val)
4969                 err = iso_init();
4970         else
4971                 err = iso_exit();
4972
4973         if (!err)
4974                 changed = true;
4975
4976         memcpy(rp.uuid, iso_socket_uuid, 16);
4977         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4978
4979         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4980
4981         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4982                                 MGMT_OP_SET_EXP_FEATURE, 0,
4983                                 &rp, sizeof(rp));
4984
4985         if (changed)
4986                 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
4987
4988         return err;
4989 }
4990 #endif
4991
4992 static const struct mgmt_exp_feature {
4993         const u8 *uuid;
4994         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4995                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4996 } exp_features[] = {
4997         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4998 #ifdef CONFIG_BT_FEATURE_DEBUG
4999         EXP_FEAT(debug_uuid, set_debug_func),
5000 #endif
5001         EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
5002         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
5003         EXP_FEAT(quality_report_uuid, set_quality_report_func),
5004         EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
5005         EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
5006 #ifdef CONFIG_BT_LE
5007         EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
5008 #endif
5009
5010         /* end with a null feature */
5011         EXP_FEAT(NULL, NULL)
5012 };
5013
5014 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5015                            void *data, u16 data_len)
5016 {
5017         struct mgmt_cp_set_exp_feature *cp = data;
5018         size_t i = 0;
5019
5020         bt_dev_dbg(hdev, "sock %p", sk);
5021
5022         for (i = 0; exp_features[i].uuid; i++) {
5023                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5024                         return exp_features[i].set_func(sk, hdev, cp, data_len);
5025         }
5026
5027         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5028                                MGMT_OP_SET_EXP_FEATURE,
5029                                MGMT_STATUS_NOT_SUPPORTED);
5030 }
5031
5032 static u32 get_params_flags(struct hci_dev *hdev,
5033                             struct hci_conn_params *params)
5034 {
5035         u32 flags = hdev->conn_flags;
5036
5037         /* Devices using RPAs can only be programmed in the acceptlist if
5038          * LL Privacy has been enable otherwise they cannot mark
5039          * HCI_CONN_FLAG_REMOTE_WAKEUP.
5040          */
5041         if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
5042             hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
5043                 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
5044
5045         return flags;
5046 }
5047
5048 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5049                             u16 data_len)
5050 {
5051         struct mgmt_cp_get_device_flags *cp = data;
5052         struct mgmt_rp_get_device_flags rp;
5053         struct bdaddr_list_with_flags *br_params;
5054         struct hci_conn_params *params;
5055         u32 supported_flags;
5056         u32 current_flags = 0;
5057         u8 status = MGMT_STATUS_INVALID_PARAMS;
5058
5059         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5060                    &cp->addr.bdaddr, cp->addr.type);
5061
5062         hci_dev_lock(hdev);
5063
5064         supported_flags = hdev->conn_flags;
5065
5066         memset(&rp, 0, sizeof(rp));
5067
5068         if (cp->addr.type == BDADDR_BREDR) {
5069                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5070                                                               &cp->addr.bdaddr,
5071                                                               cp->addr.type);
5072                 if (!br_params)
5073                         goto done;
5074
5075                 current_flags = br_params->flags;
5076         } else {
5077                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5078                                                 le_addr_type(cp->addr.type));
5079                 if (!params)
5080                         goto done;
5081
5082                 supported_flags = get_params_flags(hdev, params);
5083                 current_flags = params->flags;
5084         }
5085
5086         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5087         rp.addr.type = cp->addr.type;
5088         rp.supported_flags = cpu_to_le32(supported_flags);
5089         rp.current_flags = cpu_to_le32(current_flags);
5090
5091         status = MGMT_STATUS_SUCCESS;
5092
5093 done:
5094         hci_dev_unlock(hdev);
5095
5096         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5097                                 &rp, sizeof(rp));
5098 }
5099
5100 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5101                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5102                                  u32 supported_flags, u32 current_flags)
5103 {
5104         struct mgmt_ev_device_flags_changed ev;
5105
5106         bacpy(&ev.addr.bdaddr, bdaddr);
5107         ev.addr.type = bdaddr_type;
5108         ev.supported_flags = cpu_to_le32(supported_flags);
5109         ev.current_flags = cpu_to_le32(current_flags);
5110
5111         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5112 }
5113
5114 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5115                             u16 len)
5116 {
5117         struct mgmt_cp_set_device_flags *cp = data;
5118         struct bdaddr_list_with_flags *br_params;
5119         struct hci_conn_params *params;
5120         u8 status = MGMT_STATUS_INVALID_PARAMS;
5121         u32 supported_flags;
5122         u32 current_flags = __le32_to_cpu(cp->current_flags);
5123
5124         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5125                    &cp->addr.bdaddr, cp->addr.type, current_flags);
5126
5127         // We should take hci_dev_lock() early, I think.. conn_flags can change
5128         supported_flags = hdev->conn_flags;
5129
5130         if ((supported_flags | current_flags) != supported_flags) {
5131                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5132                             current_flags, supported_flags);
5133                 goto done;
5134         }
5135
5136         hci_dev_lock(hdev);
5137
5138         if (cp->addr.type == BDADDR_BREDR) {
5139                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5140                                                               &cp->addr.bdaddr,
5141                                                               cp->addr.type);
5142
5143                 if (br_params) {
5144                         br_params->flags = current_flags;
5145                         status = MGMT_STATUS_SUCCESS;
5146                 } else {
5147                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5148                                     &cp->addr.bdaddr, cp->addr.type);
5149                 }
5150
5151                 goto unlock;
5152         }
5153
5154         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5155                                         le_addr_type(cp->addr.type));
5156         if (!params) {
5157                 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5158                             &cp->addr.bdaddr, le_addr_type(cp->addr.type));
5159                 goto unlock;
5160         }
5161
5162         supported_flags = get_params_flags(hdev, params);
5163
5164         if ((supported_flags | current_flags) != supported_flags) {
5165                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5166                             current_flags, supported_flags);
5167                 goto unlock;
5168         }
5169
5170         WRITE_ONCE(params->flags, current_flags);
5171         status = MGMT_STATUS_SUCCESS;
5172
5173         /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5174          * has been set.
5175          */
5176         if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5177                 hci_update_passive_scan(hdev);
5178
5179 unlock:
5180         hci_dev_unlock(hdev);
5181
5182 done:
5183         if (status == MGMT_STATUS_SUCCESS)
5184                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5185                                      supported_flags, current_flags);
5186
5187         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5188                                  &cp->addr, sizeof(cp->addr));
5189 }
5190
5191 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5192                                    u16 handle)
5193 {
5194         struct mgmt_ev_adv_monitor_added ev;
5195
5196         ev.monitor_handle = cpu_to_le16(handle);
5197
5198         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5199 }
5200
5201 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
5202 {
5203         struct mgmt_ev_adv_monitor_removed ev;
5204         struct mgmt_pending_cmd *cmd;
5205         struct sock *sk_skip = NULL;
5206         struct mgmt_cp_remove_adv_monitor *cp;
5207
5208         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
5209         if (cmd) {
5210                 cp = cmd->param;
5211
5212                 if (cp->monitor_handle)
5213                         sk_skip = cmd->sk;
5214         }
5215
5216         ev.monitor_handle = cpu_to_le16(handle);
5217
5218         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
5219 }
5220
5221 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5222                                  void *data, u16 len)
5223 {
5224         struct adv_monitor *monitor = NULL;
5225         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5226         int handle, err;
5227         size_t rp_size = 0;
5228         __u32 supported = 0;
5229         __u32 enabled = 0;
5230         __u16 num_handles = 0;
5231         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5232
5233         BT_DBG("request for %s", hdev->name);
5234
5235         hci_dev_lock(hdev);
5236
5237         if (msft_monitor_supported(hdev))
5238                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5239
5240         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5241                 handles[num_handles++] = monitor->handle;
5242
5243         hci_dev_unlock(hdev);
5244
5245         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5246         rp = kmalloc(rp_size, GFP_KERNEL);
5247         if (!rp)
5248                 return -ENOMEM;
5249
5250         /* All supported features are currently enabled */
5251         enabled = supported;
5252
5253         rp->supported_features = cpu_to_le32(supported);
5254         rp->enabled_features = cpu_to_le32(enabled);
5255         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5256         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5257         rp->num_handles = cpu_to_le16(num_handles);
5258         if (num_handles)
5259                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5260
5261         err = mgmt_cmd_complete(sk, hdev->id,
5262                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5263                                 MGMT_STATUS_SUCCESS, rp, rp_size);
5264
5265         kfree(rp);
5266
5267         return err;
5268 }
5269
5270 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5271                                                    void *data, int status)
5272 {
5273         struct mgmt_rp_add_adv_patterns_monitor rp;
5274         struct mgmt_pending_cmd *cmd = data;
5275         struct adv_monitor *monitor = cmd->user_data;
5276
5277         hci_dev_lock(hdev);
5278
5279         rp.monitor_handle = cpu_to_le16(monitor->handle);
5280
5281         if (!status) {
5282                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5283                 hdev->adv_monitors_cnt++;
5284                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5285                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
5286                 hci_update_passive_scan(hdev);
5287         }
5288
5289         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5290                           mgmt_status(status), &rp, sizeof(rp));
5291         mgmt_pending_remove(cmd);
5292
5293         hci_dev_unlock(hdev);
5294         bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5295                    rp.monitor_handle, status);
5296 }
5297
5298 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5299 {
5300         struct mgmt_pending_cmd *cmd = data;
5301         struct adv_monitor *monitor = cmd->user_data;
5302
5303         return hci_add_adv_monitor(hdev, monitor);
5304 }
5305
5306 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5307                                       struct adv_monitor *m, u8 status,
5308                                       void *data, u16 len, u16 op)
5309 {
5310         struct mgmt_pending_cmd *cmd;
5311         int err;
5312
5313         hci_dev_lock(hdev);
5314
5315         if (status)
5316                 goto unlock;
5317
5318         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5319             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5320             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
5321             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
5322                 status = MGMT_STATUS_BUSY;
5323                 goto unlock;
5324         }
5325
5326         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5327         if (!cmd) {
5328                 status = MGMT_STATUS_NO_RESOURCES;
5329                 goto unlock;
5330         }
5331
5332         cmd->user_data = m;
5333         err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5334                                  mgmt_add_adv_patterns_monitor_complete);
5335         if (err) {
5336                 if (err == -ENOMEM)
5337                         status = MGMT_STATUS_NO_RESOURCES;
5338                 else
5339                         status = MGMT_STATUS_FAILED;
5340
5341                 goto unlock;
5342         }
5343
5344         hci_dev_unlock(hdev);
5345
5346         return 0;
5347
5348 unlock:
5349         hci_free_adv_monitor(hdev, m);
5350         hci_dev_unlock(hdev);
5351         return mgmt_cmd_status(sk, hdev->id, op, status);
5352 }
5353
5354 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5355                                    struct mgmt_adv_rssi_thresholds *rssi)
5356 {
5357         if (rssi) {
5358                 m->rssi.low_threshold = rssi->low_threshold;
5359                 m->rssi.low_threshold_timeout =
5360                     __le16_to_cpu(rssi->low_threshold_timeout);
5361                 m->rssi.high_threshold = rssi->high_threshold;
5362                 m->rssi.high_threshold_timeout =
5363                     __le16_to_cpu(rssi->high_threshold_timeout);
5364                 m->rssi.sampling_period = rssi->sampling_period;
5365         } else {
5366                 /* Default values. These numbers are the least constricting
5367                  * parameters for MSFT API to work, so it behaves as if there
5368                  * are no rssi parameter to consider. May need to be changed
5369                  * if other API are to be supported.
5370                  */
5371                 m->rssi.low_threshold = -127;
5372                 m->rssi.low_threshold_timeout = 60;
5373                 m->rssi.high_threshold = -127;
5374                 m->rssi.high_threshold_timeout = 0;
5375                 m->rssi.sampling_period = 0;
5376         }
5377 }
5378
5379 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5380                                     struct mgmt_adv_pattern *patterns)
5381 {
5382         u8 offset = 0, length = 0;
5383         struct adv_pattern *p = NULL;
5384         int i;
5385
5386         for (i = 0; i < pattern_count; i++) {
5387                 offset = patterns[i].offset;
5388                 length = patterns[i].length;
5389                 if (offset >= HCI_MAX_EXT_AD_LENGTH ||
5390                     length > HCI_MAX_EXT_AD_LENGTH ||
5391                     (offset + length) > HCI_MAX_EXT_AD_LENGTH)
5392                         return MGMT_STATUS_INVALID_PARAMS;
5393
5394                 p = kmalloc(sizeof(*p), GFP_KERNEL);
5395                 if (!p)
5396                         return MGMT_STATUS_NO_RESOURCES;
5397
5398                 p->ad_type = patterns[i].ad_type;
5399                 p->offset = patterns[i].offset;
5400                 p->length = patterns[i].length;
5401                 memcpy(p->value, patterns[i].value, p->length);
5402
5403                 INIT_LIST_HEAD(&p->list);
5404                 list_add(&p->list, &m->patterns);
5405         }
5406
5407         return MGMT_STATUS_SUCCESS;
5408 }
5409
5410 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5411                                     void *data, u16 len)
5412 {
5413         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5414         struct adv_monitor *m = NULL;
5415         u8 status = MGMT_STATUS_SUCCESS;
5416         size_t expected_size = sizeof(*cp);
5417
5418         BT_DBG("request for %s", hdev->name);
5419
5420         if (len <= sizeof(*cp)) {
5421                 status = MGMT_STATUS_INVALID_PARAMS;
5422                 goto done;
5423         }
5424
5425         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5426         if (len != expected_size) {
5427                 status = MGMT_STATUS_INVALID_PARAMS;
5428                 goto done;
5429         }
5430
5431         m = kzalloc(sizeof(*m), GFP_KERNEL);
5432         if (!m) {
5433                 status = MGMT_STATUS_NO_RESOURCES;
5434                 goto done;
5435         }
5436
5437         INIT_LIST_HEAD(&m->patterns);
5438
5439         parse_adv_monitor_rssi(m, NULL);
5440         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5441
5442 done:
5443         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5444                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5445 }
5446
5447 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5448                                          void *data, u16 len)
5449 {
5450         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5451         struct adv_monitor *m = NULL;
5452         u8 status = MGMT_STATUS_SUCCESS;
5453         size_t expected_size = sizeof(*cp);
5454
5455         BT_DBG("request for %s", hdev->name);
5456
5457         if (len <= sizeof(*cp)) {
5458                 status = MGMT_STATUS_INVALID_PARAMS;
5459                 goto done;
5460         }
5461
5462         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5463         if (len != expected_size) {
5464                 status = MGMT_STATUS_INVALID_PARAMS;
5465                 goto done;
5466         }
5467
5468         m = kzalloc(sizeof(*m), GFP_KERNEL);
5469         if (!m) {
5470                 status = MGMT_STATUS_NO_RESOURCES;
5471                 goto done;
5472         }
5473
5474         INIT_LIST_HEAD(&m->patterns);
5475
5476         parse_adv_monitor_rssi(m, &cp->rssi);
5477         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5478
5479 done:
5480         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5481                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5482 }
5483
5484 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5485                                              void *data, int status)
5486 {
5487         struct mgmt_rp_remove_adv_monitor rp;
5488         struct mgmt_pending_cmd *cmd = data;
5489         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5490
5491         hci_dev_lock(hdev);
5492
5493         rp.monitor_handle = cp->monitor_handle;
5494
5495         if (!status)
5496                 hci_update_passive_scan(hdev);
5497
5498         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
5499                           mgmt_status(status), &rp, sizeof(rp));
5500         mgmt_pending_remove(cmd);
5501
5502         hci_dev_unlock(hdev);
5503         bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5504                    rp.monitor_handle, status);
5505 }
5506
5507 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5508 {
5509         struct mgmt_pending_cmd *cmd = data;
5510         struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5511         u16 handle = __le16_to_cpu(cp->monitor_handle);
5512
5513         if (!handle)
5514                 return hci_remove_all_adv_monitor(hdev);
5515
5516         return hci_remove_single_adv_monitor(hdev, handle);
5517 }
5518
5519 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5520                               void *data, u16 len)
5521 {
5522         struct mgmt_pending_cmd *cmd;
5523         int err, status;
5524
5525         hci_dev_lock(hdev);
5526
5527         if (pending_find(MGMT_OP_SET_LE, hdev) ||
5528             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
5529             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5530             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5531                 status = MGMT_STATUS_BUSY;
5532                 goto unlock;
5533         }
5534
5535         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5536         if (!cmd) {
5537                 status = MGMT_STATUS_NO_RESOURCES;
5538                 goto unlock;
5539         }
5540
5541         err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd,
5542                                  mgmt_remove_adv_monitor_complete);
5543
5544         if (err) {
5545                 mgmt_pending_remove(cmd);
5546
5547                 if (err == -ENOMEM)
5548                         status = MGMT_STATUS_NO_RESOURCES;
5549                 else
5550                         status = MGMT_STATUS_FAILED;
5551
5552                 goto unlock;
5553         }
5554
5555         hci_dev_unlock(hdev);
5556
5557         return 0;
5558
5559 unlock:
5560         hci_dev_unlock(hdev);
5561         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5562                                status);
5563 }
5564
5565 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
5566 {
5567         struct mgmt_rp_read_local_oob_data mgmt_rp;
5568         size_t rp_size = sizeof(mgmt_rp);
5569         struct mgmt_pending_cmd *cmd = data;
5570         struct sk_buff *skb = cmd->skb;
5571         u8 status = mgmt_status(err);
5572
5573         if (!status) {
5574                 if (!skb)
5575                         status = MGMT_STATUS_FAILED;
5576                 else if (IS_ERR(skb))
5577                         status = mgmt_status(PTR_ERR(skb));
5578                 else
5579                         status = mgmt_status(skb->data[0]);
5580         }
5581
5582         bt_dev_dbg(hdev, "status %d", status);
5583
5584         if (status) {
5585                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
5586                 goto remove;
5587         }
5588
5589         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5590
5591         if (!bredr_sc_enabled(hdev)) {
5592                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5593
5594                 if (skb->len < sizeof(*rp)) {
5595                         mgmt_cmd_status(cmd->sk, hdev->id,
5596                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5597                                         MGMT_STATUS_FAILED);
5598                         goto remove;
5599                 }
5600
5601                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5602                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5603
5604                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5605         } else {
5606                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5607
5608                 if (skb->len < sizeof(*rp)) {
5609                         mgmt_cmd_status(cmd->sk, hdev->id,
5610                                         MGMT_OP_READ_LOCAL_OOB_DATA,
5611                                         MGMT_STATUS_FAILED);
5612                         goto remove;
5613                 }
5614
5615                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5616                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5617
5618                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5619                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5620         }
5621
5622         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5623                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5624
5625 remove:
5626         if (skb && !IS_ERR(skb))
5627                 kfree_skb(skb);
5628
5629         mgmt_pending_free(cmd);
5630 }
5631
5632 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5633 {
5634         struct mgmt_pending_cmd *cmd = data;
5635
5636         if (bredr_sc_enabled(hdev))
5637                 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5638         else
5639                 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5640
5641         if (IS_ERR(cmd->skb))
5642                 return PTR_ERR(cmd->skb);
5643         else
5644                 return 0;
5645 }
5646
5647 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5648                                void *data, u16 data_len)
5649 {
5650         struct mgmt_pending_cmd *cmd;
5651         int err;
5652
5653         bt_dev_dbg(hdev, "sock %p", sk);
5654
5655         hci_dev_lock(hdev);
5656
5657         if (!hdev_is_powered(hdev)) {
5658                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5659                                       MGMT_STATUS_NOT_POWERED);
5660                 goto unlock;
5661         }
5662
5663         if (!lmp_ssp_capable(hdev)) {
5664                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5665                                       MGMT_STATUS_NOT_SUPPORTED);
5666                 goto unlock;
5667         }
5668
5669         cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5670         if (!cmd)
5671                 err = -ENOMEM;
5672         else
5673                 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5674                                          read_local_oob_data_complete);
5675
5676         if (err < 0) {
5677                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5678                                       MGMT_STATUS_FAILED);
5679
5680                 if (cmd)
5681                         mgmt_pending_free(cmd);
5682         }
5683
5684 unlock:
5685         hci_dev_unlock(hdev);
5686         return err;
5687 }
5688
5689 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5690                                void *data, u16 len)
5691 {
5692         struct mgmt_addr_info *addr = data;
5693         int err;
5694
5695         bt_dev_dbg(hdev, "sock %p", sk);
5696
5697         if (!bdaddr_type_is_valid(addr->type))
5698                 return mgmt_cmd_complete(sk, hdev->id,
5699                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
5700                                          MGMT_STATUS_INVALID_PARAMS,
5701                                          addr, sizeof(*addr));
5702
5703         hci_dev_lock(hdev);
5704
5705         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5706                 struct mgmt_cp_add_remote_oob_data *cp = data;
5707                 u8 status;
5708
5709                 if (cp->addr.type != BDADDR_BREDR) {
5710                         err = mgmt_cmd_complete(sk, hdev->id,
5711                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
5712                                                 MGMT_STATUS_INVALID_PARAMS,
5713                                                 &cp->addr, sizeof(cp->addr));
5714                         goto unlock;
5715                 }
5716
5717                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5718                                               cp->addr.type, cp->hash,
5719                                               cp->rand, NULL, NULL);
5720                 if (err < 0)
5721                         status = MGMT_STATUS_FAILED;
5722                 else
5723                         status = MGMT_STATUS_SUCCESS;
5724
5725                 err = mgmt_cmd_complete(sk, hdev->id,
5726                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5727                                         &cp->addr, sizeof(cp->addr));
5728         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5729                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5730                 u8 *rand192, *hash192, *rand256, *hash256;
5731                 u8 status;
5732
5733                 if (bdaddr_type_is_le(cp->addr.type)) {
5734                         /* Enforce zero-valued 192-bit parameters as
5735                          * long as legacy SMP OOB isn't implemented.
5736                          */
5737                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5738                             memcmp(cp->hash192, ZERO_KEY, 16)) {
5739                                 err = mgmt_cmd_complete(sk, hdev->id,
5740                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5741                                                         MGMT_STATUS_INVALID_PARAMS,
5742                                                         addr, sizeof(*addr));
5743                                 goto unlock;
5744                         }
5745
5746                         rand192 = NULL;
5747                         hash192 = NULL;
5748                 } else {
5749                         /* In case one of the P-192 values is set to zero,
5750                          * then just disable OOB data for P-192.
5751                          */
5752                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5753                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
5754                                 rand192 = NULL;
5755                                 hash192 = NULL;
5756                         } else {
5757                                 rand192 = cp->rand192;
5758                                 hash192 = cp->hash192;
5759                         }
5760                 }
5761
5762                 /* In case one of the P-256 values is set to zero, then just
5763                  * disable OOB data for P-256.
5764                  */
5765                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5766                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
5767                         rand256 = NULL;
5768                         hash256 = NULL;
5769                 } else {
5770                         rand256 = cp->rand256;
5771                         hash256 = cp->hash256;
5772                 }
5773
5774                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5775                                               cp->addr.type, hash192, rand192,
5776                                               hash256, rand256);
5777                 if (err < 0)
5778                         status = MGMT_STATUS_FAILED;
5779                 else
5780                         status = MGMT_STATUS_SUCCESS;
5781
5782                 err = mgmt_cmd_complete(sk, hdev->id,
5783                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
5784                                         status, &cp->addr, sizeof(cp->addr));
5785         } else {
5786                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5787                            len);
5788                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5789                                       MGMT_STATUS_INVALID_PARAMS);
5790         }
5791
5792 unlock:
5793         hci_dev_unlock(hdev);
5794         return err;
5795 }
5796
5797 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5798                                   void *data, u16 len)
5799 {
5800         struct mgmt_cp_remove_remote_oob_data *cp = data;
5801         u8 status;
5802         int err;
5803
5804         bt_dev_dbg(hdev, "sock %p", sk);
5805
5806         if (cp->addr.type != BDADDR_BREDR)
5807                 return mgmt_cmd_complete(sk, hdev->id,
5808                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5809                                          MGMT_STATUS_INVALID_PARAMS,
5810                                          &cp->addr, sizeof(cp->addr));
5811
5812         hci_dev_lock(hdev);
5813
5814         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5815                 hci_remote_oob_data_clear(hdev);
5816                 status = MGMT_STATUS_SUCCESS;
5817                 goto done;
5818         }
5819
5820         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
5821         if (err < 0)
5822                 status = MGMT_STATUS_INVALID_PARAMS;
5823         else
5824                 status = MGMT_STATUS_SUCCESS;
5825
5826 done:
5827         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
5828                                 status, &cp->addr, sizeof(cp->addr));
5829
5830         hci_dev_unlock(hdev);
5831         return err;
5832 }
5833
5834 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
5835 {
5836         struct mgmt_pending_cmd *cmd;
5837
5838         bt_dev_dbg(hdev, "status %u", status);
5839
5840         hci_dev_lock(hdev);
5841
5842         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
5843         if (!cmd)
5844                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
5845
5846         if (!cmd)
5847                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
5848
5849         if (cmd) {
5850                 cmd->cmd_complete(cmd, mgmt_status(status));
5851                 mgmt_pending_remove(cmd);
5852         }
5853
5854         hci_dev_unlock(hdev);
5855 }
5856
5857 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
5858                                     uint8_t *mgmt_status)
5859 {
5860         switch (type) {
5861         case DISCOV_TYPE_LE:
5862                 *mgmt_status = mgmt_le_support(hdev);
5863                 if (*mgmt_status)
5864                         return false;
5865                 break;
5866         case DISCOV_TYPE_INTERLEAVED:
5867                 *mgmt_status = mgmt_le_support(hdev);
5868                 if (*mgmt_status)
5869                         return false;
5870                 fallthrough;
5871         case DISCOV_TYPE_BREDR:
5872                 *mgmt_status = mgmt_bredr_support(hdev);
5873                 if (*mgmt_status)
5874                         return false;
5875                 break;
5876         default:
5877                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
5878                 return false;
5879         }
5880
5881         return true;
5882 }
5883
5884 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
5885 {
5886         struct mgmt_pending_cmd *cmd = data;
5887
5888         if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
5889             cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
5890             cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
5891                 return;
5892
5893         bt_dev_dbg(hdev, "err %d", err);
5894
5895         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
5896                           cmd->param, 1);
5897         mgmt_pending_remove(cmd);
5898
5899         hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
5900                                 DISCOVERY_FINDING);
5901 }
5902
5903 static int start_discovery_sync(struct hci_dev *hdev, void *data)
5904 {
5905         return hci_start_discovery_sync(hdev);
5906 }
5907
5908 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
5909                                     u16 op, void *data, u16 len)
5910 {
5911         struct mgmt_cp_start_discovery *cp = data;
5912         struct mgmt_pending_cmd *cmd;
5913         u8 status;
5914         int err;
5915
5916         bt_dev_dbg(hdev, "sock %p", sk);
5917
5918         hci_dev_lock(hdev);
5919
5920         if (!hdev_is_powered(hdev)) {
5921                 err = mgmt_cmd_complete(sk, hdev->id, op,
5922                                         MGMT_STATUS_NOT_POWERED,
5923                                         &cp->type, sizeof(cp->type));
5924                 goto failed;
5925         }
5926
5927         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5928             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5929                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5930                                         &cp->type, sizeof(cp->type));
5931                 goto failed;
5932         }
5933
5934         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5935                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
5936                                         &cp->type, sizeof(cp->type));
5937                 goto failed;
5938         }
5939
5940         /* Can't start discovery when it is paused */
5941         if (hdev->discovery_paused) {
5942                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
5943                                         &cp->type, sizeof(cp->type));
5944                 goto failed;
5945         }
5946
5947         /* Clear the discovery filter first to free any previously
5948          * allocated memory for the UUID list.
