net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35 #ifdef TIZEN_BT
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #endif
  38
  39 #include "hci_request.h"
  40 #include "smp.h"
  41 #include "mgmt_util.h"
  42 #include "mgmt_config.h"
  43 #include "msft.h"
  44
  45 #define MGMT_VERSION    1
  46 #define MGMT_REVISION   21
  47
  48 static const u16 mgmt_commands[] = {
  49         MGMT_OP_READ_INDEX_LIST,
  50         MGMT_OP_READ_INFO,
  51         MGMT_OP_SET_POWERED,
  52         MGMT_OP_SET_DISCOVERABLE,
  53         MGMT_OP_SET_CONNECTABLE,
  54         MGMT_OP_SET_FAST_CONNECTABLE,
  55         MGMT_OP_SET_BONDABLE,
  56         MGMT_OP_SET_LINK_SECURITY,
  57         MGMT_OP_SET_SSP,
  58         MGMT_OP_SET_HS,
  59         MGMT_OP_SET_LE,
  60         MGMT_OP_SET_DEV_CLASS,
  61         MGMT_OP_SET_LOCAL_NAME,
  62         MGMT_OP_ADD_UUID,
  63         MGMT_OP_REMOVE_UUID,
  64         MGMT_OP_LOAD_LINK_KEYS,
  65         MGMT_OP_LOAD_LONG_TERM_KEYS,
  66         MGMT_OP_DISCONNECT,
  67         MGMT_OP_GET_CONNECTIONS,
  68         MGMT_OP_PIN_CODE_REPLY,
  69         MGMT_OP_PIN_CODE_NEG_REPLY,
  70         MGMT_OP_SET_IO_CAPABILITY,
  71         MGMT_OP_PAIR_DEVICE,
  72         MGMT_OP_CANCEL_PAIR_DEVICE,
  73         MGMT_OP_UNPAIR_DEVICE,
  74         MGMT_OP_USER_CONFIRM_REPLY,
  75         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  76         MGMT_OP_USER_PASSKEY_REPLY,
  77         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  78         MGMT_OP_READ_LOCAL_OOB_DATA,
  79         MGMT_OP_ADD_REMOTE_OOB_DATA,
  80         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  81         MGMT_OP_START_DISCOVERY,
  82         MGMT_OP_STOP_DISCOVERY,
  83         MGMT_OP_CONFIRM_NAME,
  84         MGMT_OP_BLOCK_DEVICE,
  85         MGMT_OP_UNBLOCK_DEVICE,
  86         MGMT_OP_SET_DEVICE_ID,
  87         MGMT_OP_SET_ADVERTISING,
  88         MGMT_OP_SET_BREDR,
  89         MGMT_OP_SET_STATIC_ADDRESS,
  90         MGMT_OP_SET_SCAN_PARAMS,
  91         MGMT_OP_SET_SECURE_CONN,
  92         MGMT_OP_SET_DEBUG_KEYS,
  93         MGMT_OP_SET_PRIVACY,
  94         MGMT_OP_LOAD_IRKS,
  95         MGMT_OP_GET_CONN_INFO,
  96         MGMT_OP_GET_CLOCK_INFO,
  97         MGMT_OP_ADD_DEVICE,
  98         MGMT_OP_REMOVE_DEVICE,
  99         MGMT_OP_LOAD_CONN_PARAM,
 100         MGMT_OP_READ_UNCONF_INDEX_LIST,
 101         MGMT_OP_READ_CONFIG_INFO,
 102         MGMT_OP_SET_EXTERNAL_CONFIG,
 103         MGMT_OP_SET_PUBLIC_ADDRESS,
 104         MGMT_OP_START_SERVICE_DISCOVERY,
 105         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 106         MGMT_OP_READ_EXT_INDEX_LIST,
 107         MGMT_OP_READ_ADV_FEATURES,
 108         MGMT_OP_ADD_ADVERTISING,
 109         MGMT_OP_REMOVE_ADVERTISING,
 110         MGMT_OP_GET_ADV_SIZE_INFO,
 111         MGMT_OP_START_LIMITED_DISCOVERY,
 112         MGMT_OP_READ_EXT_INFO,
 113         MGMT_OP_SET_APPEARANCE,
 114         MGMT_OP_GET_PHY_CONFIGURATION,
 115         MGMT_OP_SET_PHY_CONFIGURATION,
 116         MGMT_OP_SET_BLOCKED_KEYS,
 117         MGMT_OP_SET_WIDEBAND_SPEECH,
 118         MGMT_OP_READ_CONTROLLER_CAP,
 119         MGMT_OP_READ_EXP_FEATURES_INFO,
 120         MGMT_OP_SET_EXP_FEATURE,
 121         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 122         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 123         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 124         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 125         MGMT_OP_GET_DEVICE_FLAGS,
 126         MGMT_OP_SET_DEVICE_FLAGS,
 127         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 128         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 129         MGMT_OP_REMOVE_ADV_MONITOR,
 130         MGMT_OP_ADD_EXT_ADV_PARAMS,
 131         MGMT_OP_ADD_EXT_ADV_DATA,
 132         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 133 };
 134
 135 static const u16 mgmt_events[] = {
 136         MGMT_EV_CONTROLLER_ERROR,
 137         MGMT_EV_INDEX_ADDED,
 138         MGMT_EV_INDEX_REMOVED,
 139         MGMT_EV_NEW_SETTINGS,
 140         MGMT_EV_CLASS_OF_DEV_CHANGED,
 141         MGMT_EV_LOCAL_NAME_CHANGED,
 142         MGMT_EV_NEW_LINK_KEY,
 143         MGMT_EV_NEW_LONG_TERM_KEY,
 144         MGMT_EV_DEVICE_CONNECTED,
 145         MGMT_EV_DEVICE_DISCONNECTED,
 146         MGMT_EV_CONNECT_FAILED,
 147         MGMT_EV_PIN_CODE_REQUEST,
 148         MGMT_EV_USER_CONFIRM_REQUEST,
 149         MGMT_EV_USER_PASSKEY_REQUEST,
 150         MGMT_EV_AUTH_FAILED,
 151         MGMT_EV_DEVICE_FOUND,
 152         MGMT_EV_DISCOVERING,
 153         MGMT_EV_DEVICE_BLOCKED,
 154         MGMT_EV_DEVICE_UNBLOCKED,
 155         MGMT_EV_DEVICE_UNPAIRED,
 156         MGMT_EV_PASSKEY_NOTIFY,
 157         MGMT_EV_NEW_IRK,
 158         MGMT_EV_NEW_CSRK,
 159         MGMT_EV_DEVICE_ADDED,
 160         MGMT_EV_DEVICE_REMOVED,
 161         MGMT_EV_NEW_CONN_PARAM,
 162         MGMT_EV_UNCONF_INDEX_ADDED,
 163         MGMT_EV_UNCONF_INDEX_REMOVED,
 164         MGMT_EV_NEW_CONFIG_OPTIONS,
 165         MGMT_EV_EXT_INDEX_ADDED,
 166         MGMT_EV_EXT_INDEX_REMOVED,
 167         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 168         MGMT_EV_ADVERTISING_ADDED,
 169         MGMT_EV_ADVERTISING_REMOVED,
 170         MGMT_EV_EXT_INFO_CHANGED,
 171         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 172         MGMT_EV_EXP_FEATURE_CHANGED,
 173         MGMT_EV_DEVICE_FLAGS_CHANGED,
 174         MGMT_EV_ADV_MONITOR_ADDED,
 175         MGMT_EV_ADV_MONITOR_REMOVED,
 176         MGMT_EV_CONTROLLER_SUSPEND,
 177         MGMT_EV_CONTROLLER_RESUME,
 178 };
 179
 180 static const u16 mgmt_untrusted_commands[] = {
 181         MGMT_OP_READ_INDEX_LIST,
 182         MGMT_OP_READ_INFO,
 183         MGMT_OP_READ_UNCONF_INDEX_LIST,
 184         MGMT_OP_READ_CONFIG_INFO,
 185         MGMT_OP_READ_EXT_INDEX_LIST,
 186         MGMT_OP_READ_EXT_INFO,
 187         MGMT_OP_READ_CONTROLLER_CAP,
 188         MGMT_OP_READ_EXP_FEATURES_INFO,
 189         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 190         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 191 };
 192
 193 static const u16 mgmt_untrusted_events[] = {
 194         MGMT_EV_INDEX_ADDED,
 195         MGMT_EV_INDEX_REMOVED,
 196         MGMT_EV_NEW_SETTINGS,
 197         MGMT_EV_CLASS_OF_DEV_CHANGED,
 198         MGMT_EV_LOCAL_NAME_CHANGED,
 199         MGMT_EV_UNCONF_INDEX_ADDED,
 200         MGMT_EV_UNCONF_INDEX_REMOVED,
 201         MGMT_EV_NEW_CONFIG_OPTIONS,
 202         MGMT_EV_EXT_INDEX_ADDED,
 203         MGMT_EV_EXT_INDEX_REMOVED,
 204         MGMT_EV_EXT_INFO_CHANGED,
 205         MGMT_EV_EXP_FEATURE_CHANGED,
 206 };
 207
 208 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 209
 210 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 211                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 212
 213 /* HCI to MGMT error code conversion table */
 214 static const u8 mgmt_status_table[] = {
 215         MGMT_STATUS_SUCCESS,
 216         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 217         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 218         MGMT_STATUS_FAILED,             /* Hardware Failure */
 219         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 220         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 221         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 222         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 223         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 224         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 225         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 226         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 227         MGMT_STATUS_BUSY,               /* Command Disallowed */
 228         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 229         MGMT_STATUS_REJECTED,           /* Rejected Security */
 230         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 231         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 232         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 233         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 234         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 235         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 236         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 237         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 238         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 239         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 240         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 241         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 242         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 243         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 244         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 245         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 246         MGMT_STATUS_FAILED,             /* Unspecified Error */
 247         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 248         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 249         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 250         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 251         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 252         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 253         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 254         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 255         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 256         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 257         MGMT_STATUS_FAILED,             /* Transaction Collision */
 258         MGMT_STATUS_FAILED,             /* Reserved for future use */
 259         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 260         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 261         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 262         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 263         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 264         MGMT_STATUS_FAILED,             /* Reserved for future use */
 265         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 266         MGMT_STATUS_FAILED,             /* Reserved for future use */
 267         MGMT_STATUS_FAILED,             /* Slot Violation */
 268         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 269         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 270         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 271         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 272         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 273         MGMT_STATUS_BUSY,               /* Controller Busy */
 274         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 275         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 276         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 277         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 278         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 279 };
 280
 281 static u8 mgmt_status(u8 hci_status)
 282 {
 283         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 284                 return mgmt_status_table[hci_status];
 285
 286         return MGMT_STATUS_FAILED;
 287 }
 288
 289 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 290                             u16 len, int flag)
 291 {
 292         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 293                                flag, NULL);
 294 }
 295
 296 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 297                               u16 len, int flag, struct sock *skip_sk)
 298 {
 299         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 300                                flag, skip_sk);
 301 }
 302
 303 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 304                       struct sock *skip_sk)
 305 {
 306         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 307                                HCI_SOCK_TRUSTED, skip_sk);
 308 }
 309
 310 static u8 le_addr_type(u8 mgmt_addr_type)
 311 {
 312         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 313                 return ADDR_LE_DEV_PUBLIC;
 314         else
 315                 return ADDR_LE_DEV_RANDOM;
 316 }
 317
 318 void mgmt_fill_version_info(void *ver)
 319 {
 320         struct mgmt_rp_read_version *rp = ver;
 321
 322         rp->version = MGMT_VERSION;
 323         rp->revision = cpu_to_le16(MGMT_REVISION);
 324 }
 325
 326 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 327                         u16 data_len)
 328 {
 329         struct mgmt_rp_read_version rp;
 330
 331         bt_dev_dbg(hdev, "sock %p", sk);
 332
 333         mgmt_fill_version_info(&rp);
 334
 335         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 336                                  &rp, sizeof(rp));
 337 }
 338
 339 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 340                          u16 data_len)
 341 {
 342         struct mgmt_rp_read_commands *rp;
 343         u16 num_commands, num_events;
 344         size_t rp_size;
 345         int i, err;
 346
 347         bt_dev_dbg(hdev, "sock %p", sk);
 348
 349         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 350                 num_commands = ARRAY_SIZE(mgmt_commands);
 351                 num_events = ARRAY_SIZE(mgmt_events);
 352         } else {
 353                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 354                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 355         }
 356
 357         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 358
 359         rp = kmalloc(rp_size, GFP_KERNEL);
 360         if (!rp)
 361                 return -ENOMEM;
 362
 363         rp->num_commands = cpu_to_le16(num_commands);
 364         rp->num_events = cpu_to_le16(num_events);
 365
 366         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 367                 __le16 *opcode = rp->opcodes;
 368
 369                 for (i = 0; i < num_commands; i++, opcode++)
 370                         put_unaligned_le16(mgmt_commands[i], opcode);
 371
 372                 for (i = 0; i < num_events; i++, opcode++)
 373                         put_unaligned_le16(mgmt_events[i], opcode);
 374         } else {
 375                 __le16 *opcode = rp->opcodes;
 376
 377                 for (i = 0; i < num_commands; i++, opcode++)
 378                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 379
 380                 for (i = 0; i < num_events; i++, opcode++)
 381                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 382         }
 383
 384         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 385                                 rp, rp_size);
 386         kfree(rp);
 387
 388         return err;
 389 }
 390
 391 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 392                            u16 data_len)
 393 {
 394         struct mgmt_rp_read_index_list *rp;
 395         struct hci_dev *d;
 396         size_t rp_len;
 397         u16 count;
 398         int err;
 399
 400         bt_dev_dbg(hdev, "sock %p", sk);
 401
 402         read_lock(&hci_dev_list_lock);
 403
 404         count = 0;
 405         list_for_each_entry(d, &hci_dev_list, list) {
 406                 if (d->dev_type == HCI_PRIMARY &&
 407                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 408                         count++;
 409         }
 410
 411         rp_len = sizeof(*rp) + (2 * count);
 412         rp = kmalloc(rp_len, GFP_ATOMIC);
 413         if (!rp) {
 414                 read_unlock(&hci_dev_list_lock);
 415                 return -ENOMEM;
 416         }
 417
 418         count = 0;
 419         list_for_each_entry(d, &hci_dev_list, list) {
 420                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 421                     hci_dev_test_flag(d, HCI_CONFIG) ||
 422                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 423                         continue;
 424
 425                 /* Devices marked as raw-only are neither configured
 426                  * nor unconfigured controllers.
 427                  */
 428                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 429                         continue;
 430
 431                 if (d->dev_type == HCI_PRIMARY &&
 432                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 433                         rp->index[count++] = cpu_to_le16(d->id);
 434                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 435                 }
 436         }
 437
 438         rp->num_controllers = cpu_to_le16(count);
 439         rp_len = sizeof(*rp) + (2 * count);
 440
 441         read_unlock(&hci_dev_list_lock);
 442
 443         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 444                                 0, rp, rp_len);
 445
 446         kfree(rp);
 447
 448         return err;
 449 }
 450
 451 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 452                                   void *data, u16 data_len)
 453 {
 454         struct mgmt_rp_read_unconf_index_list *rp;
 455         struct hci_dev *d;
 456         size_t rp_len;
 457         u16 count;
 458         int err;
 459
 460         bt_dev_dbg(hdev, "sock %p", sk);
 461
 462         read_lock(&hci_dev_list_lock);
 463
 464         count = 0;
 465         list_for_each_entry(d, &hci_dev_list, list) {
 466                 if (d->dev_type == HCI_PRIMARY &&
 467                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 468                         count++;
 469         }
 470
 471         rp_len = sizeof(*rp) + (2 * count);
 472         rp = kmalloc(rp_len, GFP_ATOMIC);
 473         if (!rp) {
 474                 read_unlock(&hci_dev_list_lock);
 475                 return -ENOMEM;
 476         }
 477
 478         count = 0;
 479         list_for_each_entry(d, &hci_dev_list, list) {
 480                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 481                     hci_dev_test_flag(d, HCI_CONFIG) ||
 482                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 483                         continue;
 484
 485                 /* Devices marked as raw-only are neither configured
 486                  * nor unconfigured controllers.
 487                  */
 488                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 489                         continue;
 490
 491                 if (d->dev_type == HCI_PRIMARY &&
 492                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 493                         rp->index[count++] = cpu_to_le16(d->id);
 494                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 495                 }
 496         }
 497
 498         rp->num_controllers = cpu_to_le16(count);
 499         rp_len = sizeof(*rp) + (2 * count);
 500
 501         read_unlock(&hci_dev_list_lock);
 502
 503         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 504                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 505
 506         kfree(rp);
 507
 508         return err;
 509 }
 510
 511 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 512                                void *data, u16 data_len)
 513 {
 514         struct mgmt_rp_read_ext_index_list *rp;
 515         struct hci_dev *d;
 516         u16 count;
 517         int err;
 518
 519         bt_dev_dbg(hdev, "sock %p", sk);
 520
 521         read_lock(&hci_dev_list_lock);
 522
 523         count = 0;
 524         list_for_each_entry(d, &hci_dev_list, list) {
 525                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 526                         count++;
 527         }
 528
 529         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 530         if (!rp) {
 531                 read_unlock(&hci_dev_list_lock);
 532                 return -ENOMEM;
 533         }
 534
 535         count = 0;
 536         list_for_each_entry(d, &hci_dev_list, list) {
 537                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 538                     hci_dev_test_flag(d, HCI_CONFIG) ||
 539                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 540                         continue;
 541
 542                 /* Devices marked as raw-only are neither configured
 543                  * nor unconfigured controllers.
 544                  */
 545                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 546                         continue;
 547
 548                 if (d->dev_type == HCI_PRIMARY) {
 549                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 550                                 rp->entry[count].type = 0x01;
 551                         else
 552                                 rp->entry[count].type = 0x00;
 553                 } else if (d->dev_type == HCI_AMP) {
 554                         rp->entry[count].type = 0x02;
 555                 } else {
 556                         continue;
 557                 }
 558
 559                 rp->entry[count].bus = d->bus;
 560                 rp->entry[count++].index = cpu_to_le16(d->id);
 561                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 562         }
 563
 564         rp->num_controllers = cpu_to_le16(count);
 565
 566         read_unlock(&hci_dev_list_lock);
 567
 568         /* If this command is called at least once, then all the
 569          * default index and unconfigured index events are disabled
 570          * and from now on only extended index events are used.
 571          */
 572         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 573         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 574         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 575
 576         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 577                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 578                                 struct_size(rp, entry, count));
 579
 580         kfree(rp);
 581
 582         return err;
 583 }
 584
 585 static bool is_configured(struct hci_dev *hdev)
 586 {
 587         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 588             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 589                 return false;
 590
 591         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 592              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 593             !bacmp(&hdev->public_addr, BDADDR_ANY))
 594                 return false;
 595
 596         return true;
 597 }
 598
 599 static __le32 get_missing_options(struct hci_dev *hdev)
 600 {
 601         u32 options = 0;
 602
 603         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 604             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 605                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 606
 607         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 608              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 609             !bacmp(&hdev->public_addr, BDADDR_ANY))
 610                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 611
 612         return cpu_to_le32(options);
 613 }
 614
 615 static int new_options(struct hci_dev *hdev, struct sock *skip)
 616 {
 617         __le32 options = get_missing_options(hdev);
 618
 619         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 620                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 621 }
 622
 623 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 624 {
 625         __le32 options = get_missing_options(hdev);
 626
 627         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 628                                  sizeof(options));
 629 }
 630
 631 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 632                             void *data, u16 data_len)
 633 {
 634         struct mgmt_rp_read_config_info rp;
 635         u32 options = 0;
 636
 637         bt_dev_dbg(hdev, "sock %p", sk);
 638
 639         hci_dev_lock(hdev);
 640
 641         memset(&rp, 0, sizeof(rp));
 642         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 643
 644         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 645                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 646
 647         if (hdev->set_bdaddr)
 648                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 649
 650         rp.supported_options = cpu_to_le32(options);
 651         rp.missing_options = get_missing_options(hdev);
 652
 653         hci_dev_unlock(hdev);
 654
 655         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 656                                  &rp, sizeof(rp));
 657 }
 658
 659 static u32 get_supported_phys(struct hci_dev *hdev)
 660 {
 661         u32 supported_phys = 0;
 662
 663         if (lmp_bredr_capable(hdev)) {
 664                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 665
 666                 if (hdev->features[0][0] & LMP_3SLOT)
 667                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 668
 669                 if (hdev->features[0][0] & LMP_5SLOT)
 670                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 671
 672                 if (lmp_edr_2m_capable(hdev)) {
 673                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 674
 675                         if (lmp_edr_3slot_capable(hdev))
 676                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 677
 678                         if (lmp_edr_5slot_capable(hdev))
 679                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 680
 681                         if (lmp_edr_3m_capable(hdev)) {
 682                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 683
 684                                 if (lmp_edr_3slot_capable(hdev))
 685                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 686
 687                                 if (lmp_edr_5slot_capable(hdev))
 688                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 689                         }
 690                 }
 691         }
 692
 693         if (lmp_le_capable(hdev)) {
 694                 supported_phys |= MGMT_PHY_LE_1M_TX;
 695                 supported_phys |= MGMT_PHY_LE_1M_RX;
 696
 697                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 698                         supported_phys |= MGMT_PHY_LE_2M_TX;
 699                         supported_phys |= MGMT_PHY_LE_2M_RX;
 700                 }
 701
 702                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 703                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 704                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 705                 }
 706         }
 707
 708         return supported_phys;
 709 }
 710
 711 static u32 get_selected_phys(struct hci_dev *hdev)
 712 {
 713         u32 selected_phys = 0;
 714
 715         if (lmp_bredr_capable(hdev)) {
 716                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 717
 718                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 719                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 720
 721                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 722                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 723
 724                 if (lmp_edr_2m_capable(hdev)) {
 725                         if (!(hdev->pkt_type & HCI_2DH1))
 726                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 727
 728                         if (lmp_edr_3slot_capable(hdev) &&
 729                             !(hdev->pkt_type & HCI_2DH3))
 730                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 731
 732                         if (lmp_edr_5slot_capable(hdev) &&
 733                             !(hdev->pkt_type & HCI_2DH5))
 734                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 735
 736                         if (lmp_edr_3m_capable(hdev)) {
 737                                 if (!(hdev->pkt_type & HCI_3DH1))
 738                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 739
 740                                 if (lmp_edr_3slot_capable(hdev) &&
 741                                     !(hdev->pkt_type & HCI_3DH3))
 742                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 743
 744                                 if (lmp_edr_5slot_capable(hdev) &&
 745                                     !(hdev->pkt_type & HCI_3DH5))
 746                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 747                         }
 748                 }
 749         }
 750
 751         if (lmp_le_capable(hdev)) {
 752                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 753                         selected_phys |= MGMT_PHY_LE_1M_TX;
 754
 755                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 756                         selected_phys |= MGMT_PHY_LE_1M_RX;
 757
 758                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 759                         selected_phys |= MGMT_PHY_LE_2M_TX;
 760
 761                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 762                         selected_phys |= MGMT_PHY_LE_2M_RX;
 763
 764                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 765                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 766
 767                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 768                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 769         }
 770
 771         return selected_phys;
 772 }
 773
 774 static u32 get_configurable_phys(struct hci_dev *hdev)
 775 {
 776         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 777                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 778 }
 779
 780 static u32 get_supported_settings(struct hci_dev *hdev)
 781 {
 782         u32 settings = 0;
 783
 784         settings |= MGMT_SETTING_POWERED;
 785         settings |= MGMT_SETTING_BONDABLE;
 786         settings |= MGMT_SETTING_DEBUG_KEYS;
 787         settings |= MGMT_SETTING_CONNECTABLE;
 788         settings |= MGMT_SETTING_DISCOVERABLE;
 789
 790         if (lmp_bredr_capable(hdev)) {
 791                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 792                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 793                 settings |= MGMT_SETTING_BREDR;
 794                 settings |= MGMT_SETTING_LINK_SECURITY;
 795
 796                 if (lmp_ssp_capable(hdev)) {
 797                         settings |= MGMT_SETTING_SSP;
 798                         if (IS_ENABLED(CONFIG_BT_HS))
 799                                 settings |= MGMT_SETTING_HS;
 800                 }
 801
 802                 if (lmp_sc_capable(hdev))
 803                         settings |= MGMT_SETTING_SECURE_CONN;
 804
 805                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 806                              &hdev->quirks))
 807                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 808         }
 809
 810         if (lmp_le_capable(hdev)) {
 811                 settings |= MGMT_SETTING_LE;
 812                 settings |= MGMT_SETTING_SECURE_CONN;
 813                 settings |= MGMT_SETTING_PRIVACY;
 814                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 815
 816                 /* When the experimental feature for LL Privacy support is
 817                  * enabled, then advertising is no longer supported.