5949          */
5950         hci_discovery_filter_clear(hdev);
5951
5952         hdev->discovery.type = cp->type;
5953         hdev->discovery.report_invalid_rssi = false;
5954         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
5955                 hdev->discovery.limited = true;
5956         else
5957                 hdev->discovery.limited = false;
5958
5959         cmd = mgmt_pending_add(sk, op, hdev, data, len);
5960         if (!cmd) {
5961                 err = -ENOMEM;
5962                 goto failed;
5963         }
5964
5965         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
5966                                  start_discovery_complete);
5967         if (err < 0) {
5968                 mgmt_pending_remove(cmd);
5969                 goto failed;
5970         }
5971
5972         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5973
5974 failed:
5975         hci_dev_unlock(hdev);
5976         return err;
5977 }
5978
5979 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
5980                            void *data, u16 len)
5981 {
5982         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5983                                         data, len);
5984 }
5985
5986 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5987                                    void *data, u16 len)
5988 {
5989         return start_discovery_internal(sk, hdev,
5990                                         MGMT_OP_START_LIMITED_DISCOVERY,
5991                                         data, len);
5992 }
5993
5994 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5995                                    void *data, u16 len)
5996 {
5997         struct mgmt_cp_start_service_discovery *cp = data;
5998         struct mgmt_pending_cmd *cmd;
5999         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
6000         u16 uuid_count, expected_len;
6001         u8 status;
6002         int err;
6003
6004         bt_dev_dbg(hdev, "sock %p", sk);
6005
6006         hci_dev_lock(hdev);
6007
6008         if (!hdev_is_powered(hdev)) {
6009                 err = mgmt_cmd_complete(sk, hdev->id,
6010                                         MGMT_OP_START_SERVICE_DISCOVERY,
6011                                         MGMT_STATUS_NOT_POWERED,
6012                                         &cp->type, sizeof(cp->type));
6013                 goto failed;
6014         }
6015
6016         if (hdev->discovery.state != DISCOVERY_STOPPED ||
6017             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6018                 err = mgmt_cmd_complete(sk, hdev->id,
6019                                         MGMT_OP_START_SERVICE_DISCOVERY,
6020                                         MGMT_STATUS_BUSY, &cp->type,
6021                                         sizeof(cp->type));
6022                 goto failed;
6023         }
6024
6025         if (hdev->discovery_paused) {
6026                 err = mgmt_cmd_complete(sk, hdev->id,
6027                                         MGMT_OP_START_SERVICE_DISCOVERY,
6028                                         MGMT_STATUS_BUSY, &cp->type,
6029                                         sizeof(cp->type));
6030                 goto failed;
6031         }
6032
6033         uuid_count = __le16_to_cpu(cp->uuid_count);
6034         if (uuid_count > max_uuid_count) {
6035                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6036                            uuid_count);
6037                 err = mgmt_cmd_complete(sk, hdev->id,
6038                                         MGMT_OP_START_SERVICE_DISCOVERY,
6039                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6040                                         sizeof(cp->type));
6041                 goto failed;
6042         }
6043
6044         expected_len = sizeof(*cp) + uuid_count * 16;
6045         if (expected_len != len) {
6046                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6047                            expected_len, len);
6048                 err = mgmt_cmd_complete(sk, hdev->id,
6049                                         MGMT_OP_START_SERVICE_DISCOVERY,
6050                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
6051                                         sizeof(cp->type));
6052                 goto failed;
6053         }
6054
6055         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6056                 err = mgmt_cmd_complete(sk, hdev->id,
6057                                         MGMT_OP_START_SERVICE_DISCOVERY,
6058                                         status, &cp->type, sizeof(cp->type));
6059                 goto failed;
6060         }
6061
6062         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6063                                hdev, data, len);
6064         if (!cmd) {
6065                 err = -ENOMEM;
6066                 goto failed;
6067         }
6068
6069         /* Clear the discovery filter first to free any previously
6070          * allocated memory for the UUID list.
6071          */
6072         hci_discovery_filter_clear(hdev);
6073
6074         hdev->discovery.result_filtering = true;
6075         hdev->discovery.type = cp->type;
6076         hdev->discovery.rssi = cp->rssi;
6077         hdev->discovery.uuid_count = uuid_count;
6078
6079         if (uuid_count > 0) {
6080                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6081                                                 GFP_KERNEL);
6082                 if (!hdev->discovery.uuids) {
6083                         err = mgmt_cmd_complete(sk, hdev->id,
6084                                                 MGMT_OP_START_SERVICE_DISCOVERY,
6085                                                 MGMT_STATUS_FAILED,
6086                                                 &cp->type, sizeof(cp->type));
6087                         mgmt_pending_remove(cmd);
6088                         goto failed;
6089                 }
6090         }
6091
6092         err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6093                                  start_discovery_complete);
6094         if (err < 0) {
6095                 mgmt_pending_remove(cmd);
6096                 goto failed;
6097         }
6098
6099         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6100
6101 failed:
6102         hci_dev_unlock(hdev);
6103         return err;
6104 }
6105
6106 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
6107 {
6108         struct mgmt_pending_cmd *cmd;
6109
6110         bt_dev_dbg(hdev, "status %u", status);
6111
6112         hci_dev_lock(hdev);
6113
6114         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6115         if (cmd) {
6116                 cmd->cmd_complete(cmd, mgmt_status(status));
6117                 mgmt_pending_remove(cmd);
6118         }
6119
6120         hci_dev_unlock(hdev);
6121 }
6122
6123 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6124 {
6125         struct mgmt_pending_cmd *cmd = data;
6126
6127         if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
6128                 return;
6129
6130         bt_dev_dbg(hdev, "err %d", err);
6131
6132         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
6133                           cmd->param, 1);
6134         mgmt_pending_remove(cmd);
6135
6136         if (!err)
6137                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6138 }
6139
6140 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6141 {
6142         return hci_stop_discovery_sync(hdev);
6143 }
6144
6145 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6146                           u16 len)
6147 {
6148         struct mgmt_cp_stop_discovery *mgmt_cp = data;
6149         struct mgmt_pending_cmd *cmd;
6150         int err;
6151
6152         bt_dev_dbg(hdev, "sock %p", sk);
6153
6154         hci_dev_lock(hdev);
6155
6156         if (!hci_discovery_active(hdev)) {
6157                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6158                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
6159                                         sizeof(mgmt_cp->type));
6160                 goto unlock;
6161         }
6162
6163         if (hdev->discovery.type != mgmt_cp->type) {
6164                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6165                                         MGMT_STATUS_INVALID_PARAMS,
6166                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
6167                 goto unlock;
6168         }
6169
6170         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6171         if (!cmd) {
6172                 err = -ENOMEM;
6173                 goto unlock;
6174         }
6175
6176         err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6177                                  stop_discovery_complete);
6178         if (err < 0) {
6179                 mgmt_pending_remove(cmd);
6180                 goto unlock;
6181         }
6182
6183         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6184
6185 unlock:
6186         hci_dev_unlock(hdev);
6187         return err;
6188 }
6189
6190 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6191                         u16 len)
6192 {
6193         struct mgmt_cp_confirm_name *cp = data;
6194         struct inquiry_entry *e;
6195         int err;
6196
6197         bt_dev_dbg(hdev, "sock %p", sk);
6198
6199         hci_dev_lock(hdev);
6200
6201         if (!hci_discovery_active(hdev)) {
6202                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6203                                         MGMT_STATUS_FAILED, &cp->addr,
6204                                         sizeof(cp->addr));
6205                 goto failed;
6206         }
6207
6208         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6209         if (!e) {
6210                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6211                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6212                                         sizeof(cp->addr));
6213                 goto failed;
6214         }
6215
6216         if (cp->name_known) {
6217                 e->name_state = NAME_KNOWN;
6218                 list_del(&e->list);
6219         } else {
6220                 e->name_state = NAME_NEEDED;
6221                 hci_inquiry_cache_update_resolve(hdev, e);
6222         }
6223
6224         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6225                                 &cp->addr, sizeof(cp->addr));
6226
6227 failed:
6228         hci_dev_unlock(hdev);
6229         return err;
6230 }
6231
6232 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6233                         u16 len)
6234 {
6235         struct mgmt_cp_block_device *cp = data;
6236         u8 status;
6237         int err;
6238
6239         bt_dev_dbg(hdev, "sock %p", sk);
6240
6241         if (!bdaddr_type_is_valid(cp->addr.type))
6242                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6243                                          MGMT_STATUS_INVALID_PARAMS,
6244                                          &cp->addr, sizeof(cp->addr));
6245
6246         hci_dev_lock(hdev);
6247
6248         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6249                                   cp->addr.type);
6250         if (err < 0) {
6251                 status = MGMT_STATUS_FAILED;
6252                 goto done;
6253         }
6254
6255         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6256                    sk);
6257         status = MGMT_STATUS_SUCCESS;
6258
6259 done:
6260         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6261                                 &cp->addr, sizeof(cp->addr));
6262
6263         hci_dev_unlock(hdev);
6264
6265         return err;
6266 }
6267
6268 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6269                           u16 len)
6270 {
6271         struct mgmt_cp_unblock_device *cp = data;
6272         u8 status;
6273         int err;
6274
6275         bt_dev_dbg(hdev, "sock %p", sk);
6276
6277         if (!bdaddr_type_is_valid(cp->addr.type))
6278                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6279                                          MGMT_STATUS_INVALID_PARAMS,
6280                                          &cp->addr, sizeof(cp->addr));
6281
6282         hci_dev_lock(hdev);
6283
6284         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6285                                   cp->addr.type);
6286         if (err < 0) {
6287                 status = MGMT_STATUS_INVALID_PARAMS;
6288                 goto done;
6289         }
6290
6291         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6292                    sk);
6293         status = MGMT_STATUS_SUCCESS;
6294
6295 done:
6296         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6297                                 &cp->addr, sizeof(cp->addr));
6298
6299         hci_dev_unlock(hdev);
6300
6301         return err;
6302 }
6303
6304 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6305 {
6306         return hci_update_eir_sync(hdev);
6307 }
6308
6309 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6310                          u16 len)
6311 {
6312         struct mgmt_cp_set_device_id *cp = data;
6313         int err;
6314         __u16 source;
6315
6316         bt_dev_dbg(hdev, "sock %p", sk);
6317
6318         source = __le16_to_cpu(cp->source);
6319
6320         if (source > 0x0002)
6321                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6322                                        MGMT_STATUS_INVALID_PARAMS);
6323
6324         hci_dev_lock(hdev);
6325
6326         hdev->devid_source = source;
6327         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6328         hdev->devid_product = __le16_to_cpu(cp->product);
6329         hdev->devid_version = __le16_to_cpu(cp->version);
6330
6331         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6332                                 NULL, 0);
6333
6334         hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6335
6336         hci_dev_unlock(hdev);
6337
6338         return err;
6339 }
6340
6341 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6342 {
6343         if (err)
6344                 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6345         else
6346                 bt_dev_dbg(hdev, "status %d", err);
6347 }
6348
6349 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6350 {
6351         struct cmd_lookup match = { NULL, hdev };
6352         u8 instance;
6353         struct adv_info *adv_instance;
6354         u8 status = mgmt_status(err);
6355
6356         if (status) {
6357                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
6358                                      cmd_status_rsp, &status);
6359                 return;
6360         }
6361
6362         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6363                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6364         else
6365                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6366
6367         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
6368                              &match);
6369
6370         new_settings(hdev, match.sk);
6371
6372         if (match.sk)
6373                 sock_put(match.sk);
6374
6375         /* If "Set Advertising" was just disabled and instance advertising was
6376          * set up earlier, then re-enable multi-instance advertising.
6377          */
6378         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6379             list_empty(&hdev->adv_instances))
6380                 return;
6381
6382         instance = hdev->cur_adv_instance;
6383         if (!instance) {
6384                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6385                                                         struct adv_info, list);
6386                 if (!adv_instance)
6387                         return;
6388
6389                 instance = adv_instance->instance;
6390         }
6391
6392         err = hci_schedule_adv_instance_sync(hdev, instance, true);
6393
6394         enable_advertising_instance(hdev, err);
6395 }
6396
6397 static int set_adv_sync(struct hci_dev *hdev, void *data)
6398 {
6399         struct mgmt_pending_cmd *cmd = data;
6400         struct mgmt_mode *cp = cmd->param;
6401         u8 val = !!cp->val;
6402
6403         if (cp->val == 0x02)
6404                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6405         else
6406                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6407
6408         cancel_adv_timeout(hdev);
6409
6410         if (val) {
6411                 /* Switch to instance "0" for the Set Advertising setting.
6412                  * We cannot use update_[adv|scan_rsp]_data() here as the
6413                  * HCI_ADVERTISING flag is not yet set.
6414                  */
6415                 hdev->cur_adv_instance = 0x00;
6416
6417                 if (ext_adv_capable(hdev)) {
6418                         hci_start_ext_adv_sync(hdev, 0x00);
6419                 } else {
6420                         hci_update_adv_data_sync(hdev, 0x00);
6421                         hci_update_scan_rsp_data_sync(hdev, 0x00);
6422                         hci_enable_advertising_sync(hdev);
6423                 }
6424         } else {
6425                 hci_disable_advertising_sync(hdev);
6426         }
6427
6428         return 0;
6429 }
6430
6431 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6432                            u16 len)
6433 {
6434         struct mgmt_mode *cp = data;
6435         struct mgmt_pending_cmd *cmd;
6436         u8 val, status;
6437         int err;
6438
6439         bt_dev_dbg(hdev, "sock %p", sk);
6440
6441         status = mgmt_le_support(hdev);
6442         if (status)
6443                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6444                                        status);
6445
6446         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6447                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6448                                        MGMT_STATUS_INVALID_PARAMS);
6449
6450         if (hdev->advertising_paused)
6451                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6452                                        MGMT_STATUS_BUSY);
6453
6454         hci_dev_lock(hdev);
6455
6456         val = !!cp->val;
6457
6458         /* The following conditions are ones which mean that we should
6459          * not do any HCI communication but directly send a mgmt
6460          * response to user space (after toggling the flag if
6461          * necessary).
6462          */
6463         if (!hdev_is_powered(hdev) ||
6464             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6465              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6466             hci_dev_test_flag(hdev, HCI_MESH) ||
6467             hci_conn_num(hdev, LE_LINK) > 0 ||
6468             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6469              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6470                 bool changed;
6471
6472                 if (cp->val) {
6473                         hdev->cur_adv_instance = 0x00;
6474                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6475                         if (cp->val == 0x02)
6476                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6477                         else
6478                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6479                 } else {
6480                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6481                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6482                 }
6483
6484                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6485                 if (err < 0)
6486                         goto unlock;
6487
6488                 if (changed)
6489                         err = new_settings(hdev, sk);
6490
6491                 goto unlock;
6492         }
6493
6494         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6495             pending_find(MGMT_OP_SET_LE, hdev)) {
6496                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6497                                       MGMT_STATUS_BUSY);
6498                 goto unlock;
6499         }
6500
6501         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6502         if (!cmd)
6503                 err = -ENOMEM;
6504         else
6505                 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6506                                          set_advertising_complete);
6507
6508         if (err < 0 && cmd)
6509                 mgmt_pending_remove(cmd);
6510
6511 unlock:
6512         hci_dev_unlock(hdev);
6513         return err;
6514 }
6515
6516 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6517                               void *data, u16 len)
6518 {
6519         struct mgmt_cp_set_static_address *cp = data;
6520         int err;
6521
6522         bt_dev_dbg(hdev, "sock %p", sk);
6523
6524         if (!lmp_le_capable(hdev))
6525                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6526                                        MGMT_STATUS_NOT_SUPPORTED);
6527
6528         if (hdev_is_powered(hdev))
6529                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6530                                        MGMT_STATUS_REJECTED);
6531
6532         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6533                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6534                         return mgmt_cmd_status(sk, hdev->id,
6535                                                MGMT_OP_SET_STATIC_ADDRESS,
6536                                                MGMT_STATUS_INVALID_PARAMS);
6537
6538                 /* Two most significant bits shall be set */
6539                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6540                         return mgmt_cmd_status(sk, hdev->id,
6541                                                MGMT_OP_SET_STATIC_ADDRESS,
6542                                                MGMT_STATUS_INVALID_PARAMS);
6543         }
6544
6545         hci_dev_lock(hdev);
6546
6547         bacpy(&hdev->static_addr, &cp->bdaddr);
6548
6549         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6550         if (err < 0)
6551                 goto unlock;
6552
6553         err = new_settings(hdev, sk);
6554
6555 unlock:
6556         hci_dev_unlock(hdev);
6557         return err;
6558 }
6559
6560 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6561                            void *data, u16 len)
6562 {
6563         struct mgmt_cp_set_scan_params *cp = data;
6564         __u16 interval, window;
6565         int err;
6566
6567         bt_dev_dbg(hdev, "sock %p", sk);
6568
6569         if (!lmp_le_capable(hdev))
6570                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6571                                        MGMT_STATUS_NOT_SUPPORTED);
6572
6573         interval = __le16_to_cpu(cp->interval);
6574
6575         if (interval < 0x0004 || interval > 0x4000)
6576                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6577                                        MGMT_STATUS_INVALID_PARAMS);
6578
6579         window = __le16_to_cpu(cp->window);
6580
6581         if (window < 0x0004 || window > 0x4000)
6582                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6583                                        MGMT_STATUS_INVALID_PARAMS);
6584
6585         if (window > interval)
6586                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6587                                        MGMT_STATUS_INVALID_PARAMS);
6588
6589         hci_dev_lock(hdev);
6590
6591         hdev->le_scan_interval = interval;
6592         hdev->le_scan_window = window;
6593
6594         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6595                                 NULL, 0);
6596
6597         /* If background scan is running, restart it so new parameters are
6598          * loaded.
6599          */
6600         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6601             hdev->discovery.state == DISCOVERY_STOPPED)
6602                 hci_update_passive_scan(hdev);
6603
6604         hci_dev_unlock(hdev);
6605
6606         return err;
6607 }
6608
6609 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6610 {
6611         struct mgmt_pending_cmd *cmd = data;
6612
6613         bt_dev_dbg(hdev, "err %d", err);
6614
6615         if (err) {
6616                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6617                                 mgmt_status(err));
6618         } else {
6619                 struct mgmt_mode *cp = cmd->param;
6620
6621                 if (cp->val)
6622                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6623                 else
6624                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6625
6626                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6627                 new_settings(hdev, cmd->sk);
6628         }
6629
6630         mgmt_pending_free(cmd);
6631 }
6632
6633 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6634 {
6635         struct mgmt_pending_cmd *cmd = data;
6636         struct mgmt_mode *cp = cmd->param;
6637
6638         return hci_write_fast_connectable_sync(hdev, cp->val);
6639 }
6640
6641 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6642                                 void *data, u16 len)
6643 {
6644         struct mgmt_mode *cp = data;
6645         struct mgmt_pending_cmd *cmd;
6646         int err;
6647
6648         bt_dev_dbg(hdev, "sock %p", sk);
6649
6650         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6651             hdev->hci_ver < BLUETOOTH_VER_1_2)
6652                 return mgmt_cmd_status(sk, hdev->id,
6653                                        MGMT_OP_SET_FAST_CONNECTABLE,
6654                                        MGMT_STATUS_NOT_SUPPORTED);
6655
6656         if (cp->val != 0x00 && cp->val != 0x01)
6657                 return mgmt_cmd_status(sk, hdev->id,
6658                                        MGMT_OP_SET_FAST_CONNECTABLE,
6659                                        MGMT_STATUS_INVALID_PARAMS);
6660
6661         hci_dev_lock(hdev);
6662
6663         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6664                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6665                 goto unlock;
6666         }
6667
6668         if (!hdev_is_powered(hdev)) {
6669                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6670                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6671                 new_settings(hdev, sk);
6672                 goto unlock;
6673         }
6674
6675         cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6676                                len);
6677         if (!cmd)
6678                 err = -ENOMEM;
6679         else
6680                 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6681                                          fast_connectable_complete);
6682
6683         if (err < 0) {
6684                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6685                                 MGMT_STATUS_FAILED);
6686
6687                 if (cmd)
6688                         mgmt_pending_free(cmd);
6689         }
6690
6691 unlock:
6692         hci_dev_unlock(hdev);
6693
6694         return err;
6695 }
6696
6697 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6698 {
6699         struct mgmt_pending_cmd *cmd = data;
6700
6701         bt_dev_dbg(hdev, "err %d", err);
6702
6703         if (err) {
6704                 u8 mgmt_err = mgmt_status(err);
6705
6706                 /* We need to restore the flag if related HCI commands
6707                  * failed.
6708                  */
6709                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6710
6711                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6712         } else {
6713                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6714                 new_settings(hdev, cmd->sk);
6715         }
6716
6717         mgmt_pending_free(cmd);
6718 }
6719
6720 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6721 {
6722         int status;
6723
6724         status = hci_write_fast_connectable_sync(hdev, false);
6725
6726         if (!status)
6727                 status = hci_update_scan_sync(hdev);
6728
6729         /* Since only the advertising data flags will change, there
6730          * is no need to update the scan response data.
6731          */
6732         if (!status)
6733                 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6734
6735         return status;
6736 }
6737
6738 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6739 {
6740         struct mgmt_mode *cp = data;
6741         struct mgmt_pending_cmd *cmd;
6742         int err;
6743
6744         bt_dev_dbg(hdev, "sock %p", sk);
6745
6746         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6747                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6748                                        MGMT_STATUS_NOT_SUPPORTED);
6749
6750         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6751                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6752                                        MGMT_STATUS_REJECTED);
6753
6754         if (cp->val != 0x00 && cp->val != 0x01)
6755                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6756                                        MGMT_STATUS_INVALID_PARAMS);
6757
6758         hci_dev_lock(hdev);
6759
6760         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6761                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6762                 goto unlock;
6763         }
6764
6765         if (!hdev_is_powered(hdev)) {
6766                 if (!cp->val) {
6767                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6768                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6769                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6770                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6771                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
6772                 }
6773
6774                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6775
6776                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6777                 if (err < 0)
6778                         goto unlock;
6779
6780                 err = new_settings(hdev, sk);
6781                 goto unlock;
6782         }
6783
6784         /* Reject disabling when powered on */
6785         if (!cp->val) {
6786                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6787                                       MGMT_STATUS_REJECTED);
6788                 goto unlock;
6789         } else {
6790                 /* When configuring a dual-mode controller to operate
6791                  * with LE only and using a static address, then switching
6792                  * BR/EDR back on is not allowed.
6793                  *
6794                  * Dual-mode controllers shall operate with the public
6795                  * address as its identity address for BR/EDR and LE. So
6796                  * reject the attempt to create an invalid configuration.
6797                  *
6798                  * The same restrictions applies when secure connections
6799                  * has been enabled. For BR/EDR this is a controller feature
6800                  * while for LE it is a host stack feature. This means that
6801                  * switching BR/EDR back on when secure connections has been
6802                  * enabled is not a supported transaction.
6803                  */
6804                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6805                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6806                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6807                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6808                                               MGMT_STATUS_REJECTED);
6809                         goto unlock;
6810                 }
6811         }
6812
6813         cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6814         if (!cmd)
6815                 err = -ENOMEM;
6816         else
6817                 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6818                                          set_bredr_complete);
6819
6820         if (err < 0) {
6821                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6822                                 MGMT_STATUS_FAILED);
6823                 if (cmd)
6824                         mgmt_pending_free(cmd);
6825
6826                 goto unlock;
6827         }
6828
6829         /* We need to flip the bit already here so that
6830          * hci_req_update_adv_data generates the correct flags.
6831          */
6832         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
6833
6834 unlock:
6835         hci_dev_unlock(hdev);
6836         return err;
6837 }
6838
6839 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
6840 {
6841         struct mgmt_pending_cmd *cmd = data;
6842         struct mgmt_mode *cp;
6843
6844         bt_dev_dbg(hdev, "err %d", err);
6845
6846         if (err) {
6847                 u8 mgmt_err = mgmt_status(err);
6848
6849                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
6850                 goto done;
6851         }
6852
6853         cp = cmd->param;
6854
6855         switch (cp->val) {
6856         case 0x00:
6857                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
6858                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6859                 break;
6860         case 0x01:
6861                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6862                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6863                 break;
6864         case 0x02:
6865                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6866                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6867                 break;
6868         }
6869
6870         send_settings_rsp(cmd->sk, cmd->opcode, hdev);
6871         new_settings(hdev, cmd->sk);
6872
6873 done:
6874         mgmt_pending_free(cmd);
6875 }
6876
6877 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
6878 {
6879         struct mgmt_pending_cmd *cmd = data;
6880         struct mgmt_mode *cp = cmd->param;
6881         u8 val = !!cp->val;
6882
6883         /* Force write of val */
6884         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
6885
6886         return hci_write_sc_support_sync(hdev, val);
6887 }
6888
6889 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
6890                            void *data, u16 len)
6891 {
6892         struct mgmt_mode *cp = data;
6893         struct mgmt_pending_cmd *cmd;
6894         u8 val;
6895         int err;
6896
6897         bt_dev_dbg(hdev, "sock %p", sk);
6898
6899         if (!lmp_sc_capable(hdev) &&
6900             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6901                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6902                                        MGMT_STATUS_NOT_SUPPORTED);
6903
6904         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6905             lmp_sc_capable(hdev) &&
6906             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
6907                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6908                                        MGMT_STATUS_REJECTED);
6909
6910         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6911                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6912                                        MGMT_STATUS_INVALID_PARAMS);
6913
6914         hci_dev_lock(hdev);
6915
6916         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
6917             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6918                 bool changed;
6919
6920                 if (cp->val) {
6921                         changed = !hci_dev_test_and_set_flag(hdev,
6922                                                              HCI_SC_ENABLED);
6923                         if (cp->val == 0x02)
6924                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
6925                         else
6926                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6927                 } else {
6928                         changed = hci_dev_test_and_clear_flag(hdev,
6929                                                               HCI_SC_ENABLED);
6930                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
6931                 }
6932
6933                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6934                 if (err < 0)
6935                         goto failed;
6936
6937                 if (changed)
6938                         err = new_settings(hdev, sk);
6939
6940                 goto failed;
6941         }
6942
6943         val = !!cp->val;
6944
6945         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6946             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6947                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
6948                 goto failed;
6949         }
6950
6951         cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6952         if (!cmd)
6953                 err = -ENOMEM;
6954         else
6955                 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
6956                                          set_secure_conn_complete);
6957
6958         if (err < 0) {
6959                 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
6960                                 MGMT_STATUS_FAILED);
6961                 if (cmd)
6962                         mgmt_pending_free(cmd);
6963         }
6964
6965 failed:
6966         hci_dev_unlock(hdev);
6967         return err;
6968 }
6969
6970 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6971                           void *data, u16 len)
6972 {
6973         struct mgmt_mode *cp = data;
6974         bool changed, use_changed;
6975         int err;
6976
6977         bt_dev_dbg(hdev, "sock %p", sk);
6978
6979         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6980                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6981                                        MGMT_STATUS_INVALID_PARAMS);
6982
6983         hci_dev_lock(hdev);
6984
6985         if (cp->val)
6986                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6987         else
6988                 changed = hci_dev_test_and_clear_flag(hdev,
6989                                                       HCI_KEEP_DEBUG_KEYS);
6990
6991         if (cp->val == 0x02)
6992                 use_changed = !hci_dev_test_and_set_flag(hdev,
6993                                                          HCI_USE_DEBUG_KEYS);
6994         else
6995                 use_changed = hci_dev_test_and_clear_flag(hdev,
6996                                                           HCI_USE_DEBUG_KEYS);
6997
6998         if (hdev_is_powered(hdev) && use_changed &&
6999             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7000                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
7001                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
7002                              sizeof(mode), &mode);
7003         }
7004
7005         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
7006         if (err < 0)
7007                 goto unlock;
7008
7009         if (changed)
7010                 err = new_settings(hdev, sk);
7011
7012 unlock:
7013         hci_dev_unlock(hdev);
7014         return err;
7015 }
7016
7017 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7018                        u16 len)
7019 {
7020         struct mgmt_cp_set_privacy *cp = cp_data;
7021         bool changed;
7022         int err;
7023
7024         bt_dev_dbg(hdev, "sock %p", sk);
7025
7026         if (!lmp_le_capable(hdev))
7027                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7028                                        MGMT_STATUS_NOT_SUPPORTED);
7029
7030         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7031                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7032                                        MGMT_STATUS_INVALID_PARAMS);
7033
7034 #ifndef TIZEN_BT
7035         /* commenting out since set privacy command is always rejected
7036          * if this condition is enabled.