 818                  */
 819                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 820                         settings |= MGMT_SETTING_ADVERTISING;
 821         }
 822
 823         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 824             hdev->set_bdaddr)
 825                 settings |= MGMT_SETTING_CONFIGURATION;
 826
 827         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 828
 829         return settings;
 830 }
 831
 832 static u32 get_current_settings(struct hci_dev *hdev)
 833 {
 834         u32 settings = 0;
 835
 836         if (hdev_is_powered(hdev))
 837                 settings |= MGMT_SETTING_POWERED;
 838
 839         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 840                 settings |= MGMT_SETTING_CONNECTABLE;
 841
 842         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 843                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 844
 845         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 846                 settings |= MGMT_SETTING_DISCOVERABLE;
 847
 848         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 849                 settings |= MGMT_SETTING_BONDABLE;
 850
 851         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 852                 settings |= MGMT_SETTING_BREDR;
 853
 854         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 855                 settings |= MGMT_SETTING_LE;
 856
 857         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 858                 settings |= MGMT_SETTING_LINK_SECURITY;
 859
 860         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 861                 settings |= MGMT_SETTING_SSP;
 862
 863         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 864                 settings |= MGMT_SETTING_HS;
 865
 866         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 867                 settings |= MGMT_SETTING_ADVERTISING;
 868
 869         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 870                 settings |= MGMT_SETTING_SECURE_CONN;
 871
 872         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 873                 settings |= MGMT_SETTING_DEBUG_KEYS;
 874
 875         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 876                 settings |= MGMT_SETTING_PRIVACY;
 877
 878         /* The current setting for static address has two purposes. The
 879          * first is to indicate if the static address will be used and
 880          * the second is to indicate if it is actually set.
 881          *
 882          * This means if the static address is not configured, this flag
 883          * will never be set. If the address is configured, then if the
 884          * address is actually used decides if the flag is set or not.
 885          *
 886          * For single mode LE only controllers and dual-mode controllers
 887          * with BR/EDR disabled, the existence of the static address will
 888          * be evaluated.
 889          */
 890         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 891             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 892             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 893                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 894                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 895         }
 896
 897         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 898                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 899
 900         return settings;
 901 }
 902
 903 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 904 {
 905         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 906 }
 907
 908 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 909                                                   struct hci_dev *hdev,
 910                                                   const void *data)
 911 {
 912         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 913 }
 914
 915 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 916 {
 917         struct mgmt_pending_cmd *cmd;
 918
 919         /* If there's a pending mgmt command the flags will not yet have
 920          * their final values, so check for this first.
 921          */
 922         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 923         if (cmd) {
 924                 struct mgmt_mode *cp = cmd->param;
 925                 if (cp->val == 0x01)
 926                         return LE_AD_GENERAL;
 927                 else if (cp->val == 0x02)
 928                         return LE_AD_LIMITED;
 929         } else {
 930                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 931                         return LE_AD_LIMITED;
 932                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 933                         return LE_AD_GENERAL;
 934         }
 935
 936         return 0;
 937 }
 938
 939 bool mgmt_get_connectable(struct hci_dev *hdev)
 940 {
 941         struct mgmt_pending_cmd *cmd;
 942
 943         /* If there's a pending mgmt command the flag will not yet have
 944          * it's final value, so check for this first.
 945          */
 946         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 947         if (cmd) {
 948                 struct mgmt_mode *cp = cmd->param;
 949
 950                 return cp->val;
 951         }
 952
 953         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 954 }
 955
 956 static void service_cache_off(struct work_struct *work)
 957 {
 958         struct hci_dev *hdev = container_of(work, struct hci_dev,
 959                                             service_cache.work);
 960         struct hci_request req;
 961
 962         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 963                 return;
 964
 965         hci_req_init(&req, hdev);
 966
 967         hci_dev_lock(hdev);
 968
 969         __hci_req_update_eir(&req);
 970         __hci_req_update_class(&req);
 971
 972         hci_dev_unlock(hdev);
 973
 974         hci_req_run(&req, NULL);
 975 }
 976
 977 static void rpa_expired(struct work_struct *work)
 978 {
 979         struct hci_dev *hdev = container_of(work, struct hci_dev,
 980                                             rpa_expired.work);
 981         struct hci_request req;
 982
 983         bt_dev_dbg(hdev, "");
 984
 985         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 986
 987         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 988                 return;
 989
 990         /* The generation of a new RPA and programming it into the
 991          * controller happens in the hci_req_enable_advertising()
 992          * function.
 993          */
 994         hci_req_init(&req, hdev);
 995         if (ext_adv_capable(hdev))
 996                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 997         else
 998                 __hci_req_enable_advertising(&req);
 999         hci_req_run(&req, NULL);
1000 }
1001
1002 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1003 {
1004         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1005                 return;
1006
1007         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1008         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1009
1010         /* Non-mgmt controlled devices get this bit set
1011          * implicitly so that pairing works for them, however
1012          * for mgmt we require user-space to explicitly enable
1013          * it
1014          */
1015         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1016 }
1017
1018 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1019                                 void *data, u16 data_len)
1020 {
1021         struct mgmt_rp_read_info rp;
1022
1023         bt_dev_dbg(hdev, "sock %p", sk);
1024
1025         hci_dev_lock(hdev);
1026
1027         memset(&rp, 0, sizeof(rp));
1028
1029         bacpy(&rp.bdaddr, &hdev->bdaddr);
1030
1031         rp.version = hdev->hci_ver;
1032         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1033
1034         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1035         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1036
1037         memcpy(rp.dev_class, hdev->dev_class, 3);
1038
1039         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1040         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1041
1042         hci_dev_unlock(hdev);
1043
1044         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1045                                  sizeof(rp));
1046 }
1047
1048 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1049 {
1050         u16 eir_len = 0;
1051         size_t name_len;
1052
1053         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1054                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1055                                           hdev->dev_class, 3);
1056
1057         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1058                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1059                                           hdev->appearance);
1060
1061         name_len = strlen(hdev->dev_name);
1062         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1063                                   hdev->dev_name, name_len);
1064
1065         name_len = strlen(hdev->short_name);
1066         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1067                                   hdev->short_name, name_len);
1068
1069         return eir_len;
1070 }
1071
1072 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1073                                     void *data, u16 data_len)
1074 {
1075         char buf[512];
1076         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1077         u16 eir_len;
1078
1079         bt_dev_dbg(hdev, "sock %p", sk);
1080
1081         memset(&buf, 0, sizeof(buf));
1082
1083         hci_dev_lock(hdev);
1084
1085         bacpy(&rp->bdaddr, &hdev->bdaddr);
1086
1087         rp->version = hdev->hci_ver;
1088         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1089
1090         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1091         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1092
1093
1094         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1095         rp->eir_len = cpu_to_le16(eir_len);
1096
1097         hci_dev_unlock(hdev);
1098
1099         /* If this command is called at least once, then the events
1100          * for class of device and local name changes are disabled
1101          * and only the new extended controller information event
1102          * is used.