7037          */
7038         if (hdev_is_powered(hdev))
7039                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7040                                        MGMT_STATUS_REJECTED);
7041 #endif
7042
7043         hci_dev_lock(hdev);
7044
7045         /* If user space supports this command it is also expected to
7046          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7047          */
7048         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7049
7050         if (cp->privacy) {
7051                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7052                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7053                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7054                 hci_adv_instances_set_rpa_expired(hdev, true);
7055                 if (cp->privacy == 0x02)
7056                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7057                 else
7058                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7059         } else {
7060                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7061                 memset(hdev->irk, 0, sizeof(hdev->irk));
7062                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7063                 hci_adv_instances_set_rpa_expired(hdev, false);
7064                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7065         }
7066
7067         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7068         if (err < 0)
7069                 goto unlock;
7070
7071         if (changed)
7072                 err = new_settings(hdev, sk);
7073
7074 unlock:
7075         hci_dev_unlock(hdev);
7076         return err;
7077 }
7078
7079 static bool irk_is_valid(struct mgmt_irk_info *irk)
7080 {
7081         switch (irk->addr.type) {
7082         case BDADDR_LE_PUBLIC:
7083                 return true;
7084
7085         case BDADDR_LE_RANDOM:
7086                 /* Two most significant bits shall be set */
7087                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7088                         return false;
7089                 return true;
7090         }
7091
7092         return false;
7093 }
7094
7095 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7096                      u16 len)
7097 {
7098         struct mgmt_cp_load_irks *cp = cp_data;
7099         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7100                                    sizeof(struct mgmt_irk_info));
7101         u16 irk_count, expected_len;
7102         int i, err;
7103
7104         bt_dev_dbg(hdev, "sock %p", sk);
7105
7106         if (!lmp_le_capable(hdev))
7107                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7108                                        MGMT_STATUS_NOT_SUPPORTED);
7109
7110         irk_count = __le16_to_cpu(cp->irk_count);
7111         if (irk_count > max_irk_count) {
7112                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7113                            irk_count);
7114                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7115                                        MGMT_STATUS_INVALID_PARAMS);
7116         }
7117
7118         expected_len = struct_size(cp, irks, irk_count);
7119         if (expected_len != len) {
7120                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7121                            expected_len, len);
7122                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7123                                        MGMT_STATUS_INVALID_PARAMS);
7124         }
7125
7126         bt_dev_dbg(hdev, "irk_count %u", irk_count);
7127
7128         for (i = 0; i < irk_count; i++) {
7129                 struct mgmt_irk_info *key = &cp->irks[i];
7130
7131                 if (!irk_is_valid(key))
7132                         return mgmt_cmd_status(sk, hdev->id,
7133                                                MGMT_OP_LOAD_IRKS,
7134                                                MGMT_STATUS_INVALID_PARAMS);
7135         }
7136
7137         hci_dev_lock(hdev);
7138
7139         hci_smp_irks_clear(hdev);
7140
7141         for (i = 0; i < irk_count; i++) {
7142                 struct mgmt_irk_info *irk = &cp->irks[i];
7143                 u8 addr_type = le_addr_type(irk->addr.type);
7144
7145                 if (hci_is_blocked_key(hdev,
7146                                        HCI_BLOCKED_KEY_TYPE_IRK,
7147                                        irk->val)) {
7148                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7149                                     &irk->addr.bdaddr);
7150                         continue;
7151                 }
7152
7153                 /* When using SMP over BR/EDR, the addr type should be set to BREDR */
7154                 if (irk->addr.type == BDADDR_BREDR)
7155                         addr_type = BDADDR_BREDR;
7156
7157                 hci_add_irk(hdev, &irk->addr.bdaddr,
7158                             addr_type, irk->val,
7159                             BDADDR_ANY);
7160         }
7161
7162         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7163
7164         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7165
7166         hci_dev_unlock(hdev);
7167
7168         return err;
7169 }
7170
7171 #ifdef TIZEN_BT
7172 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
7173                         void *data, u16 len)
7174 {
7175         struct mgmt_cp_set_advertising_params *cp = data;
7176         __u16 min_interval;
7177         __u16 max_interval;
7178         int err;
7179
7180         BT_DBG("%s", hdev->name);
7181
7182         if (!lmp_le_capable(hdev))
7183                 return mgmt_cmd_status(sk, hdev->id,
7184                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7185                                 MGMT_STATUS_NOT_SUPPORTED);
7186
7187         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7188                 return mgmt_cmd_status(sk, hdev->id,
7189                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7190                                 MGMT_STATUS_BUSY);
7191
7192         min_interval = __le16_to_cpu(cp->interval_min);
7193         max_interval = __le16_to_cpu(cp->interval_max);
7194
7195         if (min_interval > max_interval ||
7196             min_interval < 0x0020 || max_interval > 0x4000)
7197                 return mgmt_cmd_status(sk, hdev->id,
7198                                 MGMT_OP_SET_ADVERTISING_PARAMS,
7199                                 MGMT_STATUS_INVALID_PARAMS);
7200
7201         hci_dev_lock(hdev);
7202
7203         hdev->le_adv_min_interval = min_interval;
7204         hdev->le_adv_max_interval = max_interval;
7205         hdev->adv_filter_policy = cp->filter_policy;
7206         hdev->adv_type = cp->type;
7207
7208         err = mgmt_cmd_complete(sk, hdev->id,
7209                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
7210
7211         hci_dev_unlock(hdev);
7212
7213         return err;
7214 }
7215
7216 static void set_advertising_data_complete(struct hci_dev *hdev,
7217                         u8 status, u16 opcode)
7218 {
7219         struct mgmt_cp_set_advertising_data *cp;
7220         struct mgmt_pending_cmd *cmd;
7221
7222         BT_DBG("status 0x%02x", status);
7223
7224         hci_dev_lock(hdev);
7225
7226         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
7227         if (!cmd)
7228                 goto unlock;
7229
7230         cp = cmd->param;
7231
7232         if (status)
7233                 mgmt_cmd_status(cmd->sk, hdev->id,
7234                                 MGMT_OP_SET_ADVERTISING_DATA,
7235                                 mgmt_status(status));
7236         else
7237                 mgmt_cmd_complete(cmd->sk, hdev->id,
7238                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
7239                                 cp, sizeof(*cp));
7240
7241         mgmt_pending_remove(cmd);
7242
7243 unlock:
7244         hci_dev_unlock(hdev);
7245 }
7246
7247 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
7248                         void *data, u16 len)
7249 {
7250         struct mgmt_pending_cmd *cmd;
7251         struct hci_request req;
7252         struct mgmt_cp_set_advertising_data *cp = data;
7253         struct hci_cp_le_set_adv_data adv;
7254         int err;
7255
7256         BT_DBG("%s", hdev->name);
7257
7258         if (!lmp_le_capable(hdev)) {
7259                 return mgmt_cmd_status(sk, hdev->id,
7260                                 MGMT_OP_SET_ADVERTISING_DATA,
7261                                 MGMT_STATUS_NOT_SUPPORTED);
7262         }
7263
7264         hci_dev_lock(hdev);
7265
7266         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
7267                 err = mgmt_cmd_status(sk, hdev->id,
7268                                 MGMT_OP_SET_ADVERTISING_DATA,
7269                                 MGMT_STATUS_BUSY);
7270                 goto unlocked;
7271         }
7272
7273         if (len > HCI_MAX_AD_LENGTH) {
7274                 err = mgmt_cmd_status(sk, hdev->id,
7275                                 MGMT_OP_SET_ADVERTISING_DATA,
7276                                 MGMT_STATUS_INVALID_PARAMS);
7277                 goto unlocked;
7278         }
7279
7280         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
7281                                hdev, data, len);
7282         if (!cmd) {
7283                 err = -ENOMEM;
7284                 goto unlocked;
7285         }
7286
7287         hci_req_init(&req, hdev);
7288
7289         memset(&adv, 0, sizeof(adv));
7290         memcpy(adv.data, cp->data, len);
7291         adv.length = len;
7292
7293         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
7294
7295         err = hci_req_run(&req, set_advertising_data_complete);
7296         if (err < 0)
7297                 mgmt_pending_remove(cmd);
7298
7299 unlocked:
7300         hci_dev_unlock(hdev);
7301
7302         return err;
7303 }
7304
7305 /* Adv White List feature */
7306 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7307 {
7308         struct mgmt_cp_add_dev_white_list *cp;
7309         struct mgmt_pending_cmd *cmd;
7310
7311         BT_DBG("status 0x%02x", status);
7312
7313         hci_dev_lock(hdev);
7314
7315         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
7316         if (!cmd)
7317                 goto unlock;
7318
7319         cp = cmd->param;
7320
7321         if (status)
7322                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7323                            mgmt_status(status));
7324         else
7325                 mgmt_cmd_complete(cmd->sk, hdev->id,
7326                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
7327
7328         mgmt_pending_remove(cmd);
7329
7330 unlock:
7331         hci_dev_unlock(hdev);
7332 }
7333
7334 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
7335                            void *data, u16 len)
7336 {
7337         struct mgmt_pending_cmd *cmd;
7338         struct mgmt_cp_add_dev_white_list *cp = data;
7339         struct hci_request req;
7340         int err;
7341
7342         BT_DBG("%s", hdev->name);
7343
7344         if (!lmp_le_capable(hdev))
7345                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7346                                   MGMT_STATUS_NOT_SUPPORTED);
7347
7348         if (!hdev_is_powered(hdev))
7349                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7350                                   MGMT_STATUS_REJECTED);
7351
7352         hci_dev_lock(hdev);
7353
7354         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
7355                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
7356                                 MGMT_STATUS_BUSY);
7357                 goto unlocked;
7358         }
7359
7360         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
7361         if (!cmd) {
7362                 err = -ENOMEM;
7363                 goto unlocked;
7364         }
7365
7366         hci_req_init(&req, hdev);
7367
7368         hci_req_add(&req, HCI_OP_LE_ADD_TO_ACCEPT_LIST, sizeof(*cp), cp);
7369
7370         err = hci_req_run(&req, add_white_list_complete);
7371         if (err < 0) {
7372                 mgmt_pending_remove(cmd);
7373                 goto unlocked;
7374         }
7375
7376 unlocked:
7377         hci_dev_unlock(hdev);
7378
7379         return err;
7380 }
7381
7382 static void remove_from_white_list_complete(struct hci_dev *hdev,
7383                         u8 status, u16 opcode)
7384 {
7385         struct mgmt_cp_remove_dev_from_white_list *cp;
7386         struct mgmt_pending_cmd *cmd;
7387
7388         BT_DBG("status 0x%02x", status);
7389
7390         hci_dev_lock(hdev);
7391
7392         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
7393         if (!cmd)
7394                 goto unlock;
7395
7396         cp = cmd->param;
7397
7398         if (status)
7399                 mgmt_cmd_status(cmd->sk, hdev->id,
7400                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7401                         mgmt_status(status));
7402         else
7403                 mgmt_cmd_complete(cmd->sk, hdev->id,
7404                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
7405                         cp, sizeof(*cp));
7406
7407         mgmt_pending_remove(cmd);
7408
7409 unlock:
7410         hci_dev_unlock(hdev);
7411 }
7412
7413 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
7414                            void *data, u16 len)
7415 {
7416         struct mgmt_pending_cmd *cmd;
7417         struct mgmt_cp_remove_dev_from_white_list *cp = data;
7418         struct hci_request req;
7419         int err;
7420
7421         BT_DBG("%s", hdev->name);
7422
7423         if (!lmp_le_capable(hdev))
7424                 return mgmt_cmd_status(sk, hdev->id,
7425                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7426                                 MGMT_STATUS_NOT_SUPPORTED);
7427
7428         if (!hdev_is_powered(hdev))
7429                 return mgmt_cmd_status(sk, hdev->id,
7430                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7431                                 MGMT_STATUS_REJECTED);
7432
7433         hci_dev_lock(hdev);
7434
7435         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
7436                 err = mgmt_cmd_status(sk, hdev->id,
7437                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7438                                 MGMT_STATUS_BUSY);
7439                 goto unlocked;
7440         }
7441
7442         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
7443                                 hdev, data, len);
7444         if (!cmd) {
7445                 err = -ENOMEM;
7446                 goto unlocked;
7447         }
7448
7449         hci_req_init(&req, hdev);
7450
7451         hci_req_add(&req, HCI_OP_LE_DEL_FROM_ACCEPT_LIST, sizeof(*cp), cp);
7452
7453         err = hci_req_run(&req, remove_from_white_list_complete);
7454         if (err < 0) {
7455                 mgmt_pending_remove(cmd);
7456                 goto unlocked;
7457         }
7458
7459 unlocked:
7460         hci_dev_unlock(hdev);
7461
7462         return err;
7463 }
7464
7465 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
7466                         u16 opcode)
7467 {
7468         struct mgmt_pending_cmd *cmd;
7469
7470         BT_DBG("status 0x%02x", status);
7471
7472         hci_dev_lock(hdev);
7473
7474         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
7475         if (!cmd)
7476                 goto unlock;
7477
7478         if (status)
7479                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7480                            mgmt_status(status));
7481         else
7482                 mgmt_cmd_complete(cmd->sk, hdev->id,
7483                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7484                                 0, NULL, 0);
7485
7486         mgmt_pending_remove(cmd);
7487
7488 unlock:
7489         hci_dev_unlock(hdev);
7490 }
7491
7492 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
7493                            void *data, u16 len)
7494 {
7495         struct mgmt_pending_cmd *cmd;
7496         struct hci_request req;
7497         int err;
7498
7499         BT_DBG("%s", hdev->name);
7500
7501         if (!lmp_le_capable(hdev))
7502                 return mgmt_cmd_status(sk, hdev->id,
7503                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7504                                 MGMT_STATUS_NOT_SUPPORTED);
7505
7506         if (!hdev_is_powered(hdev))
7507                 return mgmt_cmd_status(sk, hdev->id,
7508                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7509                                 MGMT_STATUS_REJECTED);
7510
7511         hci_dev_lock(hdev);
7512
7513         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
7514                 err = mgmt_cmd_status(sk, hdev->id,
7515                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
7516                                 MGMT_STATUS_BUSY);
7517                 goto unlocked;
7518         }
7519
7520         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
7521                                 hdev, NULL, 0);
7522         if (!cmd) {
7523                 err = -ENOMEM;
7524                 goto unlocked;
7525         }
7526
7527         hci_req_init(&req, hdev);
7528
7529         hci_req_add(&req, HCI_OP_LE_CLEAR_ACCEPT_LIST, 0, NULL);
7530
7531         err = hci_req_run(&req, clear_white_list_complete);
7532         if (err < 0) {
7533                 mgmt_pending_remove(cmd);
7534                 goto unlocked;
7535         }
7536
7537 unlocked:
7538         hci_dev_unlock(hdev);
7539
7540         return err;
7541 }
7542
7543 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
7544                         u16 opcode)
7545 {
7546         struct mgmt_cp_set_scan_rsp_data *cp;
7547         struct mgmt_pending_cmd *cmd;
7548
7549         BT_DBG("status 0x%02x", status);
7550
7551         hci_dev_lock(hdev);
7552
7553         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
7554         if (!cmd)
7555                 goto unlock;
7556
7557         cp = cmd->param;
7558
7559         if (status)
7560                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7561                                 mgmt_status(status));
7562         else
7563                 mgmt_cmd_complete(cmd->sk, hdev->id,
7564                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
7565                                 cp, sizeof(*cp));
7566
7567         mgmt_pending_remove(cmd);
7568
7569 unlock:
7570         hci_dev_unlock(hdev);
7571 }
7572
7573 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
7574                         u16 len)
7575 {
7576         struct mgmt_pending_cmd *cmd;
7577         struct hci_request req;
7578         struct mgmt_cp_set_scan_rsp_data *cp = data;
7579         struct hci_cp_le_set_scan_rsp_data rsp;
7580         int err;
7581
7582         BT_DBG("%s", hdev->name);
7583
7584         if (!lmp_le_capable(hdev))
7585                 return mgmt_cmd_status(sk, hdev->id,
7586                                 MGMT_OP_SET_SCAN_RSP_DATA,
7587                                 MGMT_STATUS_NOT_SUPPORTED);
7588
7589         hci_dev_lock(hdev);
7590
7591         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
7592                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7593                                 MGMT_STATUS_BUSY);
7594                 goto unlocked;
7595         }
7596
7597         if (len > HCI_MAX_AD_LENGTH) {
7598                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
7599                                 MGMT_STATUS_INVALID_PARAMS);
7600                 goto unlocked;
7601         }
7602
7603         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
7604         if (!cmd) {
7605                 err = -ENOMEM;
7606                 goto unlocked;
7607         }
7608
7609         hci_req_init(&req, hdev);
7610
7611         memset(&rsp, 0, sizeof(rsp));
7612         memcpy(rsp.data, cp->data, len);
7613         rsp.length = len;
7614
7615         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
7616
7617         err = hci_req_run(&req, set_scan_rsp_data_complete);
7618         if (err < 0)
7619                 mgmt_pending_remove(cmd);
7620
7621 unlocked:
7622         hci_dev_unlock(hdev);
7623
7624         return err;
7625 }
7626
7627 static void set_rssi_threshold_complete(struct hci_dev *hdev,
7628                         u8 status, u16 opcode)
7629 {
7630         struct mgmt_pending_cmd *cmd;
7631
7632         BT_DBG("status 0x%02x", status);
7633
7634         hci_dev_lock(hdev);
7635
7636         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7637         if (!cmd)
7638                 goto unlock;
7639
7640         if (status)
7641                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7642                                 mgmt_status(status));
7643         else
7644                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7645                                 NULL, 0);
7646
7647         mgmt_pending_remove(cmd);
7648
7649 unlock:
7650         hci_dev_unlock(hdev);
7651 }
7652
7653 static void set_rssi_disable_complete(struct hci_dev *hdev,
7654                         u8 status, u16 opcode)
7655 {
7656         struct mgmt_pending_cmd *cmd;
7657
7658         BT_DBG("status 0x%02x", status);
7659
7660         hci_dev_lock(hdev);
7661
7662         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7663         if (!cmd)
7664                 goto unlock;
7665
7666         if (status)
7667                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7668                                 mgmt_status(status));
7669         else
7670                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7671                                 0, NULL, 0);
7672
7673         mgmt_pending_remove(cmd);
7674
7675 unlock:
7676         hci_dev_unlock(hdev);
7677 }
7678
7679 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
7680                 void *data, u16 len)
7681 {
7682         int err = 0;
7683         struct hci_cp_set_rssi_threshold th = { 0, };
7684         struct mgmt_cp_set_enable_rssi *cp = data;
7685         struct hci_conn *conn;
7686         struct mgmt_pending_cmd *cmd;
7687         struct hci_request req;
7688         __u8 dest_type;
7689
7690         hci_dev_lock(hdev);
7691
7692         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7693         if (!cmd) {
7694                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7695                                 MGMT_STATUS_FAILED);
7696                 goto unlocked;
7697         }
7698
7699         if (!lmp_le_capable(hdev)) {
7700                 mgmt_pending_remove(cmd);
7701                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7702                                 MGMT_STATUS_NOT_SUPPORTED);
7703                 goto unlocked;
7704         }
7705
7706         if (!hdev_is_powered(hdev)) {
7707                 BT_DBG("%s", hdev->name);
7708                 mgmt_pending_remove(cmd);
7709                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7710                                 MGMT_STATUS_NOT_POWERED);
7711                 goto unlocked;
7712         }
7713
7714         if (cp->link_type == 0x01)
7715                 dest_type = LE_LINK;
7716         else
7717                 dest_type = ACL_LINK;
7718
7719         /* Get LE/ACL link handle info */
7720         conn = hci_conn_hash_lookup_ba(hdev,
7721                         dest_type, &cp->bdaddr);
7722
7723         if (!conn) {
7724                 err = mgmt_cmd_complete(sk, hdev->id,
7725                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
7726                 mgmt_pending_remove(cmd);
7727                 goto unlocked;
7728         }
7729
7730         hci_req_init(&req, hdev);
7731
7732         th.hci_le_ext_opcode = 0x0B;
7733         th.mode = 0x01;
7734         th.conn_handle = conn->handle;
7735         th.alert_mask = 0x07;
7736         th.low_th = cp->low_th;
7737         th.in_range_th = cp->in_range_th;
7738         th.high_th = cp->high_th;
7739
7740         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7741         err = hci_req_run(&req, set_rssi_threshold_complete);
7742
7743         if (err < 0) {
7744                 mgmt_pending_remove(cmd);
7745                 BT_ERR("Error in requesting hci_req_run");
7746                 goto unlocked;
7747         }
7748
7749 unlocked:
7750         hci_dev_unlock(hdev);
7751         return err;
7752 }
7753
7754 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
7755                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7756 {
7757         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
7758         struct mgmt_cp_set_enable_rssi *cp = data;
7759         struct mgmt_pending_cmd *cmd;
7760
7761         if (!cp || !rp)
7762                 goto remove_cmd;
7763
7764         mgmt_rp.status = rp->status;
7765         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7766         mgmt_rp.bt_address = cp->bdaddr;
7767         mgmt_rp.link_type = cp->link_type;
7768
7769         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7770                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7771                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7772
7773         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
7774                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7775
7776         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
7777         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7778                         &mgmt_rp.bt_address, true);
7779
7780 remove_cmd:
7781         hci_dev_lock(hdev);
7782         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7783         if (cmd)
7784                 mgmt_pending_remove(cmd);
7785
7786         hci_dev_unlock(hdev);
7787 }
7788
7789 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
7790                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
7791 {
7792         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
7793         struct mgmt_cp_disable_rssi *cp = data;
7794         struct mgmt_pending_cmd *cmd;
7795
7796         if (!cp || !rp)
7797                 goto remove_cmd;
7798
7799         mgmt_rp.status = rp->status;
7800         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
7801         mgmt_rp.bt_address = cp->bdaddr;
7802         mgmt_rp.link_type = cp->link_type;
7803
7804         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7805                         MGMT_STATUS_SUCCESS, &mgmt_rp,
7806                         sizeof(struct mgmt_cc_rsp_enable_rssi));
7807
7808         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
7809                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
7810
7811         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
7812                         &mgmt_rp.bt_address, false);
7813
7814 remove_cmd:
7815         hci_dev_lock(hdev);
7816         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7817         if (cmd)
7818                 mgmt_pending_remove(cmd);
7819
7820         hci_dev_unlock(hdev);
7821 }
7822
7823 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
7824                 void *data, u16 len)
7825 {
7826         struct mgmt_pending_cmd *cmd;
7827         struct hci_request req;
7828         struct hci_cp_set_enable_rssi cp_en = { 0, };
7829         int err;
7830
7831         BT_DBG("Set Disable RSSI.");
7832
7833         cp_en.hci_le_ext_opcode = 0x01;
7834         cp_en.le_enable_cs_Features = 0x00;
7835         cp_en.data[0] = 0x00;
7836         cp_en.data[1] = 0x00;
7837         cp_en.data[2] = 0x00;
7838
7839         hci_dev_lock(hdev);
7840
7841         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7842         if (!cmd) {
7843                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7844                                 MGMT_STATUS_FAILED);
7845                 goto unlocked;
7846         }
7847
7848         if (!lmp_le_capable(hdev)) {
7849                 mgmt_pending_remove(cmd);
7850                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7851                                 MGMT_STATUS_NOT_SUPPORTED);
7852                 goto unlocked;
7853         }
7854
7855         if (!hdev_is_powered(hdev)) {
7856                 BT_DBG("%s", hdev->name);
7857                 mgmt_pending_remove(cmd);
7858                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7859                                 MGMT_STATUS_NOT_POWERED);
7860                 goto unlocked;
7861         }
7862
7863         hci_req_init(&req, hdev);
7864
7865         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7866                         sizeof(struct hci_cp_set_enable_rssi),
7867                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7868                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7869
7870         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7871         err = hci_req_run(&req, set_rssi_disable_complete);
7872
7873         if (err < 0) {
7874                 mgmt_pending_remove(cmd);
7875                 BT_ERR("Error in requesting hci_req_run");
7876                 goto unlocked;
7877         }
7878
7879 unlocked:
7880         hci_dev_unlock(hdev);
7881         return err;
7882 }
7883
7884 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
7885 {
7886         struct hci_cc_rsp_enable_rssi *rp = response;
7887         struct mgmt_pending_cmd *cmd_enable = NULL;
7888         struct mgmt_pending_cmd *cmd_disable = NULL;
7889         struct mgmt_cp_set_enable_rssi *cp_en;
7890         struct mgmt_cp_disable_rssi *cp_dis;
7891
7892         hci_dev_lock(hdev);
7893         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7894         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7895         hci_dev_unlock(hdev);
7896
7897         if (cmd_enable)
7898                 BT_DBG("Enable Request");
7899
7900         if (cmd_disable)
7901                 BT_DBG("Disable Request");
7902
7903         if (cmd_enable) {
7904                 cp_en = cmd_enable->param;
7905
7906                 if (status != 0x00)
7907                         return;
7908
7909                 switch (rp->le_ext_opcode) {
7910                 case 0x01:
7911                         BT_DBG("RSSI enabled.. Setting Threshold...");
7912                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
7913                                         cp_en, sizeof(*cp_en));
7914                         break;
7915
7916                 case 0x0B:
7917                         BT_DBG("Sending RSSI enable success");
7918                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
7919                                         cp_en, rp, rp->status);
7920                         break;
7921                 }
7922
7923         } else if (cmd_disable) {
7924                 cp_dis = cmd_disable->param;
7925
7926                 if (status != 0x00)
7927                         return;
7928
7929                 switch (rp->le_ext_opcode) {
7930                 case 0x01:
7931                         BT_DBG("Sending RSSI disable success");
7932                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7933                                         cp_dis, rp, rp->status);
7934                         break;
7935
7936                 case 0x0B:
7937                         /*
7938                          * Only unset RSSI Threshold values for the Link if
7939                          * RSSI is monitored for other BREDR or LE Links
7940                          */
7941                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
7942                                 BT_DBG("Unset Threshold. Other links being monitored");
7943                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
7944                                                 cp_dis, rp, rp->status);
7945                         } else {
7946                                 BT_DBG("Unset Threshold. Disabling...");
7947                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
7948                                                 cp_dis, sizeof(*cp_dis));
7949                         }
7950                         break;
7951                 }
7952         }
7953 }
7954
7955 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
7956                 u16 opcode)
7957 {
7958         struct mgmt_pending_cmd *cmd;
7959
7960         BT_DBG("status 0x%02x", status);
7961
7962         hci_dev_lock(hdev);
7963
7964         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7965         if (!cmd)
7966                 goto unlock;
7967
7968         if (status)
7969                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7970                                 mgmt_status(status));
7971         else
7972                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7973                                 NULL, 0);
7974
7975         mgmt_pending_remove(cmd);
7976
7977 unlock:
7978         hci_dev_unlock(hdev);
7979 }
7980
7981 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7982                 void *data, u16 len)
7983 {
7984         struct mgmt_pending_cmd *cmd;
7985         struct hci_request req;
7986         struct mgmt_cp_set_enable_rssi *cp = data;
7987         struct hci_cp_set_enable_rssi cp_en = { 0, };
7988         int err;
7989
7990         BT_DBG("Set Enable RSSI.");
7991
7992         cp_en.hci_le_ext_opcode = 0x01;
7993         cp_en.le_enable_cs_Features = 0x04;
7994         cp_en.data[0] = 0x00;
7995         cp_en.data[1] = 0x00;
7996         cp_en.data[2] = 0x00;
7997
7998         hci_dev_lock(hdev);
7999
8000         if (!lmp_le_capable(hdev)) {
8001                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
8002                                 MGMT_STATUS_NOT_SUPPORTED);
8003                 goto unlocked;
8004         }
8005
8006         if (!hdev_is_powered(hdev)) {
8007                 BT_DBG("%s", hdev->name);
8008                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
8009                                 MGMT_STATUS_NOT_POWERED);
8010                 goto unlocked;
8011         }
8012
8013         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
8014                 BT_DBG("%s", hdev->name);
8015                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
8016                                 MGMT_STATUS_BUSY);
8017                 goto unlocked;
8018         }
8019
8020         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
8021                         sizeof(*cp));
8022         if (!cmd) {
8023                 BT_DBG("%s", hdev->name);
8024                 err = -ENOMEM;
8025                 goto unlocked;
8026         }
8027
8028         /* If RSSI is already enabled directly set Threshold values */
8029         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
8030                 hci_dev_unlock(hdev);
8031                 BT_DBG("RSSI Enabled. Directly set Threshold");
8032                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
8033                 return err;
8034         }
8035
8036         hci_req_init(&req, hdev);
8037
8038         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
8039                         sizeof(struct hci_cp_set_enable_rssi),
8040                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
8041                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
8042
8043         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
8044         err = hci_req_run(&req, set_rssi_enable_complete);
8045
8046         if (err < 0) {
8047                 mgmt_pending_remove(cmd);
8048                 BT_ERR("Error in requesting hci_req_run");
8049                 goto unlocked;
8050         }
8051
8052 unlocked:
8053         hci_dev_unlock(hdev);
8054
8055         return err;
8056 }
8057
8058 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8059 {
8060         struct mgmt_pending_cmd *cmd;
8061
8062         BT_DBG("status 0x%02x", status);
8063
8064         hci_dev_lock(hdev);
8065
8066         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
8067         if (!cmd)
8068                 goto unlock;
8069
8070         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8071                         MGMT_STATUS_SUCCESS, &status, 1);
8072
8073         mgmt_pending_remove(cmd);
8074
8075 unlock:
8076         hci_dev_unlock(hdev);
8077 }
8078
8079 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
8080                         u16 len)
8081 {
8082         struct mgmt_pending_cmd *cmd;
8083         struct hci_request req;
8084         struct mgmt_cp_get_raw_rssi *cp = data;
8085         struct hci_cp_get_raw_rssi hci_cp;
8086
8087         struct hci_conn *conn;
8088         int err;
8089         __u8 dest_type;
8090
8091         BT_DBG("Get Raw RSSI.");
8092
8093         hci_dev_lock(hdev);
8094
8095         if (!lmp_le_capable(hdev)) {
8096                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8097                                 MGMT_STATUS_NOT_SUPPORTED);
8098                 goto unlocked;
8099         }
8100
8101         if (cp->link_type == 0x01)
8102                 dest_type = LE_LINK;
8103         else
8104                 dest_type = ACL_LINK;
8105
8106         /* Get LE/BREDR link handle info */
8107         conn = hci_conn_hash_lookup_ba(hdev,
8108                         dest_type, &cp->bt_address);
8109         if (!conn) {
8110                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8111                                                    MGMT_STATUS_NOT_CONNECTED);
8112                 goto unlocked;
8113         }
8114         hci_cp.conn_handle = conn->handle;
8115
8116         if (!hdev_is_powered(hdev)) {
8117                 BT_DBG("%s", hdev->name);
8118                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8119                                 MGMT_STATUS_NOT_POWERED);
8120                 goto unlocked;
8121         }
8122
8123         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
8124                 BT_DBG("%s", hdev->name);
8125                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
8126                                 MGMT_STATUS_BUSY);
8127                 goto unlocked;
8128         }
8129
8130         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
8131         if (!cmd) {
8132                 BT_DBG("%s", hdev->name);
8133                 err = -ENOMEM;
8134                 goto unlocked;
8135         }
8136
8137         hci_req_init(&req, hdev);
8138
8139         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
8140         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
8141         err = hci_req_run(&req, get_raw_rssi_complete);
8142
8143         if (err < 0) {
8144                 mgmt_pending_remove(cmd);
8145                 BT_ERR("Error in requesting hci_req_run");
8146         }
8147
8148 unlocked:
8149         hci_dev_unlock(hdev);
8150
8151         return err;
8152 }
8153
8154 void mgmt_raw_rssi_response(struct hci_dev *hdev,
8155                 struct hci_cc_rp_get_raw_rssi *rp, int success)
8156 {
8157         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
8158         struct hci_conn *conn;
8159
8160         mgmt_rp.status = rp->status;
8161         mgmt_rp.rssi_dbm = rp->rssi_dbm;
8162
8163         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
8164         if (!conn)
8165                 return;
8166
8167         bacpy(&mgmt_rp.bt_address, &conn->dst);
8168         if (conn->type == LE_LINK)
8169                 mgmt_rp.link_type = 0x01;
8170         else
8171                 mgmt_rp.link_type = 0x00;
8172
8173         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
8174                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
8175 }
8176
8177 static void set_disable_threshold_complete(struct hci_dev *hdev,
8178                         u8 status, u16 opcode)
8179 {
8180         struct mgmt_pending_cmd *cmd;
8181
8182         BT_DBG("status 0x%02x", status);
8183
8184         hci_dev_lock(hdev);
8185
8186         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
8187         if (!cmd)
8188                 goto unlock;
8189
8190         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8191                         MGMT_STATUS_SUCCESS, &status, 1);
8192
8193         mgmt_pending_remove(cmd);
8194
8195 unlock:
8196         hci_dev_unlock(hdev);
8197 }
8198
8199 /** Removes monitoring for a link*/
8200 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
8201                 void *data, u16 len)
8202 {
8203         int err = 0;
8204         struct hci_cp_set_rssi_threshold th = { 0, };
8205         struct mgmt_cp_disable_rssi *cp = data;
8206         struct hci_conn *conn;
8207         struct mgmt_pending_cmd *cmd;
8208         struct hci_request req;
8209         __u8 dest_type;
8210
8211         BT_DBG("Set Disable RSSI.");
8212
8213         hci_dev_lock(hdev);
8214
8215         if (!lmp_le_capable(hdev)) {
8216                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8217                                 MGMT_STATUS_NOT_SUPPORTED);
8218                 goto unlocked;
8219         }
8220
8221         /* Get LE/ACL link handle info*/
8222         if (cp->link_type == 0x01)
8223                 dest_type = LE_LINK;
8224         else
8225                 dest_type = ACL_LINK;
8226
8227         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
8228         if (!conn) {
8229                 err = mgmt_cmd_complete(sk, hdev->id,
8230                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
8231                 goto unlocked;
8232         }
8233
8234         th.hci_le_ext_opcode = 0x0B;
8235         th.mode = 0x01;
8236         th.conn_handle = conn->handle;
8237         th.alert_mask = 0x00;
8238         th.low_th = 0x00;
8239         th.in_range_th = 0x00;
8240         th.high_th = 0x00;
8241
8242         if (!hdev_is_powered(hdev)) {
8243                 BT_DBG("%s", hdev->name);
8244                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8245                                 0, data, len);
8246                 goto unlocked;
8247         }
8248
8249         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
8250                 BT_DBG("%s", hdev->name);
8251                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
8252                                 MGMT_STATUS_BUSY);
8253                 goto unlocked;
8254         }
8255
8256         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
8257                         sizeof(*cp));
8258         if (!cmd) {
8259                 BT_DBG("%s", hdev->name);
8260                 err = -ENOMEM;
8261                 goto unlocked;
8262         }
8263
8264         hci_req_init(&req, hdev);
8265
8266         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
8267         err = hci_req_run(&req, set_disable_threshold_complete);
8268         if (err < 0) {
8269                 mgmt_pending_remove(cmd);
8270                 BT_ERR("Error in requesting hci_req_run");
8271                 goto unlocked;
8272         }
8273
8274 unlocked:
8275         hci_dev_unlock(hdev);
8276
8277         return err;
8278 }
8279
8280 void mgmt_rssi_alert_evt(struct hci_dev *hdev, u16 conn_handle,
8281                 s8 alert_type, s8 rssi_dbm)
8282 {
8283         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
8284         struct hci_conn *conn;
8285
8286         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
8287                         conn_handle, alert_type, rssi_dbm);
8288
8289         conn = hci_conn_hash_lookup_handle(hdev, conn_handle);
8290
8291         if (!conn) {
8292                 BT_ERR("RSSI alert Error: Device not found for handle");
8293                 return;
8294         }
8295         bacpy(&mgmt_ev.bdaddr, &conn->dst);
8296
8297         if (conn->type == LE_LINK)
8298                 mgmt_ev.link_type = 0x01;
8299         else
8300                 mgmt_ev.link_type = 0x00;
8301
8302         mgmt_ev.alert_type = alert_type;
8303         mgmt_ev.rssi_dbm = rssi_dbm;
8304
8305         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
8306                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
8307                         NULL);
8308 }
8309
8310 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
8311 {
8312         struct mgmt_pending_cmd *cmd;
8313         u8 type;
8314         int err;
8315
8316         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
8317
8318         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
8319         if (!cmd)
8320                 return -ENOENT;
8321
8322         type = hdev->le_discovery.type;
8323
8324         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
8325                                 mgmt_status(status), &type, sizeof(type));
8326         mgmt_pending_remove(cmd);
8327
8328         return err;
8329 }
8330
8331 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
8332                 u16 opcode)
8333 {
8334         unsigned long timeout = 0;
8335
8336         BT_DBG("status %d", status);
8337
8338         if (status) {
8339                 hci_dev_lock(hdev);
8340                 mgmt_start_le_discovery_failed(hdev, status);
8341                 hci_dev_unlock(hdev);
8342                 return;
8343         }
8344
8345         hci_dev_lock(hdev);
8346         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
8347         hci_dev_unlock(hdev);
8348
8349         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
8350                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
8351
8352         if (!timeout)
8353                 return;
8354
8355         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
8356 }
8357
8358 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
8359                 void *data, u16 len)
8360 {
8361         struct mgmt_cp_start_le_discovery *cp = data;
8362         struct mgmt_pending_cmd *cmd;
8363         struct hci_cp_le_set_scan_param param_cp;
8364         struct hci_cp_le_set_scan_enable enable_cp;
8365         struct hci_request req;
8366         u8 status, own_addr_type;
8367         int err;
8368
8369         BT_DBG("%s", hdev->name);
8370
8371         if (!hdev_is_powered(hdev)) {
8372                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8373                                 MGMT_STATUS_NOT_POWERED);
8374                 goto unlock;
8375         }
8376
8377         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
8378                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8379                                 MGMT_STATUS_BUSY);
8380                 goto unlock;
8381         }
8382
8383         if (cp->type != DISCOV_TYPE_LE) {
8384                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8385                                 MGMT_STATUS_INVALID_PARAMS);
8386                 goto unlock;
8387         }
8388
8389         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
8390         if (!cmd) {
8391                 err = -ENOMEM;
8392                 goto unlock;
8393         }
8394
8395         hdev->le_discovery.type = cp->type;
8396
8397         hci_req_init(&req, hdev);
8398
8399         status = mgmt_le_support(hdev);
8400         if (status) {
8401                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8402                                 status);
8403                 mgmt_pending_remove(cmd);
8404                 goto unlock;
8405         }
8406
8407         /* If controller is scanning, it means the background scanning
8408          * is running. Thus, we should temporarily stop it in order to
8409          * set the discovery scanning parameters.
8410          */
8411         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
8412                 hci_req_add_le_scan_disable(&req, false);
8413
8414         memset(&param_cp, 0, sizeof(param_cp));
8415
8416         /* All active scans will be done with either a resolvable
8417          * private address (when privacy feature has been enabled)
8418          * or unresolvable private address.
8419          */
8420         err = hci_update_random_address_sync(hdev, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
8421         if (err < 0) {
8422                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
8423                                 MGMT_STATUS_FAILED);
8424                 mgmt_pending_remove(cmd);
8425                 goto unlock;
8426         }
8427
8428         param_cp.type = hdev->le_scan_type;
8429         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
8430         param_cp.window = cpu_to_le16(hdev->le_scan_window);
8431         param_cp.own_address_type = own_addr_type;
8432         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
8433                     &param_cp);
8434
8435         memset(&enable_cp, 0, sizeof(enable_cp));
8436         enable_cp.enable = LE_SCAN_ENABLE;
8437         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
8438
8439         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
8440                     &enable_cp);
8441
8442         err = hci_req_run(&req, start_le_discovery_complete);
8443         if (err < 0)
8444                 mgmt_pending_remove(cmd);
8445         else
8446                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
8447
8448 unlock:
8449         return err;
8450 }
8451
8452 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
8453 {
8454         struct mgmt_pending_cmd *cmd;
8455         int err;
8456
8457         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
8458         if (!cmd)
8459                 return -ENOENT;
8460
8461         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
8462                                 mgmt_status(status), &hdev->le_discovery.type,
8463                                 sizeof(hdev->le_discovery.type));
8464         mgmt_pending_remove(cmd);
8465
8466         return err;
8467 }
8468
8469 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
8470                 u16 opcode)
8471 {
8472         BT_DBG("status %d", status);
8473
8474         hci_dev_lock(hdev);
8475
8476         if (status) {
8477                 mgmt_stop_le_discovery_failed(hdev, status);
8478                 goto unlock;
8479         }
8480
8481         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
8482
8483 unlock:
8484         hci_dev_unlock(hdev);
8485 }
8486
8487 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
8488                 void *data, u16 len)
8489 {
8490         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
8491         struct mgmt_pending_cmd *cmd;
8492         struct hci_request req;
8493         int err;
8494
8495         BT_DBG("%s", hdev->name);
8496
8497         hci_dev_lock(hdev);
8498
8499         if (!hci_le_discovery_active(hdev)) {
8500                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8501                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
8502                                         sizeof(mgmt_cp->type));
8503                 goto unlock;
8504         }
8505
8506         if (hdev->le_discovery.type != mgmt_cp->type) {
8507                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8508                                         MGMT_STATUS_INVALID_PARAMS,
8509                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
8510                 goto unlock;
8511         }
8512
8513         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
8514         if (!cmd) {
8515                 err = -ENOMEM;
8516                 goto unlock;
8517         }
8518
8519         hci_req_init(&req, hdev);
8520
8521         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
8522                 BT_DBG("unknown le discovery state %u",
8523                                         hdev->le_discovery.state);
8524
8525                 mgmt_pending_remove(cmd);
8526                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
8527                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
8528                                         sizeof(mgmt_cp->type));
8529                 goto unlock;
8530         }
8531
8532         cancel_delayed_work(&hdev->le_scan_disable);
8533         hci_req_add_le_scan_disable(&req, false);
8534
8535         err = hci_req_run(&req, stop_le_discovery_complete);
8536         if (err < 0)
8537                 mgmt_pending_remove(cmd);
8538         else
8539                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
8540
8541 unlock:
8542         hci_dev_unlock(hdev);
8543         return err;
8544 }
8545
8546 /* Separate LE discovery */
8547 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
8548 {
8549         struct mgmt_ev_discovering ev;
8550         struct mgmt_pending_cmd *cmd;
8551
8552         BT_DBG("%s le discovering %u", hdev->name, discovering);
8553
8554         if (discovering)
8555                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
8556         else
8557                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
8558
8559         if (cmd) {
8560                 u8 type = hdev->le_discovery.type;
8561
8562                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
8563                                   sizeof(type));
8564                 mgmt_pending_remove(cmd);
8565         }
8566
8567         memset(&ev, 0, sizeof(ev));
8568         ev.type = hdev->le_discovery.type;
8569         ev.discovering = discovering;
8570
8571         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8572 }
8573
8574 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
8575                         void *data, u16 len)
8576 {
8577         int err;
8578
8579         BT_DBG("%s", hdev->name);
8580
8581         hci_dev_lock(hdev);
8582
8583         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
8584         if (err < 0)
8585                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
8586
8587         hci_dev_unlock(hdev);
8588
8589         return err;
8590 }
8591
8592 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
8593                 u16 to_multiplier)
8594 {
8595         u16 max_latency;
8596
8597         if (min > max || min < 6 || max > 3200)
8598                 return -EINVAL;
8599
8600         if (to_multiplier < 10 || to_multiplier > 3200)
8601                 return -EINVAL;
8602
8603         if (max >= to_multiplier * 8)
8604                 return -EINVAL;
8605
8606         max_latency = (to_multiplier * 8 / max) - 1;
8607
8608         if (latency > 499 || latency > max_latency)
8609                 return -EINVAL;
8610
8611         return 0;
8612 }
8613
8614 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
8615                 u16 len)
8616 {
8617         struct mgmt_cp_le_conn_update *cp = data;
8618
8619         struct hci_conn *conn;
8620         u16 min, max, latency, supervision_timeout;
8621         int err = -1;
8622
8623         if (!hdev_is_powered(hdev))
8624                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8625                                 MGMT_STATUS_NOT_POWERED);
8626
8627         min = __le16_to_cpu(cp->conn_interval_min);
8628         max = __le16_to_cpu(cp->conn_interval_max);
8629         latency = __le16_to_cpu(cp->conn_latency);
8630         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
8631
8632         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
8633                         min, max, latency, supervision_timeout);
8634
8635         err = check_le_conn_update_param(min, max, latency,
8636                         supervision_timeout);
8637
8638         if (err < 0)
8639                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8640                                 MGMT_STATUS_INVALID_PARAMS);
8641
8642         hci_dev_lock(hdev);
8643
8644         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
8645         if (!conn) {
8646                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
8647                                 MGMT_STATUS_NOT_CONNECTED);
8648                 hci_dev_unlock(hdev);
8649                 return err;
8650         }
8651
8652         hci_dev_unlock(hdev);
8653
8654         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
8655
8656         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
8657                                  NULL, 0);
8658 }
8659
8660 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
8661                 u16 opcode)
8662 {
8663         struct mgmt_cp_set_manufacturer_data *cp;
8664         struct mgmt_pending_cmd *cmd;
8665
8666         BT_DBG("status 0x%02x", status);
8667
8668         hci_dev_lock(hdev);
8669
8670         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
8671         if (!cmd)
8672                 goto unlock;
8673
8674         cp = cmd->param;
8675
8676         if (status)
8677                 mgmt_cmd_status(cmd->sk, hdev->id,
8678                                 MGMT_OP_SET_MANUFACTURER_DATA,
8679                                 mgmt_status(status));
8680         else
8681                 mgmt_cmd_complete(cmd->sk, hdev->id,
8682                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
8683                                   cp, sizeof(*cp));
8684
8685         mgmt_pending_remove(cmd);
8686
8687 unlock:
8688         hci_dev_unlock(hdev);
8689 }
8690
8691 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
8692                 void *data, u16 len)
8693 {
8694         struct mgmt_pending_cmd *cmd;
8695         struct hci_request req;
8696         struct mgmt_cp_set_manufacturer_data *cp = data;
8697         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
8698         u8 old_len;
8699         int err;
8700
8701         BT_DBG("%s", hdev->name);
8702
8703         if (!lmp_bredr_capable(hdev))
8704                 return mgmt_cmd_status(sk, hdev->id,
8705                                 MGMT_OP_SET_MANUFACTURER_DATA,
8706                                 MGMT_STATUS_NOT_SUPPORTED);
8707
8708         if (cp->data[0] == 0 ||
8709                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
8710                 return mgmt_cmd_status(sk, hdev->id,
8711                                 MGMT_OP_SET_MANUFACTURER_DATA,
8712                                 MGMT_STATUS_INVALID_PARAMS);
8713
8714         if (cp->data[1] != 0xFF)
8715                 return mgmt_cmd_status(sk, hdev->id,
8716                                 MGMT_OP_SET_MANUFACTURER_DATA,
8717                                 MGMT_STATUS_NOT_SUPPORTED);
8718
8719         hci_dev_lock(hdev);
8720
8721         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
8722                 err = mgmt_cmd_status(sk, hdev->id,
8723                                 MGMT_OP_SET_MANUFACTURER_DATA,
8724                                 MGMT_STATUS_BUSY);
8725                 goto unlocked;
8726         }
8727
8728         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
8729                         len);
8730         if (!cmd) {
8731                 err = -ENOMEM;
8732                 goto unlocked;
8733         }
8734
8735         hci_req_init(&req, hdev);
8736
8737         /* if new data is same as previous data then return command
8738          * complete event
8739          */
8740         if (hdev->manufacturer_len == cp->data[0] - 1 &&
8741             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
8742                 mgmt_pending_remove(cmd);
8743                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
8744                                   0, cp, sizeof(*cp));
8745                 err = 0;
8746                 goto unlocked;
8747         }
8748
8749         old_len = hdev->manufacturer_len;
8750         if (old_len > 0)
8751                 memcpy(old_data, hdev->manufacturer_data, old_len);
8752
8753         hdev->manufacturer_len = cp->data[0] - 1;
8754         if (hdev->manufacturer_len > 0)
8755                 memcpy(hdev->manufacturer_data, cp->data + 2,
8756                                 hdev->manufacturer_len);
8757
8758         hci_update_eir_sync(hdev);
8759
8760         err = hci_req_run(&req, set_manufacturer_data_complete);
8761         if (err < 0) {
8762                 mgmt_pending_remove(cmd);
8763                 goto failed;
8764         }
8765
8766 unlocked:
8767         hci_dev_unlock(hdev);
8768
8769         return err;
8770
8771 failed:
8772         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
8773         hdev->manufacturer_len = old_len;
8774         if (hdev->manufacturer_len > 0)
8775                 memcpy(hdev->manufacturer_data, old_data,
8776                        hdev->manufacturer_len);
8777         hci_dev_unlock(hdev);
8778         return err;
8779 }
8780
8781 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
8782                 void *data, u16 len)
8783 {
8784         struct mgmt_cp_le_set_scan_params *cp = data;
8785         __u16 interval, window;
8786         int err;
8787
8788         BT_DBG("%s", hdev->name);
8789
8790         if (!lmp_le_capable(hdev))
8791                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8792                                 MGMT_STATUS_NOT_SUPPORTED);
8793
8794         interval = __le16_to_cpu(cp->interval);
8795
8796         if (interval < 0x0004 || interval > 0x4000)
8797                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8798                                 MGMT_STATUS_INVALID_PARAMS);
8799
8800         window = __le16_to_cpu(cp->window);
8801
8802         if (window < 0x0004 || window > 0x4000)
8803                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8804                                 MGMT_STATUS_INVALID_PARAMS);
8805
8806         if (window > interval)
8807                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
8808                                 MGMT_STATUS_INVALID_PARAMS);
8809
8810         hci_dev_lock(hdev);
8811
8812         hdev->le_scan_type = cp->type;
8813         hdev->le_scan_interval = interval;
8814         hdev->le_scan_window = window;
8815
8816         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
8817                                 NULL, 0);
8818
8819         /* If background scan is running, restart it so new parameters are
8820          * loaded.