1103          */
1104         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1105         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1106         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1107
1108         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1109                                  sizeof(*rp) + eir_len);
1110 }
1111
1112 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1113 {
1114         char buf[512];
1115         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1116         u16 eir_len;
1117
1118         memset(buf, 0, sizeof(buf));
1119
1120         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1121         ev->eir_len = cpu_to_le16(eir_len);
1122
1123         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1124                                   sizeof(*ev) + eir_len,
1125                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1126 }
1127
1128 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1129 {
1130         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1131
1132         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1133                                  sizeof(settings));
1134 }
1135
1136 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1137 {
1138         bt_dev_dbg(hdev, "status 0x%02x", status);
1139
1140         if (hci_conn_count(hdev) == 0) {
1141                 cancel_delayed_work(&hdev->power_off);
1142                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1143         }
1144 }
1145
1146 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1147 {
1148         struct mgmt_ev_advertising_added ev;
1149
1150         ev.instance = instance;
1151
1152         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1153 }
1154
1155 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1156                               u8 instance)
1157 {
1158         struct mgmt_ev_advertising_removed ev;
1159
1160         ev.instance = instance;
1161
1162         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1163 }
1164
1165 static void cancel_adv_timeout(struct hci_dev *hdev)
1166 {
1167         if (hdev->adv_instance_timeout) {
1168                 hdev->adv_instance_timeout = 0;
1169                 cancel_delayed_work(&hdev->adv_instance_expire);
1170         }
1171 }
1172
1173 static int clean_up_hci_state(struct hci_dev *hdev)
1174 {
1175         struct hci_request req;
1176         struct hci_conn *conn;
1177         bool discov_stopped;
1178         int err;
1179
1180         hci_req_init(&req, hdev);
1181
1182         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1183             test_bit(HCI_PSCAN, &hdev->flags)) {
1184                 u8 scan = 0x00;
1185                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1186         }
1187
1188         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1189
1190         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1191                 __hci_req_disable_advertising(&req);
1192
1193         discov_stopped = hci_req_stop_discovery(&req);
1194
1195         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1196                 /* 0x15 == Terminated due to Power Off */
1197                 __hci_abort_conn(&req, conn, 0x15);
1198         }
1199
1200         err = hci_req_run(&req, clean_up_hci_complete);
1201         if (!err && discov_stopped)
1202                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1203
1204         return err;
1205 }
1206
1207 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1208                        u16 len)
1209 {
1210         struct mgmt_mode *cp = data;
1211         struct mgmt_pending_cmd *cmd;
1212         int err;
1213
1214         bt_dev_dbg(hdev, "sock %p", sk);
1215
1216         if (cp->val != 0x00 && cp->val != 0x01)
1217                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1218                                        MGMT_STATUS_INVALID_PARAMS);
1219
1220         hci_dev_lock(hdev);
1221
1222         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1223                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1224                                       MGMT_STATUS_BUSY);
1225                 goto failed;
1226         }
1227
1228         if (!!cp->val == hdev_is_powered(hdev)) {
1229                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1230                 goto failed;
1231         }
1232
1233         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1234         if (!cmd) {
1235                 err = -ENOMEM;
1236                 goto failed;
1237         }
1238
1239         if (cp->val) {
1240                 queue_work(hdev->req_workqueue, &hdev->power_on);
1241                 err = 0;
1242         } else {
1243                 /* Disconnect connections, stop scans, etc */
1244                 err = clean_up_hci_state(hdev);
1245                 if (!err)
1246                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1247                                            HCI_POWER_OFF_TIMEOUT);
1248
1249                 /* ENODATA means there were no HCI commands queued */
1250                 if (err == -ENODATA) {
1251                         cancel_delayed_work(&hdev->power_off);
1252                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1253                         err = 0;
1254                 }
1255         }
1256
1257 failed:
1258         hci_dev_unlock(hdev);
1259         return err;
1260 }
1261
1262 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1263 {
1264         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1265
1266         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1267                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1268 }
1269
1270 int mgmt_new_settings(struct hci_dev *hdev)
1271 {
1272         return new_settings(hdev, NULL);
1273 }
1274
1275 struct cmd_lookup {
1276         struct sock *sk;
1277         struct hci_dev *hdev;
1278         u8 mgmt_status;
1279 };
1280
1281 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1282 {
1283         struct cmd_lookup *match = data;
1284
1285         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1286
1287         list_del(&cmd->list);
1288
1289         if (match->sk == NULL) {
1290                 match->sk = cmd->sk;
1291                 sock_hold(match->sk);
1292         }
1293
1294         mgmt_pending_free(cmd);
1295 }
1296
1297 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1298 {
1299         u8 *status = data;
1300
1301         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1302         mgmt_pending_remove(cmd);
1303 }
1304
1305 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1306 {
1307         if (cmd->cmd_complete) {
1308                 u8 *status = data;
1309
1310                 cmd->cmd_complete(cmd, *status);
1311                 mgmt_pending_remove(cmd);
1312
1313                 return;
1314         }
1315
1316         cmd_status_rsp(cmd, data);
1317 }
1318
1319 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1320 {
1321         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1322                                  cmd->param, cmd->param_len);
1323 }
1324
1325 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1326 {
1327         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1328                                  cmd->param, sizeof(struct mgmt_addr_info));
1329 }
1330
1331 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1332 {
1333         if (!lmp_bredr_capable(hdev))
1334                 return MGMT_STATUS_NOT_SUPPORTED;
1335         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1336                 return MGMT_STATUS_REJECTED;
1337         else
1338                 return MGMT_STATUS_SUCCESS;
1339 }
1340
1341 static u8 mgmt_le_support(struct hci_dev *hdev)
1342 {
1343         if (!lmp_le_capable(hdev))
1344                 return MGMT_STATUS_NOT_SUPPORTED;
1345         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1346                 return MGMT_STATUS_REJECTED;
1347         else
1348                 return MGMT_STATUS_SUCCESS;
1349 }
1350
1351 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1352 {
1353         struct mgmt_pending_cmd *cmd;
1354
1355         bt_dev_dbg(hdev, "status 0x%02x", status);
1356
1357         hci_dev_lock(hdev);
1358
1359         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1360         if (!cmd)
1361                 goto unlock;
1362
1363         if (status) {
1364                 u8 mgmt_err = mgmt_status(status);
1365                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1366                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1367                 goto remove_cmd;
1368         }
1369
1370         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1371             hdev->discov_timeout > 0) {
1372                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1373                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1374         }
1375
1376         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1377         new_settings(hdev, cmd->sk);
1378
1379 remove_cmd:
1380         mgmt_pending_remove(cmd);
1381
1382 unlock:
1383         hci_dev_unlock(hdev);
1384 }
1385
1386 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1387                             u16 len)
1388 {
1389         struct mgmt_cp_set_discoverable *cp = data;
1390         struct mgmt_pending_cmd *cmd;
1391         u16 timeout;
1392         int err;
1393
1394         bt_dev_dbg(hdev, "sock %p", sk);
1395
1396         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1397             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1398                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1399                                        MGMT_STATUS_REJECTED);
1400
1401         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1402                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1403                                        MGMT_STATUS_INVALID_PARAMS);
1404
1405         timeout = __le16_to_cpu(cp->timeout);
1406
1407         /* Disabling discoverable requires that no timeout is set,
1408          * and enabling limited discoverable requires a timeout.
1409          */
1410         if ((cp->val == 0x00 && timeout > 0) ||
1411             (cp->val == 0x02 && timeout == 0))
1412                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1413                                        MGMT_STATUS_INVALID_PARAMS);
1414
1415         hci_dev_lock(hdev);
1416
1417         if (!hdev_is_powered(hdev) && timeout > 0) {
1418                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1419                                       MGMT_STATUS_NOT_POWERED);
1420                 goto failed;
1421         }
1422
1423         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1424             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1425                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1426                                       MGMT_STATUS_BUSY);
1427                 goto failed;
1428         }
1429
1430         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1431                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1432                                       MGMT_STATUS_REJECTED);
1433                 goto failed;
1434         }
1435
1436         if (hdev->advertising_paused) {
1437                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1438                                       MGMT_STATUS_BUSY);
1439                 goto failed;
1440         }
1441
1442         if (!hdev_is_powered(hdev)) {
1443                 bool changed = false;
1444
1445                 /* Setting limited discoverable when powered off is
1446                  * not a valid operation since it requires a timeout
1447                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1448                  */
1449                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1450                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1451                         changed = true;
1452                 }
1453
1454                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1455                 if (err < 0)
1456                         goto failed;
1457
1458                 if (changed)
1459                         err = new_settings(hdev, sk);
1460
1461                 goto failed;
1462         }
1463
1464         /* If the current mode is the same, then just update the timeout
1465          * value with the new value. And if only the timeout gets updated,
1466          * then no need for any HCI transactions.
1467          */
1468         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1469             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1470                                                    HCI_LIMITED_DISCOVERABLE)) {
1471                 cancel_delayed_work(&hdev->discov_off);
1472                 hdev->discov_timeout = timeout;
1473
1474                 if (cp->val && hdev->discov_timeout > 0) {
1475                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1476                         queue_delayed_work(hdev->req_workqueue,
1477                                            &hdev->discov_off, to);
1478                 }
1479
1480                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1481                 goto failed;
1482         }
1483
1484         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1485         if (!cmd) {
1486                 err = -ENOMEM;
1487                 goto failed;
1488         }
1489
1490         /* Cancel any potential discoverable timeout that might be
1491          * still active and store new timeout value. The arming of
1492          * the timeout happens in the complete handler.
1493          */
1494         cancel_delayed_work(&hdev->discov_off);
1495         hdev->discov_timeout = timeout;
1496
1497         if (cp->val)
1498                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1499         else
1500                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1501
1502         /* Limited discoverable mode */
1503         if (cp->val == 0x02)
1504                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1505         else
1506                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1507
1508         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1509         err = 0;
1510
1511 failed:
1512         hci_dev_unlock(hdev);
1513         return err;
1514 }
1515
1516 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1517 {
1518         struct mgmt_pending_cmd *cmd;
1519
1520         bt_dev_dbg(hdev, "status 0x%02x", status);
1521
1522         hci_dev_lock(hdev);
1523
1524         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1525         if (!cmd)
1526                 goto unlock;
1527
1528         if (status) {
1529                 u8 mgmt_err = mgmt_status(status);
1530                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1531                 goto remove_cmd;
1532         }
1533
1534         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1535         new_settings(hdev, cmd->sk);
1536
1537 remove_cmd:
1538         mgmt_pending_remove(cmd);
1539
1540 unlock:
1541         hci_dev_unlock(hdev);
1542 }
1543
1544 static int set_connectable_update_settings(struct hci_dev *hdev,
1545                                            struct sock *sk, u8 val)
1546 {
1547         bool changed = false;
1548         int err;
1549
1550         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1551                 changed = true;
1552
1553         if (val) {
1554                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1555         } else {
1556                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1557                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1558         }
1559
1560         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1561         if (err < 0)
1562                 return err;
1563
1564         if (changed) {
1565                 hci_req_update_scan(hdev);
1566                 hci_update_background_scan(hdev);
1567                 return new_settings(hdev, sk);
1568         }
1569
1570         return 0;
1571 }
1572
1573 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1574                            u16 len)
1575 {
1576         struct mgmt_mode *cp = data;
1577         struct mgmt_pending_cmd *cmd;
1578         int err;
1579
1580         bt_dev_dbg(hdev, "sock %p", sk);
1581
1582         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1583             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1584                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1585                                        MGMT_STATUS_REJECTED);
1586
1587         if (cp->val != 0x00 && cp->val != 0x01)
1588                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1589                                        MGMT_STATUS_INVALID_PARAMS);
1590
1591         hci_dev_lock(hdev);
1592
1593         if (!hdev_is_powered(hdev)) {
1594                 err = set_connectable_update_settings(hdev, sk, cp->val);
1595                 goto failed;
1596         }
1597
1598         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1599             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1600                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1601                                       MGMT_STATUS_BUSY);
1602                 goto failed;
1603         }
1604
1605         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1606         if (!cmd) {
1607                 err = -ENOMEM;
1608                 goto failed;
1609         }
1610
1611         if (cp->val) {
1612                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1613         } else {
1614                 if (hdev->discov_timeout > 0)
1615                         cancel_delayed_work(&hdev->discov_off);
1616
1617                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1618                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1619                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1620         }
1621
1622         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1623         err = 0;
1624
1625 failed:
1626         hci_dev_unlock(hdev);
1627         return err;
1628 }
1629
1630 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1631                         u16 len)
1632 {
1633         struct mgmt_mode *cp = data;
1634         bool changed;
1635         int err;
1636
1637         bt_dev_dbg(hdev, "sock %p", sk);
1638
1639         if (cp->val != 0x00 && cp->val != 0x01)
1640                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1641                                        MGMT_STATUS_INVALID_PARAMS);
1642
1643         hci_dev_lock(hdev);
1644
1645         if (cp->val)
1646                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1647         else
1648                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1649
1650         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1651         if (err < 0)
1652                 goto unlock;
1653
1654         if (changed) {
1655                 /* In limited privacy mode the change of bondable mode
1656                  * may affect the local advertising address.