8821          */
8822         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
8823             hdev->discovery.state == DISCOVERY_STOPPED) {
8824                 struct hci_request req;
8825
8826                 hci_req_init(&req, hdev);
8827
8828                 hci_req_add_le_scan_disable(&req, false);
8829                 hci_req_add_le_passive_scan(&req);
8830
8831                 hci_req_run(&req, NULL);
8832         }
8833
8834         hci_dev_unlock(hdev);
8835
8836         return err;
8837 }
8838
8839 static int set_voice_setting(struct sock *sk, struct hci_dev *hdev,
8840                 void *data, u16 len)
8841 {
8842         struct mgmt_cp_set_voice_setting *cp = data;
8843         struct hci_conn *conn;
8844         struct hci_conn *sco_conn;
8845
8846         int err;
8847
8848         BT_DBG("%s", hdev->name);
8849
8850         if (!lmp_bredr_capable(hdev)) {
8851                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING,
8852                                 MGMT_STATUS_NOT_SUPPORTED);
8853         }
8854
8855         hci_dev_lock(hdev);
8856
8857         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
8858         if (!conn) {
8859                 err = mgmt_cmd_complete(sk, hdev->id,
8860                                 MGMT_OP_SET_VOICE_SETTING, 0, NULL, 0);
8861                 goto unlock;
8862         }
8863
8864         conn->voice_setting = cp->voice_setting;
8865         conn->sco_role = cp->sco_role;
8866
8867         sco_conn = hci_conn_hash_lookup_sco(hdev);
8868         if (sco_conn && bacmp(&sco_conn->dst, &cp->bdaddr) != 0) {
8869                 BT_ERR("There is other SCO connection.");
8870                 goto done;
8871         }
8872
8873         if (conn->sco_role == MGMT_SCO_ROLE_HANDSFREE) {
8874                 if (conn->voice_setting == 0x0063)
8875                         sco_connect_set_wbc(hdev);
8876                 else
8877                         sco_connect_set_nbc(hdev);
8878         } else {
8879                 if (conn->voice_setting == 0x0063)
8880                         sco_connect_set_gw_wbc(hdev);
8881                 else
8882                         sco_connect_set_gw_nbc(hdev);
8883         }
8884
8885 done:
8886         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
8887                         cp, sizeof(cp));
8888
8889 unlock:
8890         hci_dev_unlock(hdev);
8891         return err;
8892 }
8893
8894 static int get_adv_tx_power(struct sock *sk, struct hci_dev *hdev,
8895                 void *data, u16 len)
8896 {
8897         struct mgmt_rp_get_adv_tx_power *rp;
8898         size_t rp_len;
8899         int err;
8900
8901         BT_DBG("%s", hdev->name);
8902
8903         hci_dev_lock(hdev);
8904
8905         rp_len = sizeof(*rp);
8906         rp = kmalloc(rp_len, GFP_KERNEL);
8907         if (!rp) {
8908                 err = -ENOMEM;
8909                 goto unlock;
8910         }
8911
8912         rp->adv_tx_power = hdev->adv_tx_power;
8913
8914         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_TX_POWER, 0, rp,
8915                                 rp_len);
8916
8917         kfree(rp);
8918
8919 unlock:
8920         hci_dev_unlock(hdev);
8921
8922         return err;
8923 }
8924
8925 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
8926 {
8927         struct mgmt_ev_hardware_error ev;
8928
8929         ev.error_code = err_code;
8930         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
8931 }
8932
8933 void mgmt_tx_timeout_error(struct hci_dev *hdev)
8934 {
8935         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
8936 }
8937
8938 void mgmt_multi_adv_state_change_evt(struct hci_dev *hdev, u8 adv_instance,
8939                 u8 state_change_reason, u16 connection_handle)
8940 {
8941         struct mgmt_ev_vendor_specific_multi_adv_state_changed mgmt_ev;
8942
8943         BT_DBG("Multi adv state changed [%2.2X %2.2X %2.2X]",
8944                adv_instance, state_change_reason, connection_handle);
8945
8946         mgmt_ev.adv_instance = adv_instance;
8947         mgmt_ev.state_change_reason = state_change_reason;
8948         mgmt_ev.connection_handle = connection_handle;
8949
8950         mgmt_event(MGMT_EV_MULTI_ADV_STATE_CHANGED, hdev, &mgmt_ev,
8951                 sizeof(struct mgmt_ev_vendor_specific_multi_adv_state_changed),
8952                 NULL);
8953 }
8954
8955 static int enable_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8956                 void *data, u16 len)
8957 {
8958         int err;
8959         struct mgmt_cp_enable_6lowpan *cp = data;
8960
8961         BT_DBG("%s", hdev->name);
8962
8963         hci_dev_lock(hdev);
8964
8965         if (!hdev_is_powered(hdev)) {
8966                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8967                                       MGMT_STATUS_NOT_POWERED);
8968                 goto unlocked;
8969         }
8970
8971         if (!lmp_le_capable(hdev)) {
8972                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8973                                       MGMT_STATUS_NOT_SUPPORTED);
8974                 goto unlocked;
8975         }
8976
8977         if (cp->enable_6lowpan)
8978                 bt_6lowpan_enable();
8979         else
8980                 bt_6lowpan_disable();
8981
8982         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ENABLE_6LOWPAN,
8983                                 MGMT_STATUS_SUCCESS, NULL, 0);
8984 unlocked:
8985         hci_dev_unlock(hdev);
8986         return err;
8987 }
8988
8989 static int connect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
8990                 void *data, u16 len)
8991 {
8992         struct mgmt_cp_connect_6lowpan *cp = data;
8993         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
8994         int err;
8995
8996         BT_DBG("%s", hdev->name);
8997
8998         hci_dev_lock(hdev);
8999
9000         if (!lmp_le_capable(hdev)) {
9001                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
9002                                       MGMT_STATUS_NOT_SUPPORTED);
9003                 goto unlocked;
9004         }
9005
9006         if (!hdev_is_powered(hdev)) {
9007                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
9008                                       MGMT_STATUS_REJECTED);
9009                 goto unlocked;
9010         }
9011
9012         if (bdaddr_type_is_le(cp->addr.type)) {
9013                 if (cp->addr.type == BDADDR_LE_PUBLIC)
9014                         addr_type = ADDR_LE_DEV_PUBLIC;
9015                 else
9016                         addr_type = ADDR_LE_DEV_RANDOM;
9017         } else {
9018                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
9019                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
9020                 goto unlocked;
9021         }
9022
9023         hci_dev_unlock(hdev);
9024
9025         /* 6lowpan Connect */
9026         err = _bt_6lowpan_connect(&cp->addr.bdaddr, cp->addr.type);
9027
9028         hci_dev_lock(hdev);
9029
9030         if (err < 0) {
9031                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN,
9032                                         MGMT_STATUS_REJECTED, NULL, 0);
9033
9034                 goto unlocked;
9035         }
9036
9037         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
9038                                 NULL, 0);
9039 unlocked:
9040         hci_dev_unlock(hdev);
9041         return err;
9042 }
9043
9044 static int disconnect_bt_6lowpan(struct sock *sk, struct hci_dev *hdev,
9045                 void *data, u16 len)
9046 {
9047         struct mgmt_cp_disconnect_6lowpan *cp = data;
9048         struct hci_conn *conn = NULL;
9049         __u8 addr_type = ADDR_LE_DEV_PUBLIC;
9050         int err;
9051
9052         BT_DBG("%s", hdev->name);
9053
9054         hci_dev_lock(hdev);
9055
9056         if (!lmp_le_capable(hdev)) {
9057                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
9058                                       MGMT_STATUS_NOT_SUPPORTED);
9059                 goto unlocked;
9060         }
9061
9062         if (!hdev_is_powered(hdev)) {
9063                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT_6LOWPAN,
9064                                       MGMT_STATUS_REJECTED);
9065                 goto unlocked;
9066         }
9067
9068         if (bdaddr_type_is_le(cp->addr.type)) {
9069                 if (cp->addr.type == BDADDR_LE_PUBLIC)
9070                         addr_type = ADDR_LE_DEV_PUBLIC;
9071                 else
9072                         addr_type = ADDR_LE_DEV_RANDOM;
9073         } else {
9074                 err = mgmt_cmd_complete(sk, hdev->id,
9075                                         MGMT_OP_DISCONNECT_6LOWPAN,
9076                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
9077                 goto unlocked;
9078         }
9079
9080         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
9081         if (!conn) {
9082                 err = mgmt_cmd_complete(sk, hdev->id,
9083                                         MGMT_OP_DISCONNECT_6LOWPAN,
9084                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
9085                 goto unlocked;
9086         }
9087
9088         if (conn->dst_type != addr_type) {
9089                 err = mgmt_cmd_complete(sk, hdev->id,
9090                                         MGMT_OP_DISCONNECT_6LOWPAN,
9091                                         MGMT_STATUS_INVALID_PARAMS, NULL, 0);
9092                 goto unlocked;
9093         }
9094
9095         if (conn->state != BT_CONNECTED) {
9096                 err = mgmt_cmd_complete(sk, hdev->id,
9097                                         MGMT_OP_DISCONNECT_6LOWPAN,
9098                                         MGMT_STATUS_NOT_CONNECTED, NULL, 0);
9099                 goto unlocked;
9100         }
9101
9102         /* 6lowpan Disconnect */
9103         err = _bt_6lowpan_disconnect(conn->l2cap_data, cp->addr.type);
9104         if (err < 0) {
9105                 err = mgmt_cmd_complete(sk, hdev->id,
9106                                         MGMT_OP_DISCONNECT_6LOWPAN,
9107                                         MGMT_STATUS_REJECTED, NULL, 0);
9108                 goto unlocked;
9109         }
9110
9111         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONNECT_6LOWPAN, 0,
9112                                 NULL, 0);
9113
9114 unlocked:
9115         hci_dev_unlock(hdev);
9116         return err;
9117 }
9118
9119 void mgmt_6lowpan_conn_changed(struct hci_dev *hdev, char if_name[16],
9120                 bdaddr_t *bdaddr, u8 addr_type, bool connected)
9121 {
9122         char buf[512];
9123         struct mgmt_ev_6lowpan_conn_state_changed *ev = (void *)buf;
9124         size_t ev_size;
9125
9126         memset(buf, 0, sizeof(buf));
9127         bacpy(&ev->addr.bdaddr, bdaddr);
9128         ev->addr.type = addr_type;
9129         ev->connected = connected;
9130         memcpy(ev->ifname, (__u8 *)if_name, 16);
9131
9132         ev_size = sizeof(*ev);
9133
9134         mgmt_event(MGMT_EV_6LOWPAN_CONN_STATE_CHANGED, hdev, ev, ev_size, NULL);
9135 }
9136
9137 void mgmt_le_read_maximum_data_length_complete(struct hci_dev *hdev, u8 status)
9138 {
9139         struct mgmt_pending_cmd *cmd;
9140         struct mgmt_rp_le_read_maximum_data_length rp;
9141
9142         BT_DBG("%s status %u", hdev->name, status);
9143
9144         cmd = pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev);
9145         if (!cmd)
9146                 return;
9147
9148         if (status)
9149                 mgmt_cmd_status(cmd->sk, hdev->id,
9150                                 MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9151                                 mgmt_status(status));
9152
9153         memset(&rp, 0, sizeof(rp));
9154
9155         rp.max_tx_octets = cpu_to_le16(hdev->le_max_tx_len);
9156         rp.max_tx_time = cpu_to_le16(hdev->le_max_tx_time);
9157         rp.max_rx_octets = cpu_to_le16(hdev->le_max_rx_len);
9158         rp.max_rx_time = cpu_to_le16(hdev->le_max_rx_time);
9159
9160         mgmt_cmd_complete(cmd->sk, hdev->id,
9161                           MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, 0,
9162                           &rp, sizeof(rp));
9163
9164         mgmt_pending_remove(cmd);
9165 }
9166
9167 static int read_maximum_le_data_length(struct sock *sk,
9168                 struct hci_dev *hdev, void *data, u16 len)
9169 {
9170         struct mgmt_pending_cmd *cmd;
9171         int err;
9172
9173         BT_DBG("read_maximum_le_data_length  %s", hdev->name);
9174
9175         hci_dev_lock(hdev);
9176
9177         if (!hdev_is_powered(hdev)) {
9178                 err = mgmt_cmd_status(sk, hdev->id,
9179                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9180                                       MGMT_STATUS_NOT_POWERED);
9181                 goto unlock;
9182         }
9183
9184         if (!lmp_le_capable(hdev)) {
9185                 err = mgmt_cmd_status(sk, hdev->id,
9186                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9187                                       MGMT_STATUS_NOT_SUPPORTED);
9188                 goto unlock;
9189         }
9190
9191         if (pending_find(MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH, hdev)) {
9192                 err = mgmt_cmd_status(sk, hdev->id,
9193                                       MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9194                                       MGMT_STATUS_BUSY);
9195                 goto unlock;
9196         }
9197
9198         cmd = mgmt_pending_add(sk, MGMT_OP_LE_READ_MAXIMUM_DATA_LENGTH,
9199                                hdev, data, len);
9200         if (!cmd) {
9201                 err = -ENOMEM;
9202                 goto unlock;
9203         }
9204
9205         err = hci_send_cmd(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
9206         if (err < 0)
9207                 mgmt_pending_remove(cmd);
9208
9209 unlock:
9210         hci_dev_unlock(hdev);
9211         return err;
9212 }
9213
9214 void mgmt_le_write_host_suggested_data_length_complete(struct hci_dev *hdev,
9215                 u8 status)
9216 {
9217         struct mgmt_pending_cmd *cmd;
9218
9219         BT_DBG("status 0x%02x", status);
9220
9221         hci_dev_lock(hdev);
9222
9223         cmd = pending_find(MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH, hdev);
9224         if (!cmd) {
9225                 BT_ERR("cmd not found in the pending list");
9226                 goto unlock;
9227         }
9228
9229         if (status)
9230                 mgmt_cmd_status(cmd->sk, hdev->id,
9231                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9232                                 mgmt_status(status));
9233         else
9234                 mgmt_cmd_complete(cmd->sk, hdev->id,
9235                                   MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9236                                   0, NULL, 0);
9237
9238         mgmt_pending_remove(cmd);
9239
9240 unlock:
9241         hci_dev_unlock(hdev);
9242 }
9243
9244 static int write_host_suggested_le_data_length(struct sock *sk,
9245                 struct hci_dev *hdev, void *data, u16 len)
9246 {
9247         struct mgmt_pending_cmd *cmd;
9248         struct mgmt_cp_le_write_host_suggested_data_length *cp = data;
9249         struct hci_cp_le_write_def_data_len hci_data;
9250         int err = 0;
9251
9252         BT_DBG("Write host suggested data length request for %s", hdev->name);
9253
9254         hci_dev_lock(hdev);
9255
9256         if (!hdev_is_powered(hdev)) {
9257                 err = mgmt_cmd_status(sk, hdev->id,
9258                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9259                                 MGMT_STATUS_NOT_POWERED);
9260                 goto unlock;
9261         }
9262
9263         if (!lmp_le_capable(hdev)) {
9264                 err = mgmt_cmd_status(sk, hdev->id,
9265                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9266                                 MGMT_STATUS_NOT_SUPPORTED);
9267                 goto unlock;
9268         }
9269
9270         if (pending_find(MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH, hdev)) {
9271                 err = mgmt_cmd_status(sk, hdev->id,
9272                                 MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9273                                 MGMT_STATUS_BUSY);
9274                 goto unlock;
9275         }
9276
9277         cmd = mgmt_pending_add(sk, MGMT_OP_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH,
9278                                hdev, data, len);
9279         if (!cmd) {
9280                 err = -ENOMEM;
9281                 goto unlock;
9282         }
9283
9284         hci_data.tx_len = cp->def_tx_octets;
9285         hci_data.tx_time = cp->def_tx_time;
9286
9287         err = hci_send_cmd(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN,
9288                            sizeof(hci_data), &hci_data);
9289         if (err < 0)
9290                 mgmt_pending_remove(cmd);
9291
9292 unlock:
9293         hci_dev_unlock(hdev);
9294
9295         return err;
9296 }
9297 #endif /* TIZEN_BT */
9298
9299 static bool ltk_is_valid(struct mgmt_ltk_info *key)
9300 {
9301         if (key->initiator != 0x00 && key->initiator != 0x01)
9302                 return false;
9303
9304         switch (key->addr.type) {
9305         case BDADDR_LE_PUBLIC:
9306                 return true;
9307
9308         case BDADDR_LE_RANDOM:
9309                 /* Two most significant bits shall be set */
9310                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
9311                         return false;
9312                 return true;
9313         }
9314
9315         return false;
9316 }
9317
9318 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
9319                                void *cp_data, u16 len)
9320 {
9321         struct mgmt_cp_load_long_term_keys *cp = cp_data;
9322         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
9323                                    sizeof(struct mgmt_ltk_info));
9324         u16 key_count, expected_len;
9325         int i, err;
9326
9327         bt_dev_dbg(hdev, "sock %p", sk);
9328
9329         if (!lmp_le_capable(hdev))
9330                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
9331                                        MGMT_STATUS_NOT_SUPPORTED);
9332
9333         key_count = __le16_to_cpu(cp->key_count);
9334         if (key_count > max_key_count) {
9335                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
9336                            key_count);
9337                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
9338                                        MGMT_STATUS_INVALID_PARAMS);
9339         }
9340
9341         expected_len = struct_size(cp, keys, key_count);
9342         if (expected_len != len) {
9343                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
9344                            expected_len, len);
9345                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
9346                                        MGMT_STATUS_INVALID_PARAMS);
9347         }
9348
9349         bt_dev_dbg(hdev, "key_count %u", key_count);
9350
9351         for (i = 0; i < key_count; i++) {
9352                 struct mgmt_ltk_info *key = &cp->keys[i];
9353
9354                 if (!ltk_is_valid(key))
9355                         return mgmt_cmd_status(sk, hdev->id,
9356                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
9357                                                MGMT_STATUS_INVALID_PARAMS);
9358         }
9359
9360         hci_dev_lock(hdev);
9361
9362         hci_smp_ltks_clear(hdev);
9363
9364         for (i = 0; i < key_count; i++) {
9365                 struct mgmt_ltk_info *key = &cp->keys[i];
9366                 u8 type, authenticated;
9367                 u8 addr_type = le_addr_type(key->addr.type);
9368
9369                 if (hci_is_blocked_key(hdev,
9370                                        HCI_BLOCKED_KEY_TYPE_LTK,
9371                                        key->val)) {
9372                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
9373                                     &key->addr.bdaddr);
9374                         continue;
9375                 }
9376
9377                 switch (key->type) {
9378                 case MGMT_LTK_UNAUTHENTICATED:
9379                         authenticated = 0x00;
9380                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
9381                         break;
9382                 case MGMT_LTK_AUTHENTICATED:
9383                         authenticated = 0x01;
9384                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
9385                         break;
9386                 case MGMT_LTK_P256_UNAUTH:
9387                         authenticated = 0x00;
9388                         type = SMP_LTK_P256;
9389                         break;
9390                 case MGMT_LTK_P256_AUTH:
9391                         authenticated = 0x01;
9392                         type = SMP_LTK_P256;
9393                         break;
9394                 case MGMT_LTK_P256_DEBUG:
9395                         authenticated = 0x00;
9396                         type = SMP_LTK_P256_DEBUG;
9397                         fallthrough;
9398                 default:
9399                         continue;
9400                 }
9401
9402                 /* When using SMP over BR/EDR, the addr type should be set to BREDR */
9403                 if (key->addr.type == BDADDR_BREDR)
9404                         addr_type = BDADDR_BREDR;
9405
9406                 hci_add_ltk(hdev, &key->addr.bdaddr,
9407                             addr_type, type, authenticated,
9408                             key->val, key->enc_size, key->ediv, key->rand);
9409         }
9410
9411         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
9412                            NULL, 0);
9413
9414         hci_dev_unlock(hdev);
9415
9416         return err;
9417 }
9418
9419 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
9420 {
9421         struct mgmt_pending_cmd *cmd = data;
9422         struct hci_conn *conn = cmd->user_data;
9423         struct mgmt_cp_get_conn_info *cp = cmd->param;
9424         struct mgmt_rp_get_conn_info rp;
9425         u8 status;
9426
9427         bt_dev_dbg(hdev, "err %d", err);
9428
9429         memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
9430
9431         status = mgmt_status(err);
9432         if (status == MGMT_STATUS_SUCCESS) {
9433                 rp.rssi = conn->rssi;
9434                 rp.tx_power = conn->tx_power;
9435                 rp.max_tx_power = conn->max_tx_power;
9436         } else {
9437                 rp.rssi = HCI_RSSI_INVALID;
9438                 rp.tx_power = HCI_TX_POWER_INVALID;
9439                 rp.max_tx_power = HCI_TX_POWER_INVALID;
9440         }
9441
9442         mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
9443                           &rp, sizeof(rp));
9444
9445         mgmt_pending_free(cmd);
9446 }
9447
9448 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
9449 {
9450         struct mgmt_pending_cmd *cmd = data;
9451         struct mgmt_cp_get_conn_info *cp = cmd->param;
9452         struct hci_conn *conn;
9453         int err;
9454         __le16   handle;
9455
9456         /* Make sure we are still connected */
9457         if (cp->addr.type == BDADDR_BREDR)
9458                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
9459                                                &cp->addr.bdaddr);
9460         else
9461                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
9462
9463         if (!conn || conn->state != BT_CONNECTED)
9464                 return MGMT_STATUS_NOT_CONNECTED;
9465
9466         cmd->user_data = conn;
9467         handle = cpu_to_le16(conn->handle);
9468
9469         /* Refresh RSSI each time */
9470         err = hci_read_rssi_sync(hdev, handle);
9471
9472         /* For LE links TX power does not change thus we don't need to
9473          * query for it once value is known.
9474          */
9475         if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
9476                      conn->tx_power == HCI_TX_POWER_INVALID))
9477                 err = hci_read_tx_power_sync(hdev, handle, 0x00);
9478
9479         /* Max TX power needs to be read only once per connection */
9480         if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
9481                 err = hci_read_tx_power_sync(hdev, handle, 0x01);
9482
9483         return err;
9484 }
9485
9486 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
9487                          u16 len)
9488 {
9489         struct mgmt_cp_get_conn_info *cp = data;
9490         struct mgmt_rp_get_conn_info rp;
9491         struct hci_conn *conn;
9492         unsigned long conn_info_age;
9493         int err = 0;
9494
9495         bt_dev_dbg(hdev, "sock %p", sk);
9496
9497         memset(&rp, 0, sizeof(rp));
9498         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
9499         rp.addr.type = cp->addr.type;
9500
9501         if (!bdaddr_type_is_valid(cp->addr.type))
9502                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9503                                          MGMT_STATUS_INVALID_PARAMS,
9504                                          &rp, sizeof(rp));
9505
9506         hci_dev_lock(hdev);
9507
9508         if (!hdev_is_powered(hdev)) {
9509                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9510                                         MGMT_STATUS_NOT_POWERED, &rp,
9511                                         sizeof(rp));
9512                 goto unlock;
9513         }
9514
9515         if (cp->addr.type == BDADDR_BREDR)
9516                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
9517                                                &cp->addr.bdaddr);
9518         else
9519                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
9520
9521         if (!conn || conn->state != BT_CONNECTED) {
9522                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9523                                         MGMT_STATUS_NOT_CONNECTED, &rp,
9524                                         sizeof(rp));
9525                 goto unlock;
9526         }
9527
9528         /* To avoid client trying to guess when to poll again for information we
9529          * calculate conn info age as random value between min/max set in hdev.
9530          */
9531         conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age,
9532                                                  hdev->conn_info_max_age - 1);
9533
9534         /* Query controller to refresh cached values if they are too old or were
9535          * never read.
9536          */
9537         if (time_after(jiffies, conn->conn_info_timestamp +
9538                        msecs_to_jiffies(conn_info_age)) ||
9539             !conn->conn_info_timestamp) {
9540                 struct mgmt_pending_cmd *cmd;
9541
9542                 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
9543                                        len);
9544                 if (!cmd) {
9545                         err = -ENOMEM;
9546                 } else {
9547                         err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
9548                                                  cmd, get_conn_info_complete);
9549                 }
9550
9551                 if (err < 0) {
9552                         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9553                                           MGMT_STATUS_FAILED, &rp, sizeof(rp));
9554
9555                         if (cmd)
9556                                 mgmt_pending_free(cmd);
9557
9558                         goto unlock;
9559                 }
9560
9561                 conn->conn_info_timestamp = jiffies;
9562         } else {
9563                 /* Cache is valid, just reply with values cached in hci_conn */
9564                 rp.rssi = conn->rssi;
9565                 rp.tx_power = conn->tx_power;
9566                 rp.max_tx_power = conn->max_tx_power;
9567
9568                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
9569                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9570         }
9571
9572 unlock:
9573         hci_dev_unlock(hdev);
9574         return err;
9575 }
9576
9577 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
9578 {
9579         struct mgmt_pending_cmd *cmd = data;
9580         struct mgmt_cp_get_clock_info *cp = cmd->param;
9581         struct mgmt_rp_get_clock_info rp;
9582         struct hci_conn *conn = cmd->user_data;
9583         u8 status = mgmt_status(err);
9584
9585         bt_dev_dbg(hdev, "err %d", err);
9586
9587         memset(&rp, 0, sizeof(rp));
9588         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
9589         rp.addr.type = cp->addr.type;
9590
9591         if (err)
9592                 goto complete;
9593
9594         rp.local_clock = cpu_to_le32(hdev->clock);
9595
9596         if (conn) {
9597                 rp.piconet_clock = cpu_to_le32(conn->clock);
9598                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
9599         }
9600
9601 complete:
9602         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
9603                           sizeof(rp));
9604
9605         mgmt_pending_free(cmd);
9606 }
9607
9608 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
9609 {
9610         struct mgmt_pending_cmd *cmd = data;
9611         struct mgmt_cp_get_clock_info *cp = cmd->param;
9612         struct hci_cp_read_clock hci_cp;
9613         struct hci_conn *conn;
9614
9615         memset(&hci_cp, 0, sizeof(hci_cp));
9616         hci_read_clock_sync(hdev, &hci_cp);
9617
9618         /* Make sure connection still exists */
9619         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
9620         if (!conn || conn->state != BT_CONNECTED)
9621                 return MGMT_STATUS_NOT_CONNECTED;
9622
9623         cmd->user_data = conn;
9624         hci_cp.handle = cpu_to_le16(conn->handle);
9625         hci_cp.which = 0x01; /* Piconet clock */
9626
9627         return hci_read_clock_sync(hdev, &hci_cp);
9628 }
9629
9630 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
9631                                                                 u16 len)
9632 {
9633         struct mgmt_cp_get_clock_info *cp = data;
9634         struct mgmt_rp_get_clock_info rp;
9635         struct mgmt_pending_cmd *cmd;
9636         struct hci_conn *conn;
9637         int err;
9638
9639         bt_dev_dbg(hdev, "sock %p", sk);
9640
9641         memset(&rp, 0, sizeof(rp));
9642         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
9643         rp.addr.type = cp->addr.type;
9644
9645         if (cp->addr.type != BDADDR_BREDR)
9646                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
9647                                          MGMT_STATUS_INVALID_PARAMS,
9648                                          &rp, sizeof(rp));
9649
9650         hci_dev_lock(hdev);
9651
9652         if (!hdev_is_powered(hdev)) {
9653                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
9654                                         MGMT_STATUS_NOT_POWERED, &rp,
9655                                         sizeof(rp));
9656                 goto unlock;
9657         }
9658
9659         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
9660                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
9661                                                &cp->addr.bdaddr);
9662                 if (!conn || conn->state != BT_CONNECTED) {
9663                         err = mgmt_cmd_complete(sk, hdev->id,
9664                                                 MGMT_OP_GET_CLOCK_INFO,
9665                                                 MGMT_STATUS_NOT_CONNECTED,
9666                                                 &rp, sizeof(rp));
9667                         goto unlock;
9668                 }
9669         } else {
9670                 conn = NULL;
9671         }
9672
9673         cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
9674         if (!cmd)
9675                 err = -ENOMEM;
9676         else
9677                 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
9678                                          get_clock_info_complete);
9679
9680         if (err < 0) {
9681                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
9682                                         MGMT_STATUS_FAILED, &rp, sizeof(rp));
9683
9684                 if (cmd)
9685                         mgmt_pending_free(cmd);
9686         }
9687
9688
9689 unlock:
9690         hci_dev_unlock(hdev);
9691         return err;
9692 }
9693
9694 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
9695 {
9696         struct hci_conn *conn;
9697
9698         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
9699         if (!conn)
9700                 return false;
9701
9702         if (conn->dst_type != type)
9703                 return false;
9704
9705         if (conn->state != BT_CONNECTED)
9706                 return false;
9707
9708         return true;
9709 }
9710
9711 /* This function requires the caller holds hdev->lock */
9712 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
9713                                u8 addr_type, u8 auto_connect)
9714 {
9715         struct hci_conn_params *params;
9716
9717         params = hci_conn_params_add(hdev, addr, addr_type);
9718         if (!params)
9719                 return -EIO;
9720
9721         if (params->auto_connect == auto_connect)
9722                 return 0;
9723
9724         hci_pend_le_list_del_init(params);
9725
9726         switch (auto_connect) {
9727         case HCI_AUTO_CONN_DISABLED:
9728         case HCI_AUTO_CONN_LINK_LOSS:
9729                 /* If auto connect is being disabled when we're trying to
9730                  * connect to device, keep connecting.
9731                  */
9732                 if (params->explicit_connect)
9733                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
9734                 break;
9735         case HCI_AUTO_CONN_REPORT:
9736                 if (params->explicit_connect)
9737                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
9738                 else
9739                         hci_pend_le_list_add(params, &hdev->pend_le_reports);
9740                 break;
9741         case HCI_AUTO_CONN_DIRECT:
9742         case HCI_AUTO_CONN_ALWAYS:
9743                 if (!is_connected(hdev, addr, addr_type))
9744                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
9745                 break;
9746         }
9747
9748         params->auto_connect = auto_connect;
9749
9750         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
9751                    addr, addr_type, auto_connect);
9752
9753         return 0;
9754 }
9755
9756 static void device_added(struct sock *sk, struct hci_dev *hdev,
9757                          bdaddr_t *bdaddr, u8 type, u8 action)
9758 {
9759         struct mgmt_ev_device_added ev;
9760
9761         bacpy(&ev.addr.bdaddr, bdaddr);
9762         ev.addr.type = type;
9763         ev.action = action;
9764
9765         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
9766 }
9767
9768 static int add_device_sync(struct hci_dev *hdev, void *data)
9769 {
9770         return hci_update_passive_scan_sync(hdev);
9771 }
9772
9773 static int add_device(struct sock *sk, struct hci_dev *hdev,
9774                       void *data, u16 len)
9775 {
9776         struct mgmt_cp_add_device *cp = data;
9777         u8 auto_conn, addr_type;
9778         struct hci_conn_params *params;
9779         int err;
9780         u32 current_flags = 0;
9781         u32 supported_flags;
9782
9783         bt_dev_dbg(hdev, "sock %p", sk);
9784
9785         if (!bdaddr_type_is_valid(cp->addr.type) ||
9786             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
9787                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9788                                          MGMT_STATUS_INVALID_PARAMS,
9789                                          &cp->addr, sizeof(cp->addr));
9790
9791         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
9792                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9793                                          MGMT_STATUS_INVALID_PARAMS,
9794                                          &cp->addr, sizeof(cp->addr));
9795
9796         hci_dev_lock(hdev);
9797
9798         if (cp->addr.type == BDADDR_BREDR) {
9799                 /* Only incoming connections action is supported for now */
9800                 if (cp->action != 0x01) {
9801                         err = mgmt_cmd_complete(sk, hdev->id,
9802                                                 MGMT_OP_ADD_DEVICE,
9803                                                 MGMT_STATUS_INVALID_PARAMS,
9804                                                 &cp->addr, sizeof(cp->addr));
9805                         goto unlock;
9806                 }
9807
9808                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
9809                                                      &cp->addr.bdaddr,
9810                                                      cp->addr.type, 0);
9811                 if (err)
9812                         goto unlock;
9813
9814                 hci_update_scan(hdev);
9815
9816                 goto added;
9817         }
9818
9819         addr_type = le_addr_type(cp->addr.type);
9820
9821         if (cp->action == 0x02)
9822                 auto_conn = HCI_AUTO_CONN_ALWAYS;
9823         else if (cp->action == 0x01)
9824                 auto_conn = HCI_AUTO_CONN_DIRECT;
9825         else
9826                 auto_conn = HCI_AUTO_CONN_REPORT;
9827
9828         /* Kernel internally uses conn_params with resolvable private
9829          * address, but Add Device allows only identity addresses.
9830          * Make sure it is enforced before calling
9831          * hci_conn_params_lookup.
9832          */
9833         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9834                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9835                                         MGMT_STATUS_INVALID_PARAMS,
9836                                         &cp->addr, sizeof(cp->addr));
9837                 goto unlock;
9838         }
9839
9840         /* If the connection parameters don't exist for this device,
9841          * they will be created and configured with defaults.
9842          */
9843         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
9844                                 auto_conn) < 0) {
9845                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9846                                         MGMT_STATUS_FAILED, &cp->addr,
9847                                         sizeof(cp->addr));
9848                 goto unlock;
9849         } else {
9850                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9851                                                 addr_type);
9852                 if (params)
9853                         current_flags = params->flags;
9854         }
9855
9856         err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL);
9857         if (err < 0)
9858                 goto unlock;
9859
9860 added:
9861         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
9862         supported_flags = hdev->conn_flags;
9863         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
9864                              supported_flags, current_flags);
9865
9866         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
9867                                 MGMT_STATUS_SUCCESS, &cp->addr,
9868                                 sizeof(cp->addr));
9869
9870 unlock:
9871         hci_dev_unlock(hdev);
9872         return err;
9873 }
9874
9875 static void device_removed(struct sock *sk, struct hci_dev *hdev,
9876                            bdaddr_t *bdaddr, u8 type)
9877 {
9878         struct mgmt_ev_device_removed ev;
9879
9880         bacpy(&ev.addr.bdaddr, bdaddr);
9881         ev.addr.type = type;
9882
9883         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
9884 }
9885
9886 static int remove_device_sync(struct hci_dev *hdev, void *data)
9887 {
9888         return hci_update_passive_scan_sync(hdev);
9889 }
9890
9891 static int remove_device(struct sock *sk, struct hci_dev *hdev,
9892                          void *data, u16 len)
9893 {
9894         struct mgmt_cp_remove_device *cp = data;
9895         int err;
9896
9897         bt_dev_dbg(hdev, "sock %p", sk);
9898
9899         hci_dev_lock(hdev);
9900
9901         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
9902                 struct hci_conn_params *params;
9903                 u8 addr_type;
9904
9905                 if (!bdaddr_type_is_valid(cp->addr.type)) {
9906                         err = mgmt_cmd_complete(sk, hdev->id,
9907                                                 MGMT_OP_REMOVE_DEVICE,
9908                                                 MGMT_STATUS_INVALID_PARAMS,
9909                                                 &cp->addr, sizeof(cp->addr));
9910                         goto unlock;
9911                 }
9912
9913                 if (cp->addr.type == BDADDR_BREDR) {
9914                         err = hci_bdaddr_list_del(&hdev->accept_list,
9915                                                   &cp->addr.bdaddr,
9916                                                   cp->addr.type);
9917                         if (err) {
9918                                 err = mgmt_cmd_complete(sk, hdev->id,
9919                                                         MGMT_OP_REMOVE_DEVICE,
9920                                                         MGMT_STATUS_INVALID_PARAMS,
9921                                                         &cp->addr,
9922                                                         sizeof(cp->addr));
9923                                 goto unlock;
9924                         }
9925
9926                         hci_update_scan(hdev);
9927
9928                         device_removed(sk, hdev, &cp->addr.bdaddr,
9929                                        cp->addr.type);
9930                         goto complete;
9931                 }
9932
9933                 addr_type = le_addr_type(cp->addr.type);
9934
9935                 /* Kernel internally uses conn_params with resolvable private
9936                  * address, but Remove Device allows only identity addresses.