1657                  */
1658                 if (hdev_is_powered(hdev) &&
1659                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1660                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1661                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1662                         queue_work(hdev->req_workqueue,
1663                                    &hdev->discoverable_update);
1664
1665                 err = new_settings(hdev, sk);
1666         }
1667
1668 unlock:
1669         hci_dev_unlock(hdev);
1670         return err;
1671 }
1672
1673 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1674                              u16 len)
1675 {
1676         struct mgmt_mode *cp = data;
1677         struct mgmt_pending_cmd *cmd;
1678         u8 val, status;
1679         int err;
1680
1681         bt_dev_dbg(hdev, "sock %p", sk);
1682
1683         status = mgmt_bredr_support(hdev);
1684         if (status)
1685                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1686                                        status);
1687
1688         if (cp->val != 0x00 && cp->val != 0x01)
1689                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1690                                        MGMT_STATUS_INVALID_PARAMS);
1691
1692         hci_dev_lock(hdev);
1693
1694         if (!hdev_is_powered(hdev)) {
1695                 bool changed = false;
1696
1697                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1698                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1699                         changed = true;
1700                 }
1701
1702                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1703                 if (err < 0)
1704                         goto failed;
1705
1706                 if (changed)
1707                         err = new_settings(hdev, sk);
1708
1709                 goto failed;
1710         }
1711
1712         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1713                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1714                                       MGMT_STATUS_BUSY);
1715                 goto failed;
1716         }
1717
1718         val = !!cp->val;
1719
1720         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1721                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1722                 goto failed;
1723         }
1724
1725         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1726         if (!cmd) {
1727                 err = -ENOMEM;
1728                 goto failed;
1729         }
1730
1731         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1732         if (err < 0) {
1733                 mgmt_pending_remove(cmd);
1734                 goto failed;
1735         }
1736
1737 failed:
1738         hci_dev_unlock(hdev);
1739         return err;
1740 }
1741
1742 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1743 {
1744         struct mgmt_mode *cp = data;
1745         struct mgmt_pending_cmd *cmd;
1746         u8 status;
1747         int err;
1748
1749         bt_dev_dbg(hdev, "sock %p", sk);
1750
1751         status = mgmt_bredr_support(hdev);
1752         if (status)
1753                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1754
1755         if (!lmp_ssp_capable(hdev))
1756                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1757                                        MGMT_STATUS_NOT_SUPPORTED);
1758
1759         if (cp->val != 0x00 && cp->val != 0x01)
1760                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1761                                        MGMT_STATUS_INVALID_PARAMS);
1762
1763         hci_dev_lock(hdev);
1764
1765         if (!hdev_is_powered(hdev)) {
1766                 bool changed;
1767
1768                 if (cp->val) {
1769                         changed = !hci_dev_test_and_set_flag(hdev,
1770                                                              HCI_SSP_ENABLED);
1771                 } else {
1772                         changed = hci_dev_test_and_clear_flag(hdev,
1773                                                               HCI_SSP_ENABLED);
1774                         if (!changed)
1775                                 changed = hci_dev_test_and_clear_flag(hdev,
1776                                                                       HCI_HS_ENABLED);
1777                         else
1778                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1779                 }
1780
1781                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1782                 if (err < 0)
1783                         goto failed;
1784
1785                 if (changed)
1786                         err = new_settings(hdev, sk);
1787
1788                 goto failed;
1789         }
1790
1791         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1792                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1793                                       MGMT_STATUS_BUSY);
1794                 goto failed;
1795         }
1796
1797         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1798                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1799                 goto failed;
1800         }
1801
1802         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1803         if (!cmd) {
1804                 err = -ENOMEM;
1805                 goto failed;
1806         }
1807
1808         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1809                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1810                              sizeof(cp->val), &cp->val);
1811
1812         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1813         if (err < 0) {
1814                 mgmt_pending_remove(cmd);
1815                 goto failed;
1816         }
1817
1818 failed:
1819         hci_dev_unlock(hdev);
1820         return err;
1821 }
1822
1823 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1824 {
1825         struct mgmt_mode *cp = data;
1826         bool changed;
1827         u8 status;
1828         int err;
1829
1830         bt_dev_dbg(hdev, "sock %p", sk);
1831
1832         if (!IS_ENABLED(CONFIG_BT_HS))
1833                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1834                                        MGMT_STATUS_NOT_SUPPORTED);
1835
1836         status = mgmt_bredr_support(hdev);
1837         if (status)
1838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1839
1840         if (!lmp_ssp_capable(hdev))
1841                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1842                                        MGMT_STATUS_NOT_SUPPORTED);
1843
1844         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1845                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1846                                        MGMT_STATUS_REJECTED);
1847
1848         if (cp->val != 0x00 && cp->val != 0x01)
1849                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1850                                        MGMT_STATUS_INVALID_PARAMS);
1851
1852         hci_dev_lock(hdev);
1853
1854         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1855                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1856                                       MGMT_STATUS_BUSY);
1857                 goto unlock;
1858         }
1859
1860         if (cp->val) {
1861                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1862         } else {
1863                 if (hdev_is_powered(hdev)) {
1864                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1865                                               MGMT_STATUS_REJECTED);
1866                         goto unlock;
1867                 }
1868
1869                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1870         }
1871
1872         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1873         if (err < 0)
1874                 goto unlock;
1875
1876         if (changed)
1877                 err = new_settings(hdev, sk);
1878
1879 unlock:
1880         hci_dev_unlock(hdev);
1881         return err;
1882 }
1883
1884 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1885 {
1886         struct cmd_lookup match = { NULL, hdev };
1887
1888         hci_dev_lock(hdev);
1889
1890         if (status) {
1891                 u8 mgmt_err = mgmt_status(status);
1892
1893                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1894                                      &mgmt_err);
1895                 goto unlock;
1896         }
1897
1898         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1899
1900         new_settings(hdev, match.sk);
1901
1902         if (match.sk)
1903                 sock_put(match.sk);
1904
1905         /* Make sure the controller has a good default for
1906          * advertising data. Restrict the update to when LE
1907          * has actually been enabled. During power on, the
1908          * update in powered_update_hci will take care of it.
1909          */
1910         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1911                 struct hci_request req;
1912                 hci_req_init(&req, hdev);
1913                 if (ext_adv_capable(hdev)) {
1914                         int err;
1915
1916                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1917                         if (!err)
1918                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1919                 } else {
1920                         __hci_req_update_adv_data(&req, 0x00);
1921                         __hci_req_update_scan_rsp_data(&req, 0x00);
1922                 }
1923                 hci_req_run(&req, NULL);
1924                 hci_update_background_scan(hdev);
1925         }
1926
1927 unlock:
1928         hci_dev_unlock(hdev);
1929 }
1930
1931 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1932 {
1933         struct mgmt_mode *cp = data;
1934         struct hci_cp_write_le_host_supported hci_cp;
1935         struct mgmt_pending_cmd *cmd;
1936         struct hci_request req;
1937         int err;
1938         u8 val, enabled;
1939
1940         bt_dev_dbg(hdev, "sock %p", sk);
1941
1942         if (!lmp_le_capable(hdev))
1943                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1944                                        MGMT_STATUS_NOT_SUPPORTED);
1945
1946         if (cp->val != 0x00 && cp->val != 0x01)
1947                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1948                                        MGMT_STATUS_INVALID_PARAMS);
1949
1950         /* Bluetooth single mode LE only controllers or dual-mode
1951          * controllers configured as LE only devices, do not allow
1952          * switching LE off. These have either LE enabled explicitly
1953          * or BR/EDR has been previously switched off.
1954          *
1955          * When trying to enable an already enabled LE, then gracefully
1956          * send a positive response. Trying to disable it however will
1957          * result into rejection.
1958          */
1959         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1960                 if (cp->val == 0x01)
1961                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1962
1963                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1964                                        MGMT_STATUS_REJECTED);
1965         }
1966
1967         hci_dev_lock(hdev);
1968
1969         val = !!cp->val;
1970         enabled = lmp_host_le_capable(hdev);
1971
1972         if (!val)
1973                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1974
1975         if (!hdev_is_powered(hdev) || val == enabled) {
1976                 bool changed = false;
1977
1978                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1979                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1980                         changed = true;
1981                 }
1982
1983                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1984                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1985                         changed = true;
1986                 }
1987
1988                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1989                 if (err < 0)
1990                         goto unlock;
1991
1992                 if (changed)
1993                         err = new_settings(hdev, sk);
1994
1995                 goto unlock;
1996         }
1997
1998         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1999             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2000                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2001                                       MGMT_STATUS_BUSY);
2002                 goto unlock;
2003         }
2004
2005         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2006         if (!cmd) {
2007                 err = -ENOMEM;
2008                 goto unlock;
2009         }
2010
2011         hci_req_init(&req, hdev);
2012
2013         memset(&hci_cp, 0, sizeof(hci_cp));
2014
2015         if (val) {
2016                 hci_cp.le = val;
2017                 hci_cp.simul = 0x00;
2018         } else {
2019                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2020                         __hci_req_disable_advertising(&req);
2021
2022                 if (ext_adv_capable(hdev))
2023                         __hci_req_clear_ext_adv_sets(&req);
2024         }
2025
2026         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2027                     &hci_cp);
2028
2029         err = hci_req_run(&req, le_enable_complete);
2030         if (err < 0)
2031                 mgmt_pending_remove(cmd);
2032
2033 unlock:
2034         hci_dev_unlock(hdev);
2035         return err;
2036 }
2037
2038 /* This is a helper function to test for pending mgmt commands that can
2039  * cause CoD or EIR HCI commands. We can only allow one such pending
2040  * mgmt command at a time since otherwise we cannot easily track what
2041  * the current values are, will be, and based on that calculate if a new
2042  * HCI command needs to be sent and if yes with what value.
2043  */
2044 static bool pending_eir_or_class(struct hci_dev *hdev)
2045 {
2046         struct mgmt_pending_cmd *cmd;
2047
2048         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2049                 switch (cmd->opcode) {
2050                 case MGMT_OP_ADD_UUID:
2051                 case MGMT_OP_REMOVE_UUID:
2052                 case MGMT_OP_SET_DEV_CLASS:
2053                 case MGMT_OP_SET_POWERED:
2054                         return true;
2055                 }
2056         }
2057
2058         return false;
2059 }
2060
2061 static const u8 bluetooth_base_uuid[] = {
2062                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2063                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2064 };
2065
2066 static u8 get_uuid_size(const u8 *uuid)
2067 {
2068         u32 val;
2069
2070         if (memcmp(uuid, bluetooth_base_uuid, 12))
2071                 return 128;
2072
2073         val = get_unaligned_le32(&uuid[12]);
2074         if (val > 0xffff)
2075                 return 32;
2076
2077         return 16;
2078 }
2079
2080 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2081 {
2082         struct mgmt_pending_cmd *cmd;
2083
2084         hci_dev_lock(hdev);
2085
2086         cmd = pending_find(mgmt_op, hdev);
2087         if (!cmd)
2088                 goto unlock;
2089
2090         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2091                           mgmt_status(status), hdev->dev_class, 3);
2092
2093         mgmt_pending_remove(cmd);
2094
2095 unlock:
2096         hci_dev_unlock(hdev);
2097 }
2098
2099 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2100 {
2101         bt_dev_dbg(hdev, "status 0x%02x", status);
2102
2103         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2104 }
2105
2106 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2107 {
2108         struct mgmt_cp_add_uuid *cp = data;
2109         struct mgmt_pending_cmd *cmd;
2110         struct hci_request req;
2111         struct bt_uuid *uuid;
2112         int err;
2113
2114         bt_dev_dbg(hdev, "sock %p", sk);
2115
2116         hci_dev_lock(hdev);
2117
2118         if (pending_eir_or_class(hdev)) {
2119                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2120                                       MGMT_STATUS_BUSY);
2121                 goto failed;
2122         }
2123
2124         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2125         if (!uuid) {
2126                 err = -ENOMEM;
2127                 goto failed;
2128         }
2129
2130         memcpy(uuid->uuid, cp->uuid, 16);
2131         uuid->svc_hint = cp->svc_hint;
2132         uuid->size = get_uuid_size(cp->uuid);
2133
2134         list_add_tail(&uuid->list, &hdev->uuids);
2135
2136         hci_req_init(&req, hdev);
2137
2138         __hci_req_update_class(&req);
2139         __hci_req_update_eir(&req);
2140
2141         err = hci_req_run(&req, add_uuid_complete);
2142         if (err < 0) {
2143                 if (err != -ENODATA)
2144                         goto failed;
2145
2146                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2147                                         hdev->dev_class, 3);
2148                 goto failed;
2149         }
2150
2151         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2152         if (!cmd) {
2153                 err = -ENOMEM;
2154                 goto failed;
2155         }
2156
2157         err = 0;
2158
2159 failed:
2160         hci_dev_unlock(hdev);
2161         return err;
2162 }
2163
2164 static bool enable_service_cache(struct hci_dev *hdev)
2165 {
2166         if (!hdev_is_powered(hdev))
2167                 return false;
2168
2169         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2170                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2171                                    CACHE_TIMEOUT);
2172                 return true;
2173         }
2174
2175         return false;
2176 }
2177
2178 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2179 {
2180         bt_dev_dbg(hdev, "status 0x%02x", status);
2181
2182         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2183 }
2184
2185 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2186                        u16 len)
2187 {
2188         struct mgmt_cp_remove_uuid *cp = data;
2189         struct mgmt_pending_cmd *cmd;
2190         struct bt_uuid *match, *tmp;
2191         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2192         struct hci_request req;
2193         int err, found;
2194
2195         bt_dev_dbg(hdev, "sock %p", sk);
2196
2197         hci_dev_lock(hdev);
2198
2199         if (pending_eir_or_class(hdev)) {
2200                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2201                                       MGMT_STATUS_BUSY);
2202                 goto unlock;
2203         }
2204
2205         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2206                 hci_uuids_clear(hdev);
2207
2208                 if (enable_service_cache(hdev)) {
2209                         err = mgmt_cmd_complete(sk, hdev->id,
2210                                                 MGMT_OP_REMOVE_UUID,
2211                                                 0, hdev->dev_class, 3);
2212                         goto unlock;
2213                 }
2214
2215                 goto update_class;
2216         }
2217
2218         found = 0;
2219
2220         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2221                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2222                         continue;
2223
2224                 list_del(&match->list);
2225                 kfree(match);
2226                 found++;
2227         }
2228
2229         if (found == 0) {
2230                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2231                                       MGMT_STATUS_INVALID_PARAMS);
2232                 goto unlock;
2233         }
2234
2235 update_class:
2236         hci_req_init(&req, hdev);
2237
2238         __hci_req_update_class(&req);
2239         __hci_req_update_eir(&req);
2240
2241         err = hci_req_run(&req, remove_uuid_complete);
2242         if (err < 0) {
2243                 if (err != -ENODATA)
2244                         goto unlock;
2245
2246                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2247                                         hdev->dev_class, 3);
2248                 goto unlock;
2249         }
2250
2251         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2252         if (!cmd) {
2253                 err = -ENOMEM;
2254                 goto unlock;
2255         }
2256
2257         err = 0;
2258
2259 unlock:
2260         hci_dev_unlock(hdev);
2261         return err;
2262 }
2263
2264 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2265 {
2266         bt_dev_dbg(hdev, "status 0x%02x", status);
2267
2268         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2269 }
2270
2271 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2272                          u16 len)
2273 {
2274         struct mgmt_cp_set_dev_class *cp = data;
2275         struct mgmt_pending_cmd *cmd;
2276         struct hci_request req;
2277         int err;
2278
2279         bt_dev_dbg(hdev, "sock %p", sk);
2280
2281         if (!lmp_bredr_capable(hdev))
2282                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2283                                        MGMT_STATUS_NOT_SUPPORTED);
2284
2285         hci_dev_lock(hdev);
2286
2287         if (pending_eir_or_class(hdev)) {
2288                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2289                                       MGMT_STATUS_BUSY);
2290                 goto unlock;
2291         }
2292
2293         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2294                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2295                                       MGMT_STATUS_INVALID_PARAMS);
2296                 goto unlock;
2297         }
2298
2299         hdev->major_class = cp->major;
2300         hdev->minor_class = cp->minor;
2301
2302         if (!hdev_is_powered(hdev)) {
2303                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2304                                         hdev->dev_class, 3);
2305                 goto unlock;
2306         }
2307
2308         hci_req_init(&req, hdev);
2309
2310         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2311                 hci_dev_unlock(hdev);
2312                 cancel_delayed_work_sync(&hdev->service_cache);
2313                 hci_dev_lock(hdev);
2314                 __hci_req_update_eir(&req);
2315         }
2316
2317         __hci_req_update_class(&req);
2318
2319         err = hci_req_run(&req, set_class_complete);
2320         if (err < 0) {
2321                 if (err != -ENODATA)
2322                         goto unlock;
2323
2324                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2325                                         hdev->dev_class, 3);
2326                 goto unlock;
2327         }
2328
2329         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2330         if (!cmd) {
2331                 err = -ENOMEM;
2332                 goto unlock;
2333         }
2334
2335         err = 0;
2336
2337 unlock:
2338         hci_dev_unlock(hdev);
2339         return err;
2340 }
2341
2342 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2343                           u16 len)
2344 {
2345         struct mgmt_cp_load_link_keys *cp = data;
2346         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2347                                    sizeof(struct mgmt_link_key_info));
2348         u16 key_count, expected_len;
2349         bool changed;
2350         int i;
2351
2352         bt_dev_dbg(hdev, "sock %p", sk);
2353
2354         if (!lmp_bredr_capable(hdev))
2355                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2356                                        MGMT_STATUS_NOT_SUPPORTED);
2357
2358         key_count = __le16_to_cpu(cp->key_count);
2359         if (key_count > max_key_count) {
2360                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2361                            key_count);
2362                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2363                                        MGMT_STATUS_INVALID_PARAMS);
2364         }
2365
2366         expected_len = struct_size(cp, keys, key_count);
2367         if (expected_len != len) {
2368                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2369                            expected_len, len);
2370                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2371                                        MGMT_STATUS_INVALID_PARAMS);
2372         }
2373
2374         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2375                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2376                                        MGMT_STATUS_INVALID_PARAMS);
2377
2378         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2379                    key_count);
2380
2381         for (i = 0; i < key_count; i++) {
2382                 struct mgmt_link_key_info *key = &cp->keys[i];
2383
2384                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2385                         return mgmt_cmd_status(sk, hdev->id,
2386                                                MGMT_OP_LOAD_LINK_KEYS,
2387                                                MGMT_STATUS_INVALID_PARAMS);
2388         }
2389
2390         hci_dev_lock(hdev);
2391
2392         hci_link_keys_clear(hdev);
2393
2394         if (cp->debug_keys)
2395                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2396         else
2397                 changed = hci_dev_test_and_clear_flag(hdev,
2398                                                       HCI_KEEP_DEBUG_KEYS);
2399
2400         if (changed)
2401                 new_settings(hdev, NULL);
2402
2403         for (i = 0; i < key_count; i++) {
2404                 struct mgmt_link_key_info *key = &cp->keys[i];
2405
2406                 if (hci_is_blocked_key(hdev,
2407                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2408                                        key->val)) {
2409                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2410                                     &key->addr.bdaddr);
2411                         continue;
2412                 }
2413
2414                 /* Always ignore debug keys and require a new pairing if
2415                  * the user wants to use them.
2416                  */
2417                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2418                         continue;
2419
2420                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2421                                  key->type, key->pin_len, NULL);
2422         }
2423
2424         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2425
2426         hci_dev_unlock(hdev);
2427
2428         return 0;
2429 }
2430
2431 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2432                            u8 addr_type, struct sock *skip_sk)
2433 {
2434         struct mgmt_ev_device_unpaired ev;
2435
2436         bacpy(&ev.addr.bdaddr, bdaddr);
2437         ev.addr.type = addr_type;
2438
2439         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2440                           skip_sk);
2441 }
2442
2443 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2444                          u16 len)
2445 {
2446         struct mgmt_cp_unpair_device *cp = data;
2447         struct mgmt_rp_unpair_device rp;
2448         struct hci_conn_params *params;
2449         struct mgmt_pending_cmd *cmd;
2450         struct hci_conn *conn;
2451         u8 addr_type;
2452         int err;
2453
2454         memset(&rp, 0, sizeof(rp));
2455         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2456         rp.addr.type = cp->addr.type;
2457
2458         if (!bdaddr_type_is_valid(cp->addr.type))
2459                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2460                                          MGMT_STATUS_INVALID_PARAMS,
2461                                          &rp, sizeof(rp));
2462
2463         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2464                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2465                                          MGMT_STATUS_INVALID_PARAMS,
2466                                          &rp, sizeof(rp));
2467
2468         hci_dev_lock(hdev);
2469
2470         if (!hdev_is_powered(hdev)) {
2471                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2472                                         MGMT_STATUS_NOT_POWERED, &rp,
2473                                         sizeof(rp));
2474                 goto unlock;
2475         }
2476
2477         if (cp->addr.type == BDADDR_BREDR) {
2478                 /* If disconnection is requested, then look up the
2479                  * connection. If the remote device is connected, it
2480                  * will be later used to terminate the link.
2481                  *
2482                  * Setting it to NULL explicitly will cause no
2483                  * termination of the link.
2484                  */
2485                 if (cp->disconnect)
2486                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2487                                                        &cp->addr.bdaddr);
2488                 else
2489                         conn = NULL;
2490
2491                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2492                 if (err < 0) {
2493                         err = mgmt_cmd_complete(sk, hdev->id,
2494                                                 MGMT_OP_UNPAIR_DEVICE,
2495                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2496                                                 sizeof(rp));
2497                         goto unlock;
2498                 }
2499
2500                 goto done;
2501         }
2502
2503         /* LE address type */
2504         addr_type = le_addr_type(cp->addr.type);
2505
2506         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2507         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2508         if (err < 0) {
2509                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2510                                         MGMT_STATUS_NOT_PAIRED, &rp,
2511                                         sizeof(rp));
2512                 goto unlock;
2513         }
2514
2515         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2516         if (!conn) {
2517                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2518                 goto done;
2519         }
2520
2521
2522         /* Defer clearing up the connection parameters until closing to
2523          * give a chance of keeping them if a repairing happens.
2524          */
2525         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2526
2527         /* Disable auto-connection parameters if present */
2528         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2529         if (params) {
2530                 if (params->explicit_connect)
2531                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2532                 else
2533                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2534         }
2535
2536         /* If disconnection is not requested, then clear the connection
2537          * variable so that the link is not terminated.
2538          */
2539         if (!cp->disconnect)
2540                 conn = NULL;
2541
2542 done:
2543         /* If the connection variable is set, then termination of the
2544          * link is requested.