9937                  * Make sure it is enforced before calling
9938                  * hci_conn_params_lookup.
9939                  */
9940                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
9941                         err = mgmt_cmd_complete(sk, hdev->id,
9942                                                 MGMT_OP_REMOVE_DEVICE,
9943                                                 MGMT_STATUS_INVALID_PARAMS,
9944                                                 &cp->addr, sizeof(cp->addr));
9945                         goto unlock;
9946                 }
9947
9948                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
9949                                                 addr_type);
9950                 if (!params) {
9951                         err = mgmt_cmd_complete(sk, hdev->id,
9952                                                 MGMT_OP_REMOVE_DEVICE,
9953                                                 MGMT_STATUS_INVALID_PARAMS,
9954                                                 &cp->addr, sizeof(cp->addr));
9955                         goto unlock;
9956                 }
9957
9958                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
9959                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
9960                         err = mgmt_cmd_complete(sk, hdev->id,
9961                                                 MGMT_OP_REMOVE_DEVICE,
9962                                                 MGMT_STATUS_INVALID_PARAMS,
9963                                                 &cp->addr, sizeof(cp->addr));
9964                         goto unlock;
9965                 }
9966
9967                 hci_conn_params_free(params);
9968
9969                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
9970         } else {
9971                 struct hci_conn_params *p, *tmp;
9972                 struct bdaddr_list *b, *btmp;
9973
9974                 if (cp->addr.type) {
9975                         err = mgmt_cmd_complete(sk, hdev->id,
9976                                                 MGMT_OP_REMOVE_DEVICE,
9977                                                 MGMT_STATUS_INVALID_PARAMS,
9978                                                 &cp->addr, sizeof(cp->addr));
9979                         goto unlock;
9980                 }
9981
9982                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
9983                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
9984                         list_del(&b->list);
9985                         kfree(b);
9986                 }
9987
9988                 hci_update_scan(hdev);
9989
9990                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
9991                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
9992                                 continue;
9993                         device_removed(sk, hdev, &p->addr, p->addr_type);
9994                         if (p->explicit_connect) {
9995                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
9996                                 continue;
9997                         }
9998                         hci_conn_params_free(p);
9999                 }
10000
10001                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
10002         }
10003
10004         hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
10005
10006 complete:
10007         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
10008                                 MGMT_STATUS_SUCCESS, &cp->addr,
10009                                 sizeof(cp->addr));
10010 unlock:
10011         hci_dev_unlock(hdev);
10012         return err;
10013 }
10014
10015 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
10016                            u16 len)
10017 {
10018         struct mgmt_cp_load_conn_param *cp = data;
10019         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
10020                                      sizeof(struct mgmt_conn_param));
10021         u16 param_count, expected_len;
10022         int i;
10023
10024         if (!lmp_le_capable(hdev))
10025                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
10026                                        MGMT_STATUS_NOT_SUPPORTED);
10027
10028         param_count = __le16_to_cpu(cp->param_count);
10029         if (param_count > max_param_count) {
10030                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
10031                            param_count);
10032                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
10033                                        MGMT_STATUS_INVALID_PARAMS);
10034         }
10035
10036         expected_len = struct_size(cp, params, param_count);
10037         if (expected_len != len) {
10038                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
10039                            expected_len, len);
10040                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
10041                                        MGMT_STATUS_INVALID_PARAMS);
10042         }
10043
10044         bt_dev_dbg(hdev, "param_count %u", param_count);
10045
10046         hci_dev_lock(hdev);
10047
10048         hci_conn_params_clear_disabled(hdev);
10049
10050         for (i = 0; i < param_count; i++) {
10051                 struct mgmt_conn_param *param = &cp->params[i];
10052                 struct hci_conn_params *hci_param;
10053                 u16 min, max, latency, timeout;
10054                 u8 addr_type;
10055
10056                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
10057                            param->addr.type);
10058
10059                 if (param->addr.type == BDADDR_LE_PUBLIC) {
10060                         addr_type = ADDR_LE_DEV_PUBLIC;
10061                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
10062                         addr_type = ADDR_LE_DEV_RANDOM;
10063                 } else {
10064                         bt_dev_err(hdev, "ignoring invalid connection parameters");
10065                         continue;
10066                 }
10067
10068                 min = le16_to_cpu(param->min_interval);
10069                 max = le16_to_cpu(param->max_interval);
10070                 latency = le16_to_cpu(param->latency);
10071                 timeout = le16_to_cpu(param->timeout);
10072
10073                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
10074                            min, max, latency, timeout);
10075
10076                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
10077                         bt_dev_err(hdev, "ignoring invalid connection parameters");
10078                         continue;
10079                 }
10080
10081                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
10082                                                 addr_type);
10083                 if (!hci_param) {
10084                         bt_dev_err(hdev, "failed to add connection parameters");
10085                         continue;
10086                 }
10087
10088                 hci_param->conn_min_interval = min;
10089                 hci_param->conn_max_interval = max;
10090                 hci_param->conn_latency = latency;
10091                 hci_param->supervision_timeout = timeout;
10092         }
10093
10094         hci_dev_unlock(hdev);
10095
10096         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
10097                                  NULL, 0);
10098 }
10099
10100 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
10101                                void *data, u16 len)
10102 {
10103         struct mgmt_cp_set_external_config *cp = data;
10104         bool changed;
10105         int err;
10106
10107         bt_dev_dbg(hdev, "sock %p", sk);
10108
10109         if (hdev_is_powered(hdev))
10110                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
10111                                        MGMT_STATUS_REJECTED);
10112
10113         if (cp->config != 0x00 && cp->config != 0x01)
10114                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
10115                                          MGMT_STATUS_INVALID_PARAMS);
10116
10117         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
10118                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
10119                                        MGMT_STATUS_NOT_SUPPORTED);
10120
10121         hci_dev_lock(hdev);
10122
10123         if (cp->config)
10124                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
10125         else
10126                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
10127
10128         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
10129         if (err < 0)
10130                 goto unlock;
10131
10132         if (!changed)
10133                 goto unlock;
10134
10135         err = new_options(hdev, sk);
10136
10137         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
10138                 mgmt_index_removed(hdev);
10139
10140                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
10141                         hci_dev_set_flag(hdev, HCI_CONFIG);
10142                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
10143
10144                         queue_work(hdev->req_workqueue, &hdev->power_on);
10145                 } else {
10146                         set_bit(HCI_RAW, &hdev->flags);
10147                         mgmt_index_added(hdev);
10148                 }
10149         }
10150
10151 unlock:
10152         hci_dev_unlock(hdev);
10153         return err;
10154 }
10155
10156 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
10157                               void *data, u16 len)
10158 {
10159         struct mgmt_cp_set_public_address *cp = data;
10160         bool changed;
10161         int err;
10162
10163         bt_dev_dbg(hdev, "sock %p", sk);
10164
10165         if (hdev_is_powered(hdev))
10166                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
10167                                        MGMT_STATUS_REJECTED);
10168
10169         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
10170                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
10171                                        MGMT_STATUS_INVALID_PARAMS);
10172
10173         if (!hdev->set_bdaddr)
10174                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
10175                                        MGMT_STATUS_NOT_SUPPORTED);
10176
10177         hci_dev_lock(hdev);
10178
10179         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
10180         bacpy(&hdev->public_addr, &cp->bdaddr);
10181
10182         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
10183         if (err < 0)
10184                 goto unlock;
10185
10186         if (!changed)
10187                 goto unlock;
10188
10189         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
10190                 err = new_options(hdev, sk);
10191
10192         if (is_configured(hdev)) {
10193                 mgmt_index_removed(hdev);
10194
10195                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
10196
10197                 hci_dev_set_flag(hdev, HCI_CONFIG);
10198                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
10199
10200                 queue_work(hdev->req_workqueue, &hdev->power_on);
10201         }
10202
10203 unlock:
10204         hci_dev_unlock(hdev);
10205         return err;
10206 }
10207
10208 #ifdef TIZEN_BT
10209 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
10210                             u8 name_len)
10211 {
10212         char buf[512];
10213         struct mgmt_ev_device_name_update *ev = (void *)buf;
10214         u16 eir_len = 0;
10215
10216         if (name_len <= 0)
10217                 return -EINVAL;
10218
10219         bacpy(&ev->addr.bdaddr, bdaddr);
10220         ev->addr.type = BDADDR_BREDR;
10221
10222         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
10223                                   name_len);
10224
10225         ev->eir_len = cpu_to_le16(eir_len);
10226
10227         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
10228                           sizeof(*ev) + eir_len, NULL);
10229 }
10230
10231 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10232                                u8 link_type, u8 addr_type, u8 status)
10233 {
10234         struct mgmt_ev_conn_update_failed ev;
10235
10236         bacpy(&ev.addr.bdaddr, bdaddr);
10237         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10238         ev.status = status;
10239
10240         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
10241                                 &ev, sizeof(ev), NULL);
10242 }
10243
10244 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
10245                          u8 link_type, u8 addr_type, u16 conn_interval,
10246                          u16 conn_latency, u16 supervision_timeout)
10247 {
10248         struct mgmt_ev_conn_updated ev;
10249
10250         bacpy(&ev.addr.bdaddr, bdaddr);
10251         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10252         ev.conn_interval = cpu_to_le16(conn_interval);
10253         ev.conn_latency = cpu_to_le16(conn_latency);
10254         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
10255
10256         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
10257                                 &ev, sizeof(ev), NULL);
10258 }
10259
10260 /* le device found event - Pass adv type */
10261 void mgmt_le_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10262                 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, u8 *eir,
10263                 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, u8 adv_type)
10264 {
10265         char buf[512];
10266         struct mgmt_ev_le_device_found *ev = (void *)buf;
10267         size_t ev_size;
10268
10269         if (!hci_discovery_active(hdev) && !hci_le_discovery_active(hdev))
10270                 return;
10271
10272         /* Make sure that the buffer is big enough. The 5 extra bytes
10273          * are for the potential CoD field.
10274          */
10275         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
10276                 return;
10277
10278         memset(buf, 0, sizeof(buf));
10279
10280         bacpy(&ev->addr.bdaddr, bdaddr);
10281         ev->addr.type = link_to_bdaddr(link_type, addr_type);
10282         ev->rssi = rssi;
10283         ev->flags = cpu_to_le32(flags);
10284         ev->adv_type = adv_type;
10285
10286         if (eir_len > 0)
10287                 memcpy(ev->eir, eir, eir_len);
10288
10289         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, NULL))
10290                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
10291                                           dev_class, 3);
10292
10293         if (scan_rsp_len > 0)
10294                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
10295
10296         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10297         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
10298
10299         mgmt_event(MGMT_EV_LE_DEVICE_FOUND, hdev, ev, ev_size, NULL);
10300 }
10301 #endif
10302
10303 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
10304                                              int err)
10305 {
10306         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
10307         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
10308         u8 *h192, *r192, *h256, *r256;
10309         struct mgmt_pending_cmd *cmd = data;
10310         struct sk_buff *skb = cmd->skb;
10311         u8 status = mgmt_status(err);
10312         u16 eir_len;
10313
10314         if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
10315                 return;
10316
10317         if (!status) {
10318                 if (!skb)
10319                         status = MGMT_STATUS_FAILED;
10320                 else if (IS_ERR(skb))
10321                         status = mgmt_status(PTR_ERR(skb));
10322                 else
10323                         status = mgmt_status(skb->data[0]);
10324         }
10325
10326         bt_dev_dbg(hdev, "status %u", status);
10327
10328         mgmt_cp = cmd->param;
10329
10330         if (status) {
10331                 status = mgmt_status(status);
10332                 eir_len = 0;
10333
10334                 h192 = NULL;
10335                 r192 = NULL;
10336                 h256 = NULL;
10337                 r256 = NULL;
10338         } else if (!bredr_sc_enabled(hdev)) {
10339                 struct hci_rp_read_local_oob_data *rp;
10340
10341                 if (skb->len != sizeof(*rp)) {
10342                         status = MGMT_STATUS_FAILED;
10343                         eir_len = 0;
10344                 } else {
10345                         status = MGMT_STATUS_SUCCESS;
10346                         rp = (void *)skb->data;
10347
10348                         eir_len = 5 + 18 + 18;
10349                         h192 = rp->hash;
10350                         r192 = rp->rand;
10351                         h256 = NULL;
10352                         r256 = NULL;
10353                 }
10354         } else {
10355                 struct hci_rp_read_local_oob_ext_data *rp;
10356
10357                 if (skb->len != sizeof(*rp)) {
10358                         status = MGMT_STATUS_FAILED;
10359                         eir_len = 0;
10360                 } else {
10361                         status = MGMT_STATUS_SUCCESS;
10362                         rp = (void *)skb->data;
10363
10364                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
10365                                 eir_len = 5 + 18 + 18;
10366                                 h192 = NULL;
10367                                 r192 = NULL;
10368                         } else {
10369                                 eir_len = 5 + 18 + 18 + 18 + 18;
10370                                 h192 = rp->hash192;
10371                                 r192 = rp->rand192;
10372                         }
10373
10374                         h256 = rp->hash256;
10375                         r256 = rp->rand256;
10376                 }
10377         }
10378
10379         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
10380         if (!mgmt_rp)
10381                 goto done;
10382
10383         if (eir_len == 0)
10384                 goto send_rsp;
10385
10386         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
10387                                   hdev->dev_class, 3);
10388
10389         if (h192 && r192) {
10390                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10391                                           EIR_SSP_HASH_C192, h192, 16);
10392                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10393                                           EIR_SSP_RAND_R192, r192, 16);
10394         }
10395
10396         if (h256 && r256) {
10397                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10398                                           EIR_SSP_HASH_C256, h256, 16);
10399                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
10400                                           EIR_SSP_RAND_R256, r256, 16);
10401         }
10402
10403 send_rsp:
10404         mgmt_rp->type = mgmt_cp->type;
10405         mgmt_rp->eir_len = cpu_to_le16(eir_len);
10406
10407         err = mgmt_cmd_complete(cmd->sk, hdev->id,
10408                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
10409                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
10410         if (err < 0 || status)
10411                 goto done;
10412
10413         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
10414
10415         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
10416                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
10417                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
10418 done:
10419         if (skb && !IS_ERR(skb))
10420                 kfree_skb(skb);
10421
10422         kfree(mgmt_rp);
10423         mgmt_pending_remove(cmd);
10424 }
10425
10426 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
10427                                   struct mgmt_cp_read_local_oob_ext_data *cp)
10428 {
10429         struct mgmt_pending_cmd *cmd;
10430         int err;
10431
10432         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
10433                                cp, sizeof(*cp));
10434         if (!cmd)
10435                 return -ENOMEM;
10436
10437         err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
10438                                  read_local_oob_ext_data_complete);
10439
10440         if (err < 0) {
10441                 mgmt_pending_remove(cmd);
10442                 return err;
10443         }
10444
10445         return 0;
10446 }
10447
10448 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
10449                                    void *data, u16 data_len)
10450 {
10451         struct mgmt_cp_read_local_oob_ext_data *cp = data;
10452         struct mgmt_rp_read_local_oob_ext_data *rp;
10453         size_t rp_len;
10454         u16 eir_len;
10455         u8 status, flags, role, addr[7], hash[16], rand[16];
10456         int err;
10457
10458         bt_dev_dbg(hdev, "sock %p", sk);
10459
10460         if (hdev_is_powered(hdev)) {
10461                 switch (cp->type) {
10462                 case BIT(BDADDR_BREDR):
10463                         status = mgmt_bredr_support(hdev);
10464                         if (status)
10465                                 eir_len = 0;
10466                         else
10467                                 eir_len = 5;
10468                         break;
10469                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
10470                         status = mgmt_le_support(hdev);
10471                         if (status)
10472                                 eir_len = 0;
10473                         else
10474                                 eir_len = 9 + 3 + 18 + 18 + 3;
10475                         break;
10476                 default:
10477                         status = MGMT_STATUS_INVALID_PARAMS;
10478                         eir_len = 0;
10479                         break;
10480                 }
10481         } else {
10482                 status = MGMT_STATUS_NOT_POWERED;
10483                 eir_len = 0;
10484         }
10485
10486         rp_len = sizeof(*rp) + eir_len;
10487         rp = kmalloc(rp_len, GFP_ATOMIC);
10488         if (!rp)
10489                 return -ENOMEM;
10490
10491         if (!status && !lmp_ssp_capable(hdev)) {
10492                 status = MGMT_STATUS_NOT_SUPPORTED;
10493                 eir_len = 0;
10494         }
10495
10496         if (status)
10497                 goto complete;
10498
10499         hci_dev_lock(hdev);
10500
10501         eir_len = 0;
10502         switch (cp->type) {
10503         case BIT(BDADDR_BREDR):
10504                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
10505                         err = read_local_ssp_oob_req(hdev, sk, cp);
10506                         hci_dev_unlock(hdev);
10507                         if (!err)
10508                                 goto done;
10509
10510                         status = MGMT_STATUS_FAILED;
10511                         goto complete;
10512                 } else {
10513                         eir_len = eir_append_data(rp->eir, eir_len,
10514                                                   EIR_CLASS_OF_DEV,
10515                                                   hdev->dev_class, 3);
10516                 }
10517                 break;
10518         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
10519                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
10520                     smp_generate_oob(hdev, hash, rand) < 0) {
10521                         hci_dev_unlock(hdev);
10522                         status = MGMT_STATUS_FAILED;
10523                         goto complete;
10524                 }
10525
10526                 /* This should return the active RPA, but since the RPA
10527                  * is only programmed on demand, it is really hard to fill
10528                  * this in at the moment. For now disallow retrieving
10529                  * local out-of-band data when privacy is in use.
10530                  *
10531                  * Returning the identity address will not help here since
10532                  * pairing happens before the identity resolving key is
10533                  * known and thus the connection establishment happens
10534                  * based on the RPA and not the identity address.
10535                  */
10536                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
10537                         hci_dev_unlock(hdev);
10538                         status = MGMT_STATUS_REJECTED;
10539                         goto complete;
10540                 }
10541
10542                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
10543                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
10544                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
10545                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
10546                         memcpy(addr, &hdev->static_addr, 6);
10547                         addr[6] = 0x01;
10548                 } else {
10549                         memcpy(addr, &hdev->bdaddr, 6);
10550                         addr[6] = 0x00;
10551                 }
10552
10553                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
10554                                           addr, sizeof(addr));
10555
10556                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
10557                         role = 0x02;
10558                 else
10559                         role = 0x01;
10560
10561                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
10562                                           &role, sizeof(role));
10563
10564                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
10565                         eir_len = eir_append_data(rp->eir, eir_len,
10566                                                   EIR_LE_SC_CONFIRM,
10567                                                   hash, sizeof(hash));
10568
10569                         eir_len = eir_append_data(rp->eir, eir_len,
10570                                                   EIR_LE_SC_RANDOM,
10571                                                   rand, sizeof(rand));
10572                 }
10573
10574                 flags = mgmt_get_adv_discov_flags(hdev);
10575
10576                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
10577                         flags |= LE_AD_NO_BREDR;
10578
10579                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
10580                                           &flags, sizeof(flags));
10581                 break;
10582         }
10583
10584         hci_dev_unlock(hdev);
10585
10586         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
10587
10588         status = MGMT_STATUS_SUCCESS;
10589
10590 complete:
10591         rp->type = cp->type;
10592         rp->eir_len = cpu_to_le16(eir_len);
10593
10594         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
10595                                 status, rp, sizeof(*rp) + eir_len);
10596         if (err < 0 || status)
10597                 goto done;
10598
10599         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
10600                                  rp, sizeof(*rp) + eir_len,
10601                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
10602
10603 done:
10604         kfree(rp);
10605
10606         return err;
10607 }
10608
10609 static u32 get_supported_adv_flags(struct hci_dev *hdev)
10610 {
10611         u32 flags = 0;
10612
10613         flags |= MGMT_ADV_FLAG_CONNECTABLE;
10614         flags |= MGMT_ADV_FLAG_DISCOV;
10615         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
10616         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
10617         flags |= MGMT_ADV_FLAG_APPEARANCE;
10618         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
10619         flags |= MGMT_ADV_PARAM_DURATION;
10620         flags |= MGMT_ADV_PARAM_TIMEOUT;
10621         flags |= MGMT_ADV_PARAM_INTERVALS;
10622         flags |= MGMT_ADV_PARAM_TX_POWER;
10623         flags |= MGMT_ADV_PARAM_SCAN_RSP;
10624
10625         /* In extended adv TX_POWER returned from Set Adv Param
10626          * will be always valid.
10627          */
10628         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
10629                 flags |= MGMT_ADV_FLAG_TX_POWER;
10630
10631         if (ext_adv_capable(hdev)) {
10632                 flags |= MGMT_ADV_FLAG_SEC_1M;
10633                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
10634                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
10635
10636                 if (le_2m_capable(hdev))
10637                         flags |= MGMT_ADV_FLAG_SEC_2M;
10638
10639                 if (le_coded_capable(hdev))
10640                         flags |= MGMT_ADV_FLAG_SEC_CODED;
10641         }
10642
10643         return flags;
10644 }
10645
10646 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
10647                              void *data, u16 data_len)
10648 {
10649         struct mgmt_rp_read_adv_features *rp;
10650         size_t rp_len;
10651         int err;
10652         struct adv_info *adv_instance;
10653         u32 supported_flags;
10654         u8 *instance;
10655
10656         bt_dev_dbg(hdev, "sock %p", sk);
10657
10658         if (!lmp_le_capable(hdev))
10659                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
10660                                        MGMT_STATUS_REJECTED);
10661
10662         hci_dev_lock(hdev);
10663
10664         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
10665         rp = kmalloc(rp_len, GFP_ATOMIC);
10666         if (!rp) {
10667                 hci_dev_unlock(hdev);
10668                 return -ENOMEM;
10669         }
10670
10671         supported_flags = get_supported_adv_flags(hdev);
10672
10673         rp->supported_flags = cpu_to_le32(supported_flags);
10674         rp->max_adv_data_len = max_adv_len(hdev);
10675         rp->max_scan_rsp_len = max_adv_len(hdev);
10676         rp->max_instances = hdev->le_num_of_adv_sets;
10677         rp->num_instances = hdev->adv_instance_cnt;
10678
10679         instance = rp->instance;
10680         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
10681                 /* Only instances 1-le_num_of_adv_sets are externally visible */
10682                 if (adv_instance->instance <= hdev->adv_instance_cnt) {
10683                         *instance = adv_instance->instance;
10684                         instance++;
10685                 } else {
10686                         rp->num_instances--;
10687                         rp_len--;
10688                 }
10689         }
10690
10691         hci_dev_unlock(hdev);
10692
10693         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
10694                                 MGMT_STATUS_SUCCESS, rp, rp_len);
10695
10696         kfree(rp);
10697
10698         return err;
10699 }
10700
10701 static u8 calculate_name_len(struct hci_dev *hdev)
10702 {
10703         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
10704
10705         return eir_append_local_name(hdev, buf, 0);
10706 }
10707
10708 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
10709                            bool is_adv_data)
10710 {
10711         u8 max_len = max_adv_len(hdev);
10712
10713         if (is_adv_data) {
10714                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
10715                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
10716                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
10717                         max_len -= 3;
10718
10719                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
10720                         max_len -= 3;
10721         } else {
10722                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
10723                         max_len -= calculate_name_len(hdev);
10724
10725                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
10726                         max_len -= 4;
10727         }
10728
10729         return max_len;
10730 }
10731
10732 static bool flags_managed(u32 adv_flags)
10733 {
10734         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
10735                             MGMT_ADV_FLAG_LIMITED_DISCOV |
10736                             MGMT_ADV_FLAG_MANAGED_FLAGS);
10737 }
10738
10739 static bool tx_power_managed(u32 adv_flags)
10740 {
10741         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
10742 }
10743
10744 static bool name_managed(u32 adv_flags)
10745 {
10746         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
10747 }
10748
10749 static bool appearance_managed(u32 adv_flags)
10750 {
10751         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
10752 }
10753
10754 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
10755                               u8 len, bool is_adv_data)
10756 {
10757         int i, cur_len;
10758         u8 max_len;
10759
10760         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
10761
10762         if (len > max_len)
10763                 return false;
10764
10765         /* Make sure that the data is correctly formatted. */
10766         for (i = 0; i < len; i += (cur_len + 1)) {
10767                 cur_len = data[i];
10768
10769                 if (!cur_len)
10770                         continue;
10771
10772                 if (data[i + 1] == EIR_FLAGS &&
10773                     (!is_adv_data || flags_managed(adv_flags)))
10774                         return false;
10775
10776                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
10777                         return false;
10778
10779                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
10780                         return false;
10781
10782                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
10783                         return false;
10784
10785                 if (data[i + 1] == EIR_APPEARANCE &&
10786                     appearance_managed(adv_flags))
10787                         return false;
10788
10789                 /* If the current field length would exceed the total data
10790                  * length, then it's invalid.
10791                  */
10792                 if (i + cur_len >= len)
10793                         return false;
10794         }
10795
10796         return true;
10797 }
10798
10799 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
10800 {
10801         u32 supported_flags, phy_flags;
10802
10803         /* The current implementation only supports a subset of the specified
10804          * flags. Also need to check mutual exclusiveness of sec flags.