2545          */
2546         if (!conn) {
2547                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2548                                         &rp, sizeof(rp));
2549                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2550                 goto unlock;
2551         }
2552
2553         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2554                                sizeof(*cp));
2555         if (!cmd) {
2556                 err = -ENOMEM;
2557                 goto unlock;
2558         }
2559
2560         cmd->cmd_complete = addr_cmd_complete;
2561
2562         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2563         if (err < 0)
2564                 mgmt_pending_remove(cmd);
2565
2566 unlock:
2567         hci_dev_unlock(hdev);
2568         return err;
2569 }
2570
2571 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2572                       u16 len)
2573 {
2574         struct mgmt_cp_disconnect *cp = data;
2575         struct mgmt_rp_disconnect rp;
2576         struct mgmt_pending_cmd *cmd;
2577         struct hci_conn *conn;
2578         int err;
2579
2580         bt_dev_dbg(hdev, "sock %p", sk);
2581
2582         memset(&rp, 0, sizeof(rp));
2583         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2584         rp.addr.type = cp->addr.type;
2585
2586         if (!bdaddr_type_is_valid(cp->addr.type))
2587                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2588                                          MGMT_STATUS_INVALID_PARAMS,
2589                                          &rp, sizeof(rp));
2590
2591         hci_dev_lock(hdev);
2592
2593         if (!test_bit(HCI_UP, &hdev->flags)) {
2594                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2595                                         MGMT_STATUS_NOT_POWERED, &rp,
2596                                         sizeof(rp));
2597                 goto failed;
2598         }
2599
2600         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2601                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2602                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2603                 goto failed;
2604         }
2605
2606         if (cp->addr.type == BDADDR_BREDR)
2607                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2608                                                &cp->addr.bdaddr);
2609         else
2610                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2611                                                le_addr_type(cp->addr.type));
2612
2613         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2614                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2615                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2616                                         sizeof(rp));
2617                 goto failed;
2618         }
2619
2620         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2621         if (!cmd) {
2622                 err = -ENOMEM;
2623                 goto failed;
2624         }
2625
2626         cmd->cmd_complete = generic_cmd_complete;
2627
2628         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2629         if (err < 0)
2630                 mgmt_pending_remove(cmd);
2631
2632 failed:
2633         hci_dev_unlock(hdev);
2634         return err;
2635 }
2636
2637 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2638 {
2639         switch (link_type) {
2640         case LE_LINK:
2641                 switch (addr_type) {
2642                 case ADDR_LE_DEV_PUBLIC:
2643                         return BDADDR_LE_PUBLIC;
2644
2645                 default:
2646                         /* Fallback to LE Random address type */
2647                         return BDADDR_LE_RANDOM;
2648                 }
2649
2650         default:
2651                 /* Fallback to BR/EDR type */
2652                 return BDADDR_BREDR;
2653         }
2654 }
2655
2656 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2657                            u16 data_len)
2658 {
2659         struct mgmt_rp_get_connections *rp;
2660         struct hci_conn *c;
2661         int err;
2662         u16 i;
2663
2664         bt_dev_dbg(hdev, "sock %p", sk);
2665
2666         hci_dev_lock(hdev);
2667
2668         if (!hdev_is_powered(hdev)) {
2669                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2670                                       MGMT_STATUS_NOT_POWERED);
2671                 goto unlock;
2672         }
2673
2674         i = 0;
2675         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2676                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2677                         i++;
2678         }
2679
2680         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2681         if (!rp) {
2682                 err = -ENOMEM;
2683                 goto unlock;
2684         }
2685
2686         i = 0;
2687         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2688                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2689                         continue;
2690                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2691                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2692                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2693                         continue;
2694                 i++;
2695         }
2696
2697         rp->conn_count = cpu_to_le16(i);
2698
2699         /* Recalculate length in case of filtered SCO connections, etc */
2700         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2701                                 struct_size(rp, addr, i));
2702
2703         kfree(rp);
2704
2705 unlock:
2706         hci_dev_unlock(hdev);
2707         return err;
2708 }
2709
2710 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2711                                    struct mgmt_cp_pin_code_neg_reply *cp)
2712 {
2713         struct mgmt_pending_cmd *cmd;
2714         int err;
2715
2716         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2717                                sizeof(*cp));
2718         if (!cmd)
2719                 return -ENOMEM;
2720
2721         cmd->cmd_complete = addr_cmd_complete;
2722
2723         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2724                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2725         if (err < 0)
2726                 mgmt_pending_remove(cmd);
2727
2728         return err;
2729 }
2730
2731 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2732                           u16 len)
2733 {
2734         struct hci_conn *conn;
2735         struct mgmt_cp_pin_code_reply *cp = data;
2736         struct hci_cp_pin_code_reply reply;
2737         struct mgmt_pending_cmd *cmd;
2738         int err;
2739
2740         bt_dev_dbg(hdev, "sock %p", sk);
2741
2742         hci_dev_lock(hdev);
2743
2744         if (!hdev_is_powered(hdev)) {
2745                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2746                                       MGMT_STATUS_NOT_POWERED);
2747                 goto failed;
2748         }
2749
2750         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2751         if (!conn) {
2752                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2753                                       MGMT_STATUS_NOT_CONNECTED);
2754                 goto failed;
2755         }
2756
2757         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2758                 struct mgmt_cp_pin_code_neg_reply ncp;
2759
2760                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2761
2762                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2763
2764                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2765                 if (err >= 0)
2766                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2767                                               MGMT_STATUS_INVALID_PARAMS);
2768
2769                 goto failed;
2770         }
2771
2772         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2773         if (!cmd) {
2774                 err = -ENOMEM;
2775                 goto failed;
2776         }
2777
2778         cmd->cmd_complete = addr_cmd_complete;
2779
2780         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2781         reply.pin_len = cp->pin_len;
2782         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2783
2784         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2785         if (err < 0)
2786                 mgmt_pending_remove(cmd);
2787
2788 failed:
2789         hci_dev_unlock(hdev);
2790         return err;
2791 }
2792
2793 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2794                              u16 len)
2795 {
2796         struct mgmt_cp_set_io_capability *cp = data;
2797
2798         bt_dev_dbg(hdev, "sock %p", sk);
2799
2800         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2801                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2802                                        MGMT_STATUS_INVALID_PARAMS);
2803
2804         hci_dev_lock(hdev);
2805
2806         hdev->io_capability = cp->io_capability;
2807
2808         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2809
2810         hci_dev_unlock(hdev);
2811
2812         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2813                                  NULL, 0);
2814 }
2815
2816 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2817 {
2818         struct hci_dev *hdev = conn->hdev;
2819         struct mgmt_pending_cmd *cmd;
2820
2821         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2822                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2823                         continue;
2824
2825                 if (cmd->user_data != conn)
2826                         continue;
2827
2828                 return cmd;
2829         }
2830
2831         return NULL;
2832 }
2833
2834 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2835 {
2836         struct mgmt_rp_pair_device rp;
2837         struct hci_conn *conn = cmd->user_data;
2838         int err;
2839
2840         bacpy(&rp.addr.bdaddr, &conn->dst);
2841         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2842
2843         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2844                                 status, &rp, sizeof(rp));
2845
2846         /* So we don't get further callbacks for this connection */
2847         conn->connect_cfm_cb = NULL;
2848         conn->security_cfm_cb = NULL;
2849         conn->disconn_cfm_cb = NULL;
2850
2851         hci_conn_drop(conn);
2852
2853         /* The device is paired so there is no need to remove
2854          * its connection parameters anymore.
2855          */
2856         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2857
2858         hci_conn_put(conn);
2859
2860         return err;
2861 }
2862
2863 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2864 {
2865         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2866         struct mgmt_pending_cmd *cmd;
2867
2868         cmd = find_pairing(conn);
2869         if (cmd) {
2870                 cmd->cmd_complete(cmd, status);
2871                 mgmt_pending_remove(cmd);
2872         }
2873 }
2874
2875 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2876 {
2877         struct mgmt_pending_cmd *cmd;
2878
2879         BT_DBG("status %u", status);
2880
2881         cmd = find_pairing(conn);
2882         if (!cmd) {
2883                 BT_DBG("Unable to find a pending command");
2884                 return;
2885         }
2886
2887         cmd->cmd_complete(cmd, mgmt_status(status));
2888         mgmt_pending_remove(cmd);
2889 }
2890
2891 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2892 {
2893         struct mgmt_pending_cmd *cmd;
2894
2895         BT_DBG("status %u", status);
2896
2897         if (!status)
2898                 return;
2899
2900         cmd = find_pairing(conn);
2901         if (!cmd) {
2902                 BT_DBG("Unable to find a pending command");
2903                 return;
2904         }
2905
2906         cmd->cmd_complete(cmd, mgmt_status(status));
2907         mgmt_pending_remove(cmd);
2908 }
2909
2910 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2911                        u16 len)
2912 {
2913         struct mgmt_cp_pair_device *cp = data;
2914         struct mgmt_rp_pair_device rp;
2915         struct mgmt_pending_cmd *cmd;
2916         u8 sec_level, auth_type;
2917         struct hci_conn *conn;
2918         int err;
2919
2920         bt_dev_dbg(hdev, "sock %p", sk);
2921
2922         memset(&rp, 0, sizeof(rp));
2923         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2924         rp.addr.type = cp->addr.type;
2925
2926         if (!bdaddr_type_is_valid(cp->addr.type))
2927                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2928                                          MGMT_STATUS_INVALID_PARAMS,
2929                                          &rp, sizeof(rp));
2930
2931         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2932                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2933                                          MGMT_STATUS_INVALID_PARAMS,
2934                                          &rp, sizeof(rp));
2935
2936         hci_dev_lock(hdev);
2937
2938         if (!hdev_is_powered(hdev)) {
2939                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2940                                         MGMT_STATUS_NOT_POWERED, &rp,
2941                                         sizeof(rp));
2942                 goto unlock;
2943         }
2944
2945         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2946                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2947                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2948                                         sizeof(rp));
2949                 goto unlock;
2950         }
2951
2952         sec_level = BT_SECURITY_MEDIUM;
2953         auth_type = HCI_AT_DEDICATED_BONDING;
2954
2955         if (cp->addr.type == BDADDR_BREDR) {
2956                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2957                                        auth_type, CONN_REASON_PAIR_DEVICE);
2958         } else {
2959                 u8 addr_type = le_addr_type(cp->addr.type);
2960                 struct hci_conn_params *p;
2961
2962                 /* When pairing a new device, it is expected to remember
2963                  * this device for future connections. Adding the connection
2964                  * parameter information ahead of time allows tracking
2965                  * of the peripheral preferred values and will speed up any
2966                  * further connection establishment.
2967                  *
2968                  * If connection parameters already exist, then they
2969                  * will be kept and this function does nothing.
2970                  */
2971                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2972
2973                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2974                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2975
2976                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2977                                            sec_level, HCI_LE_CONN_TIMEOUT,
2978                                            CONN_REASON_PAIR_DEVICE);
2979         }
2980
2981         if (IS_ERR(conn)) {
2982                 int status;
2983
2984                 if (PTR_ERR(conn) == -EBUSY)
2985                         status = MGMT_STATUS_BUSY;
2986                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2987                         status = MGMT_STATUS_NOT_SUPPORTED;
2988                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2989                         status = MGMT_STATUS_REJECTED;
2990                 else
2991                         status = MGMT_STATUS_CONNECT_FAILED;
2992
2993                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2994                                         status, &rp, sizeof(rp));
2995                 goto unlock;
2996         }
2997
2998         if (conn->connect_cfm_cb) {
2999                 hci_conn_drop(conn);
3000                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3001                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
3002                 goto unlock;
3003         }
3004
3005         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3006         if (!cmd) {
3007                 err = -ENOMEM;
3008                 hci_conn_drop(conn);
3009                 goto unlock;
3010         }
3011
3012         cmd->cmd_complete = pairing_complete;
3013
3014         /* For LE, just connecting isn't a proof that the pairing finished */
3015         if (cp->addr.type == BDADDR_BREDR) {
3016                 conn->connect_cfm_cb = pairing_complete_cb;
3017                 conn->security_cfm_cb = pairing_complete_cb;
3018                 conn->disconn_cfm_cb = pairing_complete_cb;
3019         } else {
3020                 conn->connect_cfm_cb = le_pairing_complete_cb;
3021                 conn->security_cfm_cb = le_pairing_complete_cb;
3022                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3023         }
3024
3025         conn->io_capability = cp->io_cap;
3026         cmd->user_data = hci_conn_get(conn);
3027
3028         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3029             hci_conn_security(conn, sec_level, auth_type, true)) {
3030                 cmd->cmd_complete(cmd, 0);
3031                 mgmt_pending_remove(cmd);
3032         }
3033
3034         err = 0;
3035
3036 unlock:
3037         hci_dev_unlock(hdev);
3038         return err;
3039 }
3040
3041 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3042                               u16 len)
3043 {
3044         struct mgmt_addr_info *addr = data;
3045         struct mgmt_pending_cmd *cmd;
3046         struct hci_conn *conn;
3047         int err;
3048
3049         bt_dev_dbg(hdev, "sock %p", sk);
3050
3051         hci_dev_lock(hdev);
3052
3053         if (!hdev_is_powered(hdev)) {
3054                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3055                                       MGMT_STATUS_NOT_POWERED);
3056                 goto unlock;
3057         }
3058
3059         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3060         if (!cmd) {
3061                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3062                                       MGMT_STATUS_INVALID_PARAMS);
3063                 goto unlock;
3064         }
3065
3066         conn = cmd->user_data;
3067
3068         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3069                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3070                                       MGMT_STATUS_INVALID_PARAMS);
3071                 goto unlock;
3072         }
3073
3074         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3075         mgmt_pending_remove(cmd);
3076
3077         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3078                                 addr, sizeof(*addr));
3079
3080         /* Since user doesn't want to proceed with the connection, abort any
3081          * ongoing pairing and then terminate the link if it was created
3082          * because of the pair device action.