10805          */
10806         supported_flags = get_supported_adv_flags(hdev);
10807         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
10808         if (adv_flags & ~supported_flags ||
10809             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
10810                 return false;
10811
10812         return true;
10813 }
10814
10815 static bool adv_busy(struct hci_dev *hdev)
10816 {
10817         return pending_find(MGMT_OP_SET_LE, hdev);
10818 }
10819
10820 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
10821                              int err)
10822 {
10823         struct adv_info *adv, *n;
10824
10825         bt_dev_dbg(hdev, "err %d", err);
10826
10827         hci_dev_lock(hdev);
10828
10829         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
10830                 u8 instance;
10831
10832                 if (!adv->pending)
10833                         continue;
10834
10835                 if (!err) {
10836                         adv->pending = false;
10837                         continue;
10838                 }
10839
10840                 instance = adv->instance;
10841
10842                 if (hdev->cur_adv_instance == instance)
10843                         cancel_adv_timeout(hdev);
10844
10845                 hci_remove_adv_instance(hdev, instance);
10846                 mgmt_advertising_removed(sk, hdev, instance);
10847         }
10848
10849         hci_dev_unlock(hdev);
10850 }
10851
10852 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
10853 {
10854         struct mgmt_pending_cmd *cmd = data;
10855         struct mgmt_cp_add_advertising *cp = cmd->param;
10856         struct mgmt_rp_add_advertising rp;
10857
10858         memset(&rp, 0, sizeof(rp));
10859
10860         rp.instance = cp->instance;
10861
10862         if (err)
10863                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
10864                                 mgmt_status(err));
10865         else
10866                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
10867                                   mgmt_status(err), &rp, sizeof(rp));
10868
10869         add_adv_complete(hdev, cmd->sk, cp->instance, err);
10870
10871         mgmt_pending_free(cmd);
10872 }
10873
10874 static int add_advertising_sync(struct hci_dev *hdev, void *data)
10875 {
10876         struct mgmt_pending_cmd *cmd = data;
10877         struct mgmt_cp_add_advertising *cp = cmd->param;
10878
10879         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
10880 }
10881
10882 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
10883                            void *data, u16 data_len)
10884 {
10885         struct mgmt_cp_add_advertising *cp = data;
10886         struct mgmt_rp_add_advertising rp;
10887         u32 flags;
10888         u8 status;
10889         u16 timeout, duration;
10890         unsigned int prev_instance_cnt;
10891         u8 schedule_instance = 0;
10892         struct adv_info *adv, *next_instance;
10893         int err;
10894         struct mgmt_pending_cmd *cmd;
10895
10896         bt_dev_dbg(hdev, "sock %p", sk);
10897
10898         status = mgmt_le_support(hdev);
10899         if (status)
10900                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10901                                        status);
10902
10903         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10904                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10905                                        MGMT_STATUS_INVALID_PARAMS);
10906
10907         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
10908                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10909                                        MGMT_STATUS_INVALID_PARAMS);
10910
10911         flags = __le32_to_cpu(cp->flags);
10912         timeout = __le16_to_cpu(cp->timeout);
10913         duration = __le16_to_cpu(cp->duration);
10914
10915         if (!requested_adv_flags_are_valid(hdev, flags))
10916                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10917                                        MGMT_STATUS_INVALID_PARAMS);
10918
10919         hci_dev_lock(hdev);
10920
10921         if (timeout && !hdev_is_powered(hdev)) {
10922                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10923                                       MGMT_STATUS_REJECTED);
10924                 goto unlock;
10925         }
10926
10927         if (adv_busy(hdev)) {
10928                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10929                                       MGMT_STATUS_BUSY);
10930                 goto unlock;
10931         }
10932
10933         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
10934             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
10935                                cp->scan_rsp_len, false)) {
10936                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10937                                       MGMT_STATUS_INVALID_PARAMS);
10938                 goto unlock;
10939         }
10940
10941         prev_instance_cnt = hdev->adv_instance_cnt;
10942
10943         adv = hci_add_adv_instance(hdev, cp->instance, flags,
10944                                    cp->adv_data_len, cp->data,
10945                                    cp->scan_rsp_len,
10946                                    cp->data + cp->adv_data_len,
10947                                    timeout, duration,
10948                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
10949                                    hdev->le_adv_min_interval,
10950                                    hdev->le_adv_max_interval, 0);
10951         if (IS_ERR(adv)) {
10952                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10953                                       MGMT_STATUS_FAILED);
10954                 goto unlock;
10955         }
10956
10957         /* Only trigger an advertising added event if a new instance was
10958          * actually added.
10959          */
10960         if (hdev->adv_instance_cnt > prev_instance_cnt)
10961                 mgmt_advertising_added(sk, hdev, cp->instance);
10962
10963         if (hdev->cur_adv_instance == cp->instance) {
10964                 /* If the currently advertised instance is being changed then
10965                  * cancel the current advertising and schedule the next
10966                  * instance. If there is only one instance then the overridden
10967                  * advertising data will be visible right away.
10968                  */
10969                 cancel_adv_timeout(hdev);
10970
10971                 next_instance = hci_get_next_instance(hdev, cp->instance);
10972                 if (next_instance)
10973                         schedule_instance = next_instance->instance;
10974         } else if (!hdev->adv_instance_timeout) {
10975                 /* Immediately advertise the new instance if no other
10976                  * instance is currently being advertised.
10977                  */
10978                 schedule_instance = cp->instance;
10979         }
10980
10981         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
10982          * there is no instance to be advertised then we have no HCI
10983          * communication to make. Simply return.
10984          */
10985         if (!hdev_is_powered(hdev) ||
10986             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
10987             !schedule_instance) {
10988                 rp.instance = cp->instance;
10989                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
10990                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10991                 goto unlock;
10992         }
10993
10994         /* We're good to go, update advertising data, parameters, and start
10995          * advertising.
10996          */
10997         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
10998                                data_len);
10999         if (!cmd) {
11000                 err = -ENOMEM;
11001                 goto unlock;
11002         }
11003
11004         cp->instance = schedule_instance;
11005
11006         err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
11007                                  add_advertising_complete);
11008         if (err < 0)
11009                 mgmt_pending_free(cmd);
11010
11011 unlock:
11012         hci_dev_unlock(hdev);
11013
11014         return err;
11015 }
11016
11017 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
11018                                         int err)
11019 {
11020         struct mgmt_pending_cmd *cmd = data;
11021         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
11022         struct mgmt_rp_add_ext_adv_params rp;
11023         struct adv_info *adv;
11024         u32 flags;
11025
11026         BT_DBG("%s", hdev->name);
11027
11028         hci_dev_lock(hdev);
11029
11030         adv = hci_find_adv_instance(hdev, cp->instance);
11031         if (!adv)
11032                 goto unlock;
11033
11034         rp.instance = cp->instance;
11035         rp.tx_power = adv->tx_power;
11036
11037         /* While we're at it, inform userspace of the available space for this
11038          * advertisement, given the flags that will be used.
11039          */
11040         flags = __le32_to_cpu(cp->flags);
11041         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
11042         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
11043
11044         if (err) {
11045                 /* If this advertisement was previously advertising and we
11046                  * failed to update it, we signal that it has been removed and
11047                  * delete its structure
11048                  */
11049                 if (!adv->pending)
11050                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
11051
11052                 hci_remove_adv_instance(hdev, cp->instance);
11053
11054                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
11055                                 mgmt_status(err));
11056         } else {
11057                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
11058                                   mgmt_status(err), &rp, sizeof(rp));
11059         }
11060
11061 unlock:
11062         if (cmd)
11063                 mgmt_pending_free(cmd);
11064
11065         hci_dev_unlock(hdev);
11066 }
11067
11068 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
11069 {
11070         struct mgmt_pending_cmd *cmd = data;
11071         struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
11072
11073         return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
11074 }
11075
11076 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
11077                               void *data, u16 data_len)
11078 {
11079         struct mgmt_cp_add_ext_adv_params *cp = data;
11080         struct mgmt_rp_add_ext_adv_params rp;
11081         struct mgmt_pending_cmd *cmd = NULL;
11082         struct adv_info *adv;
11083         u32 flags, min_interval, max_interval;
11084         u16 timeout, duration;
11085         u8 status;
11086         s8 tx_power;
11087         int err;
11088
11089         BT_DBG("%s", hdev->name);
11090
11091         status = mgmt_le_support(hdev);
11092         if (status)
11093                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11094                                        status);
11095
11096         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
11097                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11098                                        MGMT_STATUS_INVALID_PARAMS);
11099
11100         /* The purpose of breaking add_advertising into two separate MGMT calls
11101          * for params and data is to allow more parameters to be added to this
11102          * structure in the future. For this reason, we verify that we have the
11103          * bare minimum structure we know of when the interface was defined. Any
11104          * extra parameters we don't know about will be ignored in this request.
11105          */
11106         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
11107                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11108                                        MGMT_STATUS_INVALID_PARAMS);
11109
11110         flags = __le32_to_cpu(cp->flags);
11111
11112         if (!requested_adv_flags_are_valid(hdev, flags))
11113                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11114                                        MGMT_STATUS_INVALID_PARAMS);
11115
11116         hci_dev_lock(hdev);
11117
11118         /* In new interface, we require that we are powered to register */
11119         if (!hdev_is_powered(hdev)) {
11120                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11121                                       MGMT_STATUS_REJECTED);
11122                 goto unlock;
11123         }
11124
11125         if (adv_busy(hdev)) {
11126                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11127                                       MGMT_STATUS_BUSY);
11128                 goto unlock;
11129         }
11130
11131         /* Parse defined parameters from request, use defaults otherwise */
11132         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
11133                   __le16_to_cpu(cp->timeout) : 0;
11134
11135         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
11136                    __le16_to_cpu(cp->duration) :
11137                    hdev->def_multi_adv_rotation_duration;
11138
11139         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
11140                        __le32_to_cpu(cp->min_interval) :
11141                        hdev->le_adv_min_interval;
11142
11143         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
11144                        __le32_to_cpu(cp->max_interval) :
11145                        hdev->le_adv_max_interval;
11146
11147         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
11148                    cp->tx_power :
11149                    HCI_ADV_TX_POWER_NO_PREFERENCE;
11150
11151         /* Create advertising instance with no advertising or response data */
11152         adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
11153                                    timeout, duration, tx_power, min_interval,
11154                                    max_interval, 0);
11155
11156         if (IS_ERR(adv)) {
11157                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
11158                                       MGMT_STATUS_FAILED);
11159                 goto unlock;
11160         }
11161
11162         /* Submit request for advertising params if ext adv available */
11163         if (ext_adv_capable(hdev)) {
11164                 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
11165                                        data, data_len);
11166                 if (!cmd) {
11167                         err = -ENOMEM;
11168                         hci_remove_adv_instance(hdev, cp->instance);
11169                         goto unlock;
11170                 }
11171
11172                 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
11173                                          add_ext_adv_params_complete);
11174                 if (err < 0)
11175                         mgmt_pending_free(cmd);
11176         } else {
11177                 rp.instance = cp->instance;
11178                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
11179                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
11180                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
11181                 err = mgmt_cmd_complete(sk, hdev->id,
11182                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
11183                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11184         }
11185
11186 unlock:
11187         hci_dev_unlock(hdev);
11188
11189         return err;
11190 }
11191
11192 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
11193 {
11194         struct mgmt_pending_cmd *cmd = data;
11195         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
11196         struct mgmt_rp_add_advertising rp;
11197
11198         add_adv_complete(hdev, cmd->sk, cp->instance, err);
11199
11200         memset(&rp, 0, sizeof(rp));
11201
11202         rp.instance = cp->instance;
11203
11204         if (err)
11205                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
11206                                 mgmt_status(err));
11207         else
11208                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
11209                                   mgmt_status(err), &rp, sizeof(rp));
11210
11211         mgmt_pending_free(cmd);
11212 }
11213
11214 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
11215 {
11216         struct mgmt_pending_cmd *cmd = data;
11217         struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
11218         int err;
11219
11220         if (ext_adv_capable(hdev)) {
11221                 err = hci_update_adv_data_sync(hdev, cp->instance);
11222                 if (err)
11223                         return err;
11224
11225                 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
11226                 if (err)
11227                         return err;
11228
11229                 return hci_enable_ext_advertising_sync(hdev, cp->instance);
11230         }
11231
11232         return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
11233 }
11234
11235 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
11236                             u16 data_len)
11237 {
11238         struct mgmt_cp_add_ext_adv_data *cp = data;
11239         struct mgmt_rp_add_ext_adv_data rp;
11240         u8 schedule_instance = 0;
11241         struct adv_info *next_instance;
11242         struct adv_info *adv_instance;
11243         int err = 0;
11244         struct mgmt_pending_cmd *cmd;
11245
11246         BT_DBG("%s", hdev->name);
11247
11248         hci_dev_lock(hdev);
11249
11250         adv_instance = hci_find_adv_instance(hdev, cp->instance);
11251
11252         if (!adv_instance) {
11253                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11254                                       MGMT_STATUS_INVALID_PARAMS);
11255                 goto unlock;
11256         }
11257
11258         /* In new interface, we require that we are powered to register */
11259         if (!hdev_is_powered(hdev)) {
11260                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11261                                       MGMT_STATUS_REJECTED);
11262                 goto clear_new_instance;
11263         }
11264
11265         if (adv_busy(hdev)) {
11266                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11267                                       MGMT_STATUS_BUSY);
11268                 goto clear_new_instance;
11269         }
11270
11271         /* Validate new data */
11272         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
11273                                cp->adv_data_len, true) ||
11274             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
11275                                cp->adv_data_len, cp->scan_rsp_len, false)) {
11276                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11277                                       MGMT_STATUS_INVALID_PARAMS);
11278                 goto clear_new_instance;
11279         }
11280
11281         /* Set the data in the advertising instance */
11282         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
11283                                   cp->data, cp->scan_rsp_len,
11284                                   cp->data + cp->adv_data_len);
11285
11286         /* If using software rotation, determine next instance to use */
11287         if (hdev->cur_adv_instance == cp->instance) {
11288                 /* If the currently advertised instance is being changed
11289                  * then cancel the current advertising and schedule the
11290                  * next instance. If there is only one instance then the
11291                  * overridden advertising data will be visible right
11292                  * away
11293                  */
11294                 cancel_adv_timeout(hdev);
11295
11296                 next_instance = hci_get_next_instance(hdev, cp->instance);
11297                 if (next_instance)
11298                         schedule_instance = next_instance->instance;
11299         } else if (!hdev->adv_instance_timeout) {
11300                 /* Immediately advertise the new instance if no other
11301                  * instance is currently being advertised.
11302                  */
11303                 schedule_instance = cp->instance;
11304         }
11305
11306         /* If the HCI_ADVERTISING flag is set or there is no instance to
11307          * be advertised then we have no HCI communication to make.
11308          * Simply return.
11309          */
11310         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
11311                 if (adv_instance->pending) {
11312                         mgmt_advertising_added(sk, hdev, cp->instance);
11313                         adv_instance->pending = false;
11314                 }
11315                 rp.instance = cp->instance;
11316                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
11317                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11318                 goto unlock;
11319         }
11320
11321         cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
11322                                data_len);
11323         if (!cmd) {
11324                 err = -ENOMEM;
11325                 goto clear_new_instance;
11326         }
11327
11328         err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
11329                                  add_ext_adv_data_complete);
11330         if (err < 0) {
11331                 mgmt_pending_free(cmd);
11332                 goto clear_new_instance;
11333         }
11334
11335         /* We were successful in updating data, so trigger advertising_added
11336          * event if this is an instance that wasn't previously advertising. If
11337          * a failure occurs in the requests we initiated, we will remove the
11338          * instance again in add_advertising_complete
11339          */
11340         if (adv_instance->pending)
11341                 mgmt_advertising_added(sk, hdev, cp->instance);
11342
11343         goto unlock;
11344
11345 clear_new_instance:
11346         hci_remove_adv_instance(hdev, cp->instance);
11347
11348 unlock:
11349         hci_dev_unlock(hdev);
11350
11351         return err;
11352 }
11353
11354 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
11355                                         int err)
11356 {
11357         struct mgmt_pending_cmd *cmd = data;
11358         struct mgmt_cp_remove_advertising *cp = cmd->param;
11359         struct mgmt_rp_remove_advertising rp;
11360
11361         bt_dev_dbg(hdev, "err %d", err);
11362
11363         memset(&rp, 0, sizeof(rp));
11364         rp.instance = cp->instance;
11365
11366         if (err)
11367                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
11368                                 mgmt_status(err));
11369         else
11370                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
11371                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11372
11373         mgmt_pending_free(cmd);
11374 }
11375
11376 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
11377 {
11378         struct mgmt_pending_cmd *cmd = data;
11379         struct mgmt_cp_remove_advertising *cp = cmd->param;
11380         int err;
11381
11382         err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
11383         if (err)
11384                 return err;
11385
11386         if (list_empty(&hdev->adv_instances))
11387                 err = hci_disable_advertising_sync(hdev);
11388
11389         return err;
11390 }
11391
11392 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
11393                               void *data, u16 data_len)
11394 {
11395         struct mgmt_cp_remove_advertising *cp = data;
11396         struct mgmt_pending_cmd *cmd;
11397         int err;
11398
11399         bt_dev_dbg(hdev, "sock %p", sk);
11400
11401         hci_dev_lock(hdev);
11402
11403         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
11404                 err = mgmt_cmd_status(sk, hdev->id,
11405                                       MGMT_OP_REMOVE_ADVERTISING,
11406                                       MGMT_STATUS_INVALID_PARAMS);
11407                 goto unlock;
11408         }
11409
11410         if (pending_find(MGMT_OP_SET_LE, hdev)) {
11411                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
11412                                       MGMT_STATUS_BUSY);
11413                 goto unlock;
11414         }
11415
11416         if (list_empty(&hdev->adv_instances)) {
11417                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
11418                                       MGMT_STATUS_INVALID_PARAMS);
11419                 goto unlock;
11420         }
11421
11422         cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
11423                                data_len);
11424         if (!cmd) {
11425                 err = -ENOMEM;
11426                 goto unlock;
11427         }
11428
11429         err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
11430                                  remove_advertising_complete);
11431         if (err < 0)
11432                 mgmt_pending_free(cmd);
11433
11434 unlock:
11435         hci_dev_unlock(hdev);
11436
11437         return err;
11438 }
11439
11440 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
11441                              void *data, u16 data_len)
11442 {
11443         struct mgmt_cp_get_adv_size_info *cp = data;
11444         struct mgmt_rp_get_adv_size_info rp;
11445         u32 flags, supported_flags;
11446
11447         bt_dev_dbg(hdev, "sock %p", sk);
11448
11449         if (!lmp_le_capable(hdev))
11450                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11451                                        MGMT_STATUS_REJECTED);
11452
11453         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
11454                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11455                                        MGMT_STATUS_INVALID_PARAMS);
11456
11457         flags = __le32_to_cpu(cp->flags);
11458
11459         /* The current implementation only supports a subset of the specified
11460          * flags.
11461          */
11462         supported_flags = get_supported_adv_flags(hdev);
11463         if (flags & ~supported_flags)
11464                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11465                                        MGMT_STATUS_INVALID_PARAMS);
11466
11467         rp.instance = cp->instance;
11468         rp.flags = cp->flags;
11469         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
11470         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
11471
11472         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
11473                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
11474 }
11475
11476 static const struct hci_mgmt_handler mgmt_handlers[] = {
11477         { NULL }, /* 0x0000 (no command) */
11478         { read_version,            MGMT_READ_VERSION_SIZE,
11479                                                 HCI_MGMT_NO_HDEV |
11480                                                 HCI_MGMT_UNTRUSTED },
11481         { read_commands,           MGMT_READ_COMMANDS_SIZE,
11482                                                 HCI_MGMT_NO_HDEV |
11483                                                 HCI_MGMT_UNTRUSTED },
11484         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
11485                                                 HCI_MGMT_NO_HDEV |
11486                                                 HCI_MGMT_UNTRUSTED },
11487         { read_controller_info,    MGMT_READ_INFO_SIZE,
11488                                                 HCI_MGMT_UNTRUSTED },
11489         { set_powered,             MGMT_SETTING_SIZE },
11490         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
11491         { set_connectable,         MGMT_SETTING_SIZE },
11492         { set_fast_connectable,    MGMT_SETTING_SIZE },
11493         { set_bondable,            MGMT_SETTING_SIZE },
11494         { set_link_security,       MGMT_SETTING_SIZE },
11495         { set_ssp,                 MGMT_SETTING_SIZE },
11496         { set_hs,                  MGMT_SETTING_SIZE },
11497         { set_le,                  MGMT_SETTING_SIZE },
11498         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
11499         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
11500         { add_uuid,                MGMT_ADD_UUID_SIZE },
11501         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
11502         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
11503                                                 HCI_MGMT_VAR_LEN },
11504         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
11505                                                 HCI_MGMT_VAR_LEN },
11506         { disconnect,              MGMT_DISCONNECT_SIZE },
11507         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
11508         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
11509         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
11510         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
11511         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
11512         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
11513         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
11514         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
11515         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
11516         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
11517         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
11518         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
11519         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
11520                                                 HCI_MGMT_VAR_LEN },
11521         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
11522         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
11523         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
11524         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
11525         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
11526         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
11527         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
11528         { set_advertising,         MGMT_SETTING_SIZE },
11529         { set_bredr,               MGMT_SETTING_SIZE },
11530         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
11531         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
11532         { set_secure_conn,         MGMT_SETTING_SIZE },
11533         { set_debug_keys,          MGMT_SETTING_SIZE },
11534         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
11535         { load_irks,               MGMT_LOAD_IRKS_SIZE,
11536                                                 HCI_MGMT_VAR_LEN },
11537         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
11538         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
11539         { add_device,              MGMT_ADD_DEVICE_SIZE },
11540         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
11541         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
11542                                                 HCI_MGMT_VAR_LEN },
11543         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
11544                                                 HCI_MGMT_NO_HDEV |
11545                                                 HCI_MGMT_UNTRUSTED },
11546         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
11547                                                 HCI_MGMT_UNCONFIGURED |
11548                                                 HCI_MGMT_UNTRUSTED },
11549         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
11550                                                 HCI_MGMT_UNCONFIGURED },
11551         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
11552                                                 HCI_MGMT_UNCONFIGURED },
11553         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
11554                                                 HCI_MGMT_VAR_LEN },
11555         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
11556         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
11557                                                 HCI_MGMT_NO_HDEV |
11558                                                 HCI_MGMT_UNTRUSTED },
11559         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
11560         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
11561                                                 HCI_MGMT_VAR_LEN },
11562         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
11563         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
11564         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
11565         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
11566                                                 HCI_MGMT_UNTRUSTED },
11567         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
11568         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
11569         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
11570         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
11571                                                 HCI_MGMT_VAR_LEN },
11572         { set_wideband_speech,     MGMT_SETTING_SIZE },
11573         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
11574                                                 HCI_MGMT_UNTRUSTED },
11575         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
11576                                                 HCI_MGMT_UNTRUSTED |
11577                                                 HCI_MGMT_HDEV_OPTIONAL },
11578         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
11579                                                 HCI_MGMT_VAR_LEN |
11580                                                 HCI_MGMT_HDEV_OPTIONAL },
11581         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
11582                                                 HCI_MGMT_UNTRUSTED },
11583         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
11584                                                 HCI_MGMT_VAR_LEN },
11585         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
11586                                                 HCI_MGMT_UNTRUSTED },
11587         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
11588                                                 HCI_MGMT_VAR_LEN },
11589         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
11590         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
11591         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
11592         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
11593                                                 HCI_MGMT_VAR_LEN },
11594         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
11595         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
11596                                                 HCI_MGMT_VAR_LEN },
11597         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
11598                                                 HCI_MGMT_VAR_LEN },
11599         { add_adv_patterns_monitor_rssi,
11600                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
11601                                                 HCI_MGMT_VAR_LEN },
11602         { set_mesh,                MGMT_SET_MESH_RECEIVER_SIZE,
11603                                                 HCI_MGMT_VAR_LEN },
11604         { mesh_features,           MGMT_MESH_READ_FEATURES_SIZE },
11605         { mesh_send,               MGMT_MESH_SEND_SIZE,
11606                                                 HCI_MGMT_VAR_LEN },
11607         { mesh_send_cancel,        MGMT_MESH_SEND_CANCEL_SIZE },
11608 };
11609
11610 #ifdef TIZEN_BT
11611 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
11612         { NULL }, /* 0x0000 (no command) */
11613         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
11614         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
11615                                                 HCI_MGMT_VAR_LEN },
11616         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
11617                                                 HCI_MGMT_VAR_LEN },
11618         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
11619         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
11620         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
11621         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
11622         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
11623         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
11624         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
11625         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
11626         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
11627         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
11628         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
11629         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
11630         { set_voice_setting,       MGMT_SET_VOICE_SETTING_SIZE },
11631         { get_adv_tx_power,        MGMT_GET_ADV_TX_POWER_SIZE },
11632         { enable_bt_6lowpan,       MGMT_ENABLE_BT_6LOWPAN_SIZE },
11633         { connect_bt_6lowpan,      MGMT_CONNECT_6LOWPAN_SIZE },
11634         { disconnect_bt_6lowpan,   MGMT_DISCONNECT_6LOWPAN_SIZE },
11635         { read_maximum_le_data_length,
11636                                    MGMT_LE_READ_MAXIMUM_DATA_LENGTH_SIZE },
11637         { write_host_suggested_le_data_length,
11638                                    MGMT_LE_WRITE_HOST_SUGGESTED_DATA_LENGTH_SIZE },
11639 };
11640 #endif
11641
11642 void mgmt_index_added(struct hci_dev *hdev)
11643 {
11644         struct mgmt_ev_ext_index ev;
11645
11646         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
11647                 return;
11648
11649         switch (hdev->dev_type) {
11650         case HCI_PRIMARY:
11651                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
11652                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
11653                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
11654                         ev.type = 0x01;
11655                 } else {
11656                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
11657                                          HCI_MGMT_INDEX_EVENTS);
11658                         ev.type = 0x00;
11659                 }
11660                 break;
11661         case HCI_AMP:
11662                 ev.type = 0x02;
11663                 break;
11664         default:
11665                 return;
11666         }
11667
11668         ev.bus = hdev->bus;
11669
11670         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
11671                          HCI_MGMT_EXT_INDEX_EVENTS);
11672 }
11673
11674 void mgmt_index_removed(struct hci_dev *hdev)
11675 {
11676         struct mgmt_ev_ext_index ev;
11677         u8 status = MGMT_STATUS_INVALID_INDEX;
11678
11679         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
11680                 return;
11681
11682         switch (hdev->dev_type) {
11683         case HCI_PRIMARY:
11684                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
11685
11686                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
11687                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
11688                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
11689                         ev.type = 0x01;
11690                 } else {
11691                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
11692                                          HCI_MGMT_INDEX_EVENTS);
11693                         ev.type = 0x00;
11694                 }
11695                 break;
11696         case HCI_AMP:
11697                 ev.type = 0x02;
11698                 break;
11699         default:
11700                 return;
11701         }
11702
11703         ev.bus = hdev->bus;
11704
11705         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
11706                          HCI_MGMT_EXT_INDEX_EVENTS);
11707
11708         /* Cancel any remaining timed work */
11709         if (!hci_dev_test_flag(hdev, HCI_MGMT))
11710                 return;
11711         cancel_delayed_work_sync(&hdev->discov_off);
11712         cancel_delayed_work_sync(&hdev->service_cache);
11713         cancel_delayed_work_sync(&hdev->rpa_expired);
11714 }
11715
11716 void mgmt_power_on(struct hci_dev *hdev, int err)
11717 {
11718         struct cmd_lookup match = { NULL, hdev };
11719
11720         bt_dev_dbg(hdev, "err %d", err);
11721
11722         hci_dev_lock(hdev);
11723
11724         if (!err) {
11725                 restart_le_actions(hdev);
11726                 hci_update_passive_scan(hdev);
11727         }
11728
11729         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
11730
11731         new_settings(hdev, match.sk);
11732
11733         if (match.sk)
11734                 sock_put(match.sk);
11735
11736         hci_dev_unlock(hdev);
11737 }
11738
11739 void __mgmt_power_off(struct hci_dev *hdev)
11740 {
11741         struct cmd_lookup match = { NULL, hdev };
11742         u8 status, zero_cod[] = { 0, 0, 0 };
11743
11744         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
11745
11746         /* If the power off is because of hdev unregistration let
11747          * use the appropriate INVALID_INDEX status. Otherwise use
11748          * NOT_POWERED. We cover both scenarios here since later in
11749          * mgmt_index_removed() any hci_conn callbacks will have already
11750          * been triggered, potentially causing misleading DISCONNECTED
11751          * status responses.
11752          */
11753         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
11754                 status = MGMT_STATUS_INVALID_INDEX;
11755         else
11756                 status = MGMT_STATUS_NOT_POWERED;
11757
11758         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
11759
11760         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
11761                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
11762                                    zero_cod, sizeof(zero_cod),
11763                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11764                 ext_info_changed(hdev, NULL);
11765         }
11766
11767         new_settings(hdev, match.sk);
11768
11769         if (match.sk)
11770                 sock_put(match.sk);
11771 }
11772
11773 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
11774 {
11775         struct mgmt_pending_cmd *cmd;
11776         u8 status;
11777
11778         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
11779         if (!cmd)
11780                 return;
11781
11782         if (err == -ERFKILL)
11783                 status = MGMT_STATUS_RFKILLED;
11784         else
11785                 status = MGMT_STATUS_FAILED;
11786
11787         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
11788
11789         mgmt_pending_remove(cmd);
11790 }
11791
11792 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
11793                        bool persistent)
11794 {
11795         struct mgmt_ev_new_link_key ev;
11796
11797         memset(&ev, 0, sizeof(ev));
11798
11799         ev.store_hint = persistent;
11800         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11801         ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
11802         ev.key.type = key->type;
11803         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
11804         ev.key.pin_len = key->pin_len;
11805
11806         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
11807 }
11808
11809 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
11810 {
11811         switch (ltk->type) {
11812         case SMP_LTK:
11813         case SMP_LTK_RESPONDER:
11814                 if (ltk->authenticated)
11815                         return MGMT_LTK_AUTHENTICATED;
11816                 return MGMT_LTK_UNAUTHENTICATED;
11817         case SMP_LTK_P256:
11818                 if (ltk->authenticated)
11819                         return MGMT_LTK_P256_AUTH;
11820                 return MGMT_LTK_P256_UNAUTH;
11821         case SMP_LTK_P256_DEBUG:
11822                 return MGMT_LTK_P256_DEBUG;
11823         }
11824
11825         return MGMT_LTK_UNAUTHENTICATED;
11826 }
11827
11828 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
11829 {
11830         struct mgmt_ev_new_long_term_key ev;
11831
11832         memset(&ev, 0, sizeof(ev));
11833
11834         /* Devices using resolvable or non-resolvable random addresses
11835          * without providing an identity resolving key don't require
11836          * to store long term keys. Their addresses will change the
11837          * next time around.
11838          *
11839          * Only when a remote device provides an identity address
11840          * make sure the long term key is stored. If the remote
11841          * identity is known, the long term keys are internally
11842          * mapped to the identity address. So allow static random
11843          * and public addresses here.
11844          */
11845         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11846             (key->bdaddr.b[5] & 0xc0) != 0xc0)
11847                 ev.store_hint = 0x00;
11848         else
11849                 ev.store_hint = persistent;
11850
11851         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
11852         ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
11853         ev.key.type = mgmt_ltk_type(key);
11854         ev.key.enc_size = key->enc_size;
11855         ev.key.ediv = key->ediv;
11856         ev.key.rand = key->rand;
11857
11858         if (key->type == SMP_LTK)
11859                 ev.key.initiator = 1;
11860
11861         /* Make sure we copy only the significant bytes based on the
11862          * encryption key size, and set the rest of the value to zeroes.
11863          */
11864         memcpy(ev.key.val, key->val, key->enc_size);
11865         memset(ev.key.val + key->enc_size, 0,
11866                sizeof(ev.key.val) - key->enc_size);
11867
11868         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
11869 }
11870
11871 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
11872 {
11873         struct mgmt_ev_new_irk ev;
11874
11875         memset(&ev, 0, sizeof(ev));
11876
11877         ev.store_hint = persistent;
11878
11879         bacpy(&ev.rpa, &irk->rpa);
11880         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
11881         ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type);
11882         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
11883
11884         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
11885 }
11886
11887 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
11888                    bool persistent)
11889 {
11890         struct mgmt_ev_new_csrk ev;
11891
11892         memset(&ev, 0, sizeof(ev));
11893
11894         /* Devices using resolvable or non-resolvable random addresses
11895          * without providing an identity resolving key don't require
11896          * to store signature resolving keys. Their addresses will change
11897          * the next time around.
11898          *
11899          * Only when a remote device provides an identity address
11900          * make sure the signature resolving key is stored. So allow
11901          * static random and public addresses here.
11902          */
11903         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
11904             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
11905                 ev.store_hint = 0x00;
11906         else
11907                 ev.store_hint = persistent;
11908
11909         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
11910         ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type);
11911         ev.key.type = csrk->type;
11912         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
11913
11914         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
11915 }
11916
11917 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
11918                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
11919                          u16 max_interval, u16 latency, u16 timeout)
11920 {
11921         struct mgmt_ev_new_conn_param ev;
11922
11923         if (!hci_is_identity_address(bdaddr, bdaddr_type))
11924                 return;
11925
11926         memset(&ev, 0, sizeof(ev));
11927         bacpy(&ev.addr.bdaddr, bdaddr);
11928         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
11929         ev.store_hint = store_hint;
11930         ev.min_interval = cpu_to_le16(min_interval);
11931         ev.max_interval = cpu_to_le16(max_interval);
11932         ev.latency = cpu_to_le16(latency);
11933         ev.timeout = cpu_to_le16(timeout);
11934
11935         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
11936 }
11937
11938 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
11939                            u8 *name, u8 name_len)
11940 {
11941         struct sk_buff *skb;
11942         struct mgmt_ev_device_connected *ev;
11943         u16 eir_len = 0;
11944         u32 flags = 0;
11945
11946         /* allocate buff for LE or BR/EDR adv */
11947         if (conn->le_adv_data_len > 0)
11948                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
11949                                      sizeof(*ev) + conn->le_adv_data_len);
11950         else
11951                 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
11952                                      sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
11953                                      eir_precalc_len(sizeof(conn->dev_class)));
11954
11955         ev = skb_put(skb, sizeof(*ev));
11956         bacpy(&ev->addr.bdaddr, &conn->dst);
11957         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
11958
11959         if (conn->out)
11960                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
11961
11962         ev->flags = __cpu_to_le32(flags);
11963
11964         /* We must ensure that the EIR Data fields are ordered and
11965          * unique. Keep it simple for now and avoid the problem by not
11966          * adding any BR/EDR data to the LE adv.
11967          */
11968         if (conn->le_adv_data_len > 0) {
11969                 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
11970                 eir_len = conn->le_adv_data_len;
11971         } else {
11972                 if (name)
11973                         eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
11974
11975                 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
11976                         eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
11977                                                     conn->dev_class, sizeof(conn->dev_class));
11978         }
11979
11980         ev->eir_len = cpu_to_le16(eir_len);
11981
11982         mgmt_event_skb(skb, NULL);
11983 }
11984
11985 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
11986 {
11987         struct sock **sk = data;
11988
11989         cmd->cmd_complete(cmd, 0);
11990
11991         *sk = cmd->sk;
11992         sock_hold(*sk);
11993
11994         mgmt_pending_remove(cmd);
11995 }
11996
11997 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
11998 {
11999         struct hci_dev *hdev = data;
12000         struct mgmt_cp_unpair_device *cp = cmd->param;
12001
12002         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
12003
12004         cmd->cmd_complete(cmd, 0);
12005         mgmt_pending_remove(cmd);
12006 }
12007
12008 bool mgmt_powering_down(struct hci_dev *hdev)
12009 {
12010         struct mgmt_pending_cmd *cmd;
12011         struct mgmt_mode *cp;
12012
12013         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
12014         if (!cmd)
12015                 return false;
12016
12017         cp = cmd->param;
12018         if (!cp->val)
12019                 return true;
12020
12021         return false;
12022 }
12023
12024 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12025                               u8 link_type, u8 addr_type, u8 reason,
12026                               bool mgmt_connected)
12027 {
12028         struct mgmt_ev_device_disconnected ev;
12029         struct sock *sk = NULL;
12030
12031         /* The connection is still in hci_conn_hash so test for 1
12032          * instead of 0 to know if this is the last one.
12033          */
12034         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
12035                 cancel_delayed_work(&hdev->power_off);
12036                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
12037         }
12038
12039         if (!mgmt_connected)
12040                 return;
12041
12042         if (link_type != ACL_LINK && link_type != LE_LINK)
12043                 return;
12044
12045         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
12046
12047         bacpy(&ev.addr.bdaddr, bdaddr);
12048         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12049         ev.reason = reason;
12050
12051         /* Report disconnects due to suspend */
12052         if (hdev->suspended)
12053                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
12054
12055         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
12056
12057         if (sk)
12058                 sock_put(sk);
12059
12060         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
12061                              hdev);
12062 }
12063
12064 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
12065                             u8 link_type, u8 addr_type, u8 status)
12066 {
12067         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
12068         struct mgmt_cp_disconnect *cp;
12069         struct mgmt_pending_cmd *cmd;
12070
12071         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
12072                              hdev);
12073
12074         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
12075         if (!cmd)
12076                 return;
12077
12078         cp = cmd->param;
12079
12080         if (bacmp(bdaddr, &cp->addr.bdaddr))
12081                 return;
12082
12083         if (cp->addr.type != bdaddr_type)
12084                 return;
12085
12086         cmd->cmd_complete(cmd, mgmt_status(status));
12087         mgmt_pending_remove(cmd);
12088 }
12089
12090 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
12091                          u8 addr_type, u8 status)
12092 {
12093         struct mgmt_ev_connect_failed ev;
12094
12095         /* The connection is still in hci_conn_hash so test for 1
12096          * instead of 0 to know if this is the last one.
12097          */
12098         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
12099                 cancel_delayed_work(&hdev->power_off);
12100                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
12101         }
12102
12103         bacpy(&ev.addr.bdaddr, bdaddr);
12104         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12105         ev.status = mgmt_status(status);
12106
12107         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
12108 }
12109
12110 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
12111 {
12112         struct mgmt_ev_pin_code_request ev;
12113
12114         bacpy(&ev.addr.bdaddr, bdaddr);
12115         ev.addr.type = BDADDR_BREDR;
12116         ev.secure = secure;
12117
12118         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
12119 }
12120
12121 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12122                                   u8 status)
12123 {
12124         struct mgmt_pending_cmd *cmd;
12125
12126         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
12127         if (!cmd)
12128                 return;
12129
12130         cmd->cmd_complete(cmd, mgmt_status(status));
12131         mgmt_pending_remove(cmd);
12132 }
12133
12134 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12135                                       u8 status)
12136 {
12137         struct mgmt_pending_cmd *cmd;
12138
12139         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
12140         if (!cmd)
12141                 return;
12142
12143         cmd->cmd_complete(cmd, mgmt_status(status));
12144         mgmt_pending_remove(cmd);
12145 }
12146
12147 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
12148                               u8 link_type, u8 addr_type, u32 value,
12149                               u8 confirm_hint)
12150 {
12151         struct mgmt_ev_user_confirm_request ev;
12152
12153         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
12154
12155         bacpy(&ev.addr.bdaddr, bdaddr);
12156         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12157         ev.confirm_hint = confirm_hint;
12158         ev.value = cpu_to_le32(value);
12159
12160         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
12161                           NULL);
12162 }
12163
12164 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
12165                               u8 link_type, u8 addr_type)
12166 {
12167         struct mgmt_ev_user_passkey_request ev;
12168
12169         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
12170
12171         bacpy(&ev.addr.bdaddr, bdaddr);
12172         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12173
12174         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
12175                           NULL);
12176 }
12177
12178 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12179                                       u8 link_type, u8 addr_type, u8 status,
12180                                       u8 opcode)
12181 {
12182         struct mgmt_pending_cmd *cmd;
12183
12184         cmd = pending_find(opcode, hdev);
12185         if (!cmd)
12186                 return -ENOENT;
12187
12188         cmd->cmd_complete(cmd, mgmt_status(status));
12189         mgmt_pending_remove(cmd);
12190
12191         return 0;
12192 }
12193
12194 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12195                                      u8 link_type, u8 addr_type, u8 status)
12196 {
12197         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12198                                           status, MGMT_OP_USER_CONFIRM_REPLY);
12199 }
12200
12201 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12202                                          u8 link_type, u8 addr_type, u8 status)
12203 {
12204         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12205                                           status,
12206                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
12207 }
12208
12209 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12210                                      u8 link_type, u8 addr_type, u8 status)
12211 {
12212         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12213                                           status, MGMT_OP_USER_PASSKEY_REPLY);
12214 }
12215
12216 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
12217                                          u8 link_type, u8 addr_type, u8 status)
12218 {
12219         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
12220                                           status,
12221                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
12222 }
12223
12224 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
12225                              u8 link_type, u8 addr_type, u32 passkey,
12226                              u8 entered)
12227 {
12228         struct mgmt_ev_passkey_notify ev;
12229
12230         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
12231
12232         bacpy(&ev.addr.bdaddr, bdaddr);
12233         ev.addr.type = link_to_bdaddr(link_type, addr_type);
12234         ev.passkey = __cpu_to_le32(passkey);
12235         ev.entered = entered;
12236
12237         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
12238 }
12239
12240 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
12241 {
12242         struct mgmt_ev_auth_failed ev;
12243         struct mgmt_pending_cmd *cmd;
12244         u8 status = mgmt_status(hci_status);
12245
12246         bacpy(&ev.addr.bdaddr, &conn->dst);
12247         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
12248         ev.status = status;
12249
12250         cmd = find_pairing(conn);
12251
12252         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
12253                     cmd ? cmd->sk : NULL);
12254
12255         if (cmd) {
12256                 cmd->cmd_complete(cmd, status);
12257                 mgmt_pending_remove(cmd);
12258         }
12259 }
12260
12261 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
12262 {
12263         struct cmd_lookup match = { NULL, hdev };
12264         bool changed;
12265
12266         if (status) {
12267                 u8 mgmt_err = mgmt_status(status);
12268                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
12269                                      cmd_status_rsp, &mgmt_err);
12270                 return;
12271         }
12272
12273         if (test_bit(HCI_AUTH, &hdev->flags))
12274                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
12275         else
12276                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
12277
12278         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
12279                              &match);
12280
12281         if (changed)
12282                 new_settings(hdev, match.sk);
12283
12284         if (match.sk)
12285                 sock_put(match.sk);
12286 }
12287
12288 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
12289 {
12290         struct cmd_lookup *match = data;
12291
12292         if (match->sk == NULL) {
12293                 match->sk = cmd->sk;
12294                 sock_hold(match->sk);
12295         }
12296 }
12297
12298 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
12299                                     u8 status)
12300 {
12301         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
12302
12303         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
12304         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
12305         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
12306
12307         if (!status) {
12308                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
12309                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
12310                 ext_info_changed(hdev, NULL);
12311         }
12312
12313         if (match.sk)
12314                 sock_put(match.sk);
12315 }
12316
12317 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
12318 {
12319         struct mgmt_cp_set_local_name ev;
12320         struct mgmt_pending_cmd *cmd;
12321
12322         if (status)
12323                 return;
12324
12325         memset(&ev, 0, sizeof(ev));
12326         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
12327         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
12328
12329         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
12330         if (!cmd) {
12331                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
12332
12333                 /* If this is a HCI command related to powering on the
12334                  * HCI dev don't send any mgmt signals.
12335                  */
12336                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
12337                         return;
12338         }
12339
12340         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
12341                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
12342         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
12343 }
12344
12345 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
12346 {
12347         int i;
12348
12349         for (i = 0; i < uuid_count; i++) {
12350                 if (!memcmp(uuid, uuids[i], 16))
12351                         return true;
12352         }
12353
12354         return false;
12355 }
12356
12357 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
12358 {
12359         u16 parsed = 0;
12360
12361         while (parsed < eir_len) {
12362                 u8 field_len = eir[0];
12363                 u8 uuid[16];
12364                 int i;
12365
12366                 if (field_len == 0)
12367                         break;
12368
12369                 if (eir_len - parsed < field_len + 1)
12370                         break;
12371
12372                 switch (eir[1]) {
12373                 case EIR_UUID16_ALL:
12374                 case EIR_UUID16_SOME:
12375                         for (i = 0; i + 3 <= field_len; i += 2) {
12376                                 memcpy(uuid, bluetooth_base_uuid, 16);
12377                                 uuid[13] = eir[i + 3];
12378                                 uuid[12] = eir[i + 2];
12379                                 if (has_uuid(uuid, uuid_count, uuids))
12380                                         return true;
12381                         }
12382                         break;
12383                 case EIR_UUID32_ALL:
12384                 case EIR_UUID32_SOME:
12385                         for (i = 0; i + 5 <= field_len; i += 4) {
12386                                 memcpy(uuid, bluetooth_base_uuid, 16);
12387                                 uuid[15] = eir[i + 5];
12388                                 uuid[14] = eir[i + 4];
12389                                 uuid[13] = eir[i + 3];
12390                                 uuid[12] = eir[i + 2];
12391                                 if (has_uuid(uuid, uuid_count, uuids))
12392                                         return true;
12393                         }
12394                         break;
12395                 case EIR_UUID128_ALL:
12396                 case EIR_UUID128_SOME:
12397                         for (i = 0; i + 17 <= field_len; i += 16) {
12398                                 memcpy(uuid, eir + i + 2, 16);
12399                                 if (has_uuid(uuid, uuid_count, uuids))
12400                                         return true;
12401                         }
12402                         break;
12403                 }
12404
12405                 parsed += field_len + 1;
12406                 eir += field_len + 1;
12407         }
12408
12409         return false;
12410 }
12411
12412 static void restart_le_scan(struct hci_dev *hdev)
12413 {
12414         /* If controller is not scanning we are done. */
12415         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
12416                 return;
12417
12418         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
12419                        hdev->discovery.scan_start +
12420                        hdev->discovery.scan_duration))
12421                 return;
12422
12423         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
12424                            DISCOV_LE_RESTART_DELAY);
12425 }
12426
12427 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
12428                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
12429 {
12430         /* If a RSSI threshold has been specified, and
12431          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
12432          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
12433          * is set, let it through for further processing, as we might need to
12434          * restart the scan.
12435          *
12436          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
12437          * the results are also dropped.
12438          */
12439         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
12440             (rssi == HCI_RSSI_INVALID ||
12441             (rssi < hdev->discovery.rssi &&
12442              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
12443                 return  false;
12444
12445         if (hdev->discovery.uuid_count != 0) {
12446                 /* If a list of UUIDs is provided in filter, results with no
12447                  * matching UUID should be dropped.
12448                  */
12449                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
12450                                    hdev->discovery.uuids) &&
12451                     !eir_has_uuids(scan_rsp, scan_rsp_len,
12452                                    hdev->discovery.uuid_count,
12453                                    hdev->discovery.uuids))
12454                         return false;
12455         }
12456
12457         /* If duplicate filtering does not report RSSI changes, then restart
12458          * scanning to ensure updated result with updated RSSI values.
12459          */
12460         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
12461                 restart_le_scan(hdev);
12462
12463                 /* Validate RSSI value against the RSSI threshold once more. */
12464                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
12465                     rssi < hdev->discovery.rssi)
12466                         return false;
12467         }
12468
12469         return true;
12470 }
12471
12472 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
12473                                   bdaddr_t *bdaddr, u8 addr_type)
12474 {
12475         struct mgmt_ev_adv_monitor_device_lost ev;
12476
12477         ev.monitor_handle = cpu_to_le16(handle);
12478         bacpy(&ev.addr.bdaddr, bdaddr);
12479         ev.addr.type = addr_type;
12480
12481         mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
12482                    NULL);
12483 }
12484
12485 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
12486                                                struct sk_buff *skb,
12487                                                struct sock *skip_sk,
12488                                                u16 handle)
12489 {
12490         struct sk_buff *advmon_skb;
12491         size_t advmon_skb_len;
12492         __le16 *monitor_handle;
12493
12494         if (!skb)
12495                 return;
12496
12497         advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
12498                           sizeof(struct mgmt_ev_device_found)) + skb->len;
12499         advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
12500                                     advmon_skb_len);
12501         if (!advmon_skb)
12502                 return;
12503
12504         /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
12505          * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
12506          * store monitor_handle of the matched monitor.
12507          */
12508         monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
12509         *monitor_handle = cpu_to_le16(handle);
12510         skb_put_data(advmon_skb, skb->data, skb->len);
12511
12512         mgmt_event_skb(advmon_skb, skip_sk);
12513 }
12514
12515 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
12516                                           bdaddr_t *bdaddr, bool report_device,
12517                                           struct sk_buff *skb,
12518                                           struct sock *skip_sk)
12519 {
12520         struct monitored_device *dev, *tmp;
12521         bool matched = false;
12522         bool notified = false;
12523
12524         /* We have received the Advertisement Report because:
12525          * 1. the kernel has initiated active discovery
12526          * 2. if not, we have pend_le_reports > 0 in which case we are doing
12527          *    passive scanning
12528          * 3. if none of the above is true, we have one or more active
12529          *    Advertisement Monitor
12530          *
12531          * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
12532          * and report ONLY one advertisement per device for the matched Monitor
12533          * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
12534          *
12535          * For case 3, since we are not active scanning and all advertisements
12536          * received are due to a matched Advertisement Monitor, report all
12537          * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
12538          */
12539         if (report_device && !hdev->advmon_pend_notify) {
12540                 mgmt_event_skb(skb, skip_sk);
12541                 return;
12542         }
12543
12544         hdev->advmon_pend_notify = false;
12545
12546         list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
12547                 if (!bacmp(&dev->bdaddr, bdaddr)) {
12548                         matched = true;
12549
12550                         if (!dev->notified) {
12551                                 mgmt_send_adv_monitor_device_found(hdev, skb,
12552                                                                    skip_sk,
12553                                                                    dev->handle);
12554                                 notified = true;
12555                                 dev->notified = true;
12556                         }
12557                 }
12558
12559                 if (!dev->notified)
12560                         hdev->advmon_pend_notify = true;
12561         }
12562
12563         if (!report_device &&
12564             ((matched && !notified) || !msft_monitor_supported(hdev))) {
12565                 /* Handle 0 indicates that we are not active scanning and this
12566                  * is a subsequent advertisement report for an already matched
12567                  * Advertisement Monitor or the controller offloading support
12568                  * is not available.
12569                  */
12570                 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
12571         }
12572
12573         if (report_device)
12574                 mgmt_event_skb(skb, skip_sk);
12575         else
12576                 kfree_skb(skb);
12577 }
12578
12579 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
12580                               u8 addr_type, s8 rssi, u32 flags, u8 *eir,
12581                               u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
12582                               u64 instant)
12583 {
12584         struct sk_buff *skb;
12585         struct mgmt_ev_mesh_device_found *ev;
12586         int i, j;
12587
12588         if (!hdev->mesh_ad_types[0])
12589                 goto accepted;
12590
12591         /* Scan for requested AD types */
12592         if (eir_len > 0) {
12593                 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
12594                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
12595                                 if (!hdev->mesh_ad_types[j])
12596                                         break;
12597
12598                                 if (hdev->mesh_ad_types[j] == eir[i + 1])
12599                                         goto accepted;
12600                         }
12601                 }
12602         }
12603
12604         if (scan_rsp_len > 0) {
12605                 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
12606                         for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
12607                                 if (!hdev->mesh_ad_types[j])
12608                                         break;
12609
12610                                 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
12611                                         goto accepted;
12612                         }
12613                 }
12614         }
12615
12616         return;
12617
12618 accepted:
12619         skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
12620                              sizeof(*ev) + eir_len + scan_rsp_len);
12621         if (!skb)
12622                 return;
12623
12624         ev = skb_put(skb, sizeof(*ev));
12625
12626         bacpy(&ev->addr.bdaddr, bdaddr);
12627         ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
12628         ev->rssi = rssi;
12629         ev->flags = cpu_to_le32(flags);
12630         ev->instant = cpu_to_le64(instant);
12631
12632         if (eir_len > 0)
12633                 /* Copy EIR or advertising data into event */
12634                 skb_put_data(skb, eir, eir_len);
12635
12636         if (scan_rsp_len > 0)
12637                 /* Append scan response data to event */
12638                 skb_put_data(skb, scan_rsp, scan_rsp_len);
12639
12640         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
12641
12642         mgmt_event_skb(skb, NULL);
12643 }
12644
12645 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
12646                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
12647                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
12648                        u64 instant)
12649 {
12650         struct sk_buff *skb;
12651         struct mgmt_ev_device_found *ev;
12652         bool report_device = hci_discovery_active(hdev);
12653
12654         if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
12655                 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
12656                                   eir, eir_len, scan_rsp, scan_rsp_len,
12657                                   instant);
12658
12659         /* Don't send events for a non-kernel initiated discovery. With
12660          * LE one exception is if we have pend_le_reports > 0 in which
12661          * case we're doing passive scanning and want these events.
12662          */
12663         if (!hci_discovery_active(hdev)) {
12664                 if (link_type == ACL_LINK)
12665                         return;
12666                 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
12667                         report_device = true;
12668                 else if (!hci_is_adv_monitoring(hdev))
12669                         return;
12670         }
12671
12672         if (hdev->discovery.result_filtering) {
12673                 /* We are using service discovery */
12674                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
12675                                      scan_rsp_len))
12676                         return;
12677         }
12678
12679         if (hdev->discovery.limited) {
12680                 /* Check for limited discoverable bit */
12681                 if (dev_class) {
12682                         if (!(dev_class[1] & 0x20))
12683                                 return;
12684                 } else {
12685                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
12686                         if (!flags || !(flags[0] & LE_AD_LIMITED))
12687                                 return;
12688                 }
12689         }
12690
12691         /* Allocate skb. The 5 extra bytes are for the potential CoD field */
12692         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
12693                              sizeof(*ev) + eir_len + scan_rsp_len + 5);
12694         if (!skb)
12695                 return;
12696
12697         ev = skb_put(skb, sizeof(*ev));
12698
12699         /* In case of device discovery with BR/EDR devices (pre 1.2), the
12700          * RSSI value was reported as 0 when not available. This behavior
12701          * is kept when using device discovery. This is required for full
12702          * backwards compatibility with the API.
12703          *
12704          * However when using service discovery, the value 127 will be
12705          * returned when the RSSI is not available.
12706          */
12707         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
12708             link_type == ACL_LINK)
12709                 rssi = 0;
12710
12711         bacpy(&ev->addr.bdaddr, bdaddr);
12712         ev->addr.type = link_to_bdaddr(link_type, addr_type);
12713         ev->rssi = rssi;
12714         ev->flags = cpu_to_le32(flags);
12715
12716         if (eir_len > 0)
12717                 /* Copy EIR or advertising data into event */
12718                 skb_put_data(skb, eir, eir_len);
12719
12720         if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
12721                 u8 eir_cod[5];
12722
12723                 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
12724                                            dev_class, 3);
12725                 skb_put_data(skb, eir_cod, sizeof(eir_cod));
12726         }
12727
12728         if (scan_rsp_len > 0)
12729                 /* Append scan response data to event */
12730                 skb_put_data(skb, scan_rsp, scan_rsp_len);
12731
12732         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
12733
12734         mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
12735 }
12736
12737 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
12738                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
12739 {
12740         struct sk_buff *skb;
12741         struct mgmt_ev_device_found *ev;
12742         u16 eir_len = 0;
12743         u32 flags = 0;
12744
12745         skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
12746                              sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
12747
12748         ev = skb_put(skb, sizeof(*ev));
12749         bacpy(&ev->addr.bdaddr, bdaddr);
12750         ev->addr.type = link_to_bdaddr(link_type, addr_type);
12751         ev->rssi = rssi;
12752
12753         if (name)
12754                 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
12755         else
12756                 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
12757
12758         ev->eir_len = cpu_to_le16(eir_len);
12759         ev->flags = cpu_to_le32(flags);
12760
12761         mgmt_event_skb(skb, NULL);
12762 }
12763
12764 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
12765 {
12766         struct mgmt_ev_discovering ev;
12767
12768         bt_dev_dbg(hdev, "discovering %u", discovering);
12769
12770         memset(&ev, 0, sizeof(ev));
12771         ev.type = hdev->discovery.type;
12772         ev.discovering = discovering;
12773
12774         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
12775 }
12776
12777 void mgmt_suspending(struct hci_dev *hdev, u8 state)
12778 {
12779         struct mgmt_ev_controller_suspend ev;
12780
12781         ev.suspend_state = state;
12782         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
12783 }
12784
12785 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
12786                    u8 addr_type)
12787 {
12788         struct mgmt_ev_controller_resume ev;
12789
12790         ev.wake_reason = reason;
12791         if (bdaddr) {
12792                 bacpy(&ev.addr.bdaddr, bdaddr);
12793                 ev.addr.type = addr_type;
12794         } else {
12795                 memset(&ev.addr, 0, sizeof(ev.addr));
12796         }
12797
12798         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
12799 }
12800
12801 static struct hci_mgmt_chan chan = {
12802         .channel        = HCI_CHANNEL_CONTROL,
12803         .handler_count  = ARRAY_SIZE(mgmt_handlers),
12804         .handlers       = mgmt_handlers,
12805 #ifdef TIZEN_BT
12806         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
12807         .tizen_handlers = tizen_mgmt_handlers,
12808 #endif
12809         .hdev_init      = mgmt_init_hdev,
12810 };
12811
12812 int mgmt_init(void)
12813 {
12814         return hci_mgmt_chan_register(&chan);
12815 }
12816
12817 void mgmt_exit(void)
12818 {
12819         hci_mgmt_chan_unregister(&chan);
12820 }
12821
12822 void mgmt_cleanup(struct sock *sk)
12823 {
12824         struct mgmt_mesh_tx *mesh_tx;
12825         struct hci_dev *hdev;
12826
12827         read_lock(&hci_dev_list_lock);
12828
12829         list_for_each_entry(hdev, &hci_dev_list, list) {
12830                 do {
12831                         mesh_tx = mgmt_mesh_next(hdev, sk);
12832
12833                         if (mesh_tx)
12834                                 mesh_send_complete(hdev, mesh_tx, true);
12835                 } while (mesh_tx);
12836         }
12837
12838         read_unlock(&hci_dev_list_lock);
12839 }