3083          */
3084         if (addr->type == BDADDR_BREDR)
3085                 hci_remove_link_key(hdev, &addr->bdaddr);
3086         else
3087                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3088                                               le_addr_type(addr->type));
3089
3090         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3091                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3092
3093 unlock:
3094         hci_dev_unlock(hdev);
3095         return err;
3096 }
3097
3098 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3099                              struct mgmt_addr_info *addr, u16 mgmt_op,
3100                              u16 hci_op, __le32 passkey)
3101 {
3102         struct mgmt_pending_cmd *cmd;
3103         struct hci_conn *conn;
3104         int err;
3105
3106         hci_dev_lock(hdev);
3107
3108         if (!hdev_is_powered(hdev)) {
3109                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3110                                         MGMT_STATUS_NOT_POWERED, addr,
3111                                         sizeof(*addr));
3112                 goto done;
3113         }
3114
3115         if (addr->type == BDADDR_BREDR)
3116                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3117         else
3118                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3119                                                le_addr_type(addr->type));
3120
3121         if (!conn) {
3122                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3123                                         MGMT_STATUS_NOT_CONNECTED, addr,
3124                                         sizeof(*addr));
3125                 goto done;
3126         }
3127
3128         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3129                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3130                 if (!err)
3131                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3132                                                 MGMT_STATUS_SUCCESS, addr,
3133                                                 sizeof(*addr));
3134                 else
3135                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3136                                                 MGMT_STATUS_FAILED, addr,
3137                                                 sizeof(*addr));
3138
3139                 goto done;
3140         }
3141
3142         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3143         if (!cmd) {
3144                 err = -ENOMEM;
3145                 goto done;
3146         }
3147
3148         cmd->cmd_complete = addr_cmd_complete;
3149
3150         /* Continue with pairing via HCI */
3151         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3152                 struct hci_cp_user_passkey_reply cp;
3153
3154                 bacpy(&cp.bdaddr, &addr->bdaddr);
3155                 cp.passkey = passkey;
3156                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3157         } else
3158                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3159                                    &addr->bdaddr);
3160
3161         if (err < 0)
3162                 mgmt_pending_remove(cmd);
3163
3164 done:
3165         hci_dev_unlock(hdev);
3166         return err;
3167 }
3168
3169 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3170                               void *data, u16 len)
3171 {
3172         struct mgmt_cp_pin_code_neg_reply *cp = data;
3173
3174         bt_dev_dbg(hdev, "sock %p", sk);
3175
3176         return user_pairing_resp(sk, hdev, &cp->addr,
3177                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3178                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3179 }
3180
3181 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3182                               u16 len)
3183 {
3184         struct mgmt_cp_user_confirm_reply *cp = data;
3185
3186         bt_dev_dbg(hdev, "sock %p", sk);
3187
3188         if (len != sizeof(*cp))
3189                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3190                                        MGMT_STATUS_INVALID_PARAMS);
3191
3192         return user_pairing_resp(sk, hdev, &cp->addr,
3193                                  MGMT_OP_USER_CONFIRM_REPLY,
3194                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3195 }
3196
3197 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3198                                   void *data, u16 len)
3199 {
3200         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3201
3202         bt_dev_dbg(hdev, "sock %p", sk);
3203
3204         return user_pairing_resp(sk, hdev, &cp->addr,
3205                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3206                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3207 }
3208
3209 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3210                               u16 len)
3211 {
3212         struct mgmt_cp_user_passkey_reply *cp = data;
3213
3214         bt_dev_dbg(hdev, "sock %p", sk);
3215
3216         return user_pairing_resp(sk, hdev, &cp->addr,
3217                                  MGMT_OP_USER_PASSKEY_REPLY,
3218                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3219 }
3220
3221 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3222                                   void *data, u16 len)
3223 {
3224         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3225
3226         bt_dev_dbg(hdev, "sock %p", sk);
3227
3228         return user_pairing_resp(sk, hdev, &cp->addr,
3229                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3230                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3231 }
3232
3233 static void adv_expire(struct hci_dev *hdev, u32 flags)
3234 {
3235         struct adv_info *adv_instance;
3236         struct hci_request req;
3237         int err;
3238
3239         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3240         if (!adv_instance)
3241                 return;
3242
3243         /* stop if current instance doesn't need to be changed */
3244         if (!(adv_instance->flags & flags))
3245                 return;
3246
3247         cancel_adv_timeout(hdev);
3248
3249         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3250         if (!adv_instance)
3251                 return;
3252
3253         hci_req_init(&req, hdev);
3254         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3255                                               true);
3256         if (err)
3257                 return;
3258
3259         hci_req_run(&req, NULL);
3260 }
3261
3262 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3263 {
3264         struct mgmt_cp_set_local_name *cp;
3265         struct mgmt_pending_cmd *cmd;
3266
3267         bt_dev_dbg(hdev, "status 0x%02x", status);
3268
3269         hci_dev_lock(hdev);
3270
3271         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3272         if (!cmd)
3273                 goto unlock;
3274
3275         cp = cmd->param;
3276
3277         if (status) {
3278                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3279                                 mgmt_status(status));
3280         } else {
3281                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3282                                   cp, sizeof(*cp));
3283
3284                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3285                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3286         }
3287
3288         mgmt_pending_remove(cmd);
3289
3290 unlock:
3291         hci_dev_unlock(hdev);
3292 }
3293
3294 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3295                           u16 len)
3296 {
3297         struct mgmt_cp_set_local_name *cp = data;
3298         struct mgmt_pending_cmd *cmd;
3299         struct hci_request req;
3300         int err;
3301
3302         bt_dev_dbg(hdev, "sock %p", sk);
3303
3304         hci_dev_lock(hdev);
3305
3306         /* If the old values are the same as the new ones just return a
3307          * direct command complete event.
3308          */
3309         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3310             !memcmp(hdev->short_name, cp->short_name,
3311                     sizeof(hdev->short_name))) {
3312                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3313                                         data, len);
3314                 goto failed;
3315         }
3316
3317         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3318
3319         if (!hdev_is_powered(hdev)) {
3320                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3321
3322                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3323                                         data, len);
3324                 if (err < 0)
3325                         goto failed;
3326
3327                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3328                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3329                 ext_info_changed(hdev, sk);
3330
3331                 goto failed;
3332         }
3333
3334         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3335         if (!cmd) {
3336                 err = -ENOMEM;
3337                 goto failed;
3338         }
3339
3340         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3341
3342         hci_req_init(&req, hdev);
3343
3344         if (lmp_bredr_capable(hdev)) {
3345                 __hci_req_update_name(&req);
3346                 __hci_req_update_eir(&req);
3347         }
3348
3349         /* The name is stored in the scan response data and so
3350          * no need to update the advertising data here.
3351          */
3352         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3353                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3354
3355         err = hci_req_run(&req, set_name_complete);
3356         if (err < 0)
3357                 mgmt_pending_remove(cmd);
3358
3359 failed:
3360         hci_dev_unlock(hdev);
3361         return err;
3362 }
3363
3364 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3365                           u16 len)
3366 {
3367         struct mgmt_cp_set_appearance *cp = data;
3368         u16 appearance;
3369         int err;
3370
3371         bt_dev_dbg(hdev, "sock %p", sk);
3372
3373         if (!lmp_le_capable(hdev))
3374                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3375                                        MGMT_STATUS_NOT_SUPPORTED);
3376
3377         appearance = le16_to_cpu(cp->appearance);
3378
3379         hci_dev_lock(hdev);
3380
3381         if (hdev->appearance != appearance) {
3382                 hdev->appearance = appearance;
3383
3384                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3385                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3386
3387                 ext_info_changed(hdev, sk);
3388         }
3389
3390         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3391                                 0);
3392
3393         hci_dev_unlock(hdev);
3394
3395         return err;
3396 }
3397
3398 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3399                                  void *data, u16 len)
3400 {
3401         struct mgmt_rp_get_phy_configuration rp;
3402
3403         bt_dev_dbg(hdev, "sock %p", sk);
3404
3405         hci_dev_lock(hdev);
3406
3407         memset(&rp, 0, sizeof(rp));
3408
3409         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3410         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3411         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3412
3413         hci_dev_unlock(hdev);
3414
3415         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3416                                  &rp, sizeof(rp));
3417 }
3418
3419 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3420 {
3421         struct mgmt_ev_phy_configuration_changed ev;
3422
3423         memset(&ev, 0, sizeof(ev));
3424
3425         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3426
3427         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3428                           sizeof(ev), skip);
3429 }
3430
3431 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3432                                      u16 opcode, struct sk_buff *skb)
3433 {
3434         struct mgmt_pending_cmd *cmd;
3435
3436         bt_dev_dbg(hdev, "status 0x%02x", status);
3437
3438         hci_dev_lock(hdev);
3439
3440         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3441         if (!cmd)
3442                 goto unlock;
3443
3444         if (status) {
3445                 mgmt_cmd_status(cmd->sk, hdev->id,
3446                                 MGMT_OP_SET_PHY_CONFIGURATION,
3447                                 mgmt_status(status));
3448         } else {
3449                 mgmt_cmd_complete(cmd->sk, hdev->id,
3450                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3451                                   NULL, 0);
3452
3453                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3454         }
3455
3456         mgmt_pending_remove(cmd);
3457
3458 unlock:
3459         hci_dev_unlock(hdev);
3460 }
3461
3462 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3463                                  void *data, u16 len)
3464 {
3465         struct mgmt_cp_set_phy_configuration *cp = data;
3466         struct hci_cp_le_set_default_phy cp_phy;
3467         struct mgmt_pending_cmd *cmd;
3468         struct hci_request req;
3469         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3470         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3471         bool changed = false;
3472         int err;
3473
3474         bt_dev_dbg(hdev, "sock %p", sk);
3475
3476         configurable_phys = get_configurable_phys(hdev);
3477         supported_phys = get_supported_phys(hdev);
3478         selected_phys = __le32_to_cpu(cp->selected_phys);
3479
3480         if (selected_phys & ~supported_phys)
3481                 return mgmt_cmd_status(sk, hdev->id,
3482                                        MGMT_OP_SET_PHY_CONFIGURATION,
3483                                        MGMT_STATUS_INVALID_PARAMS);
3484
3485         unconfigure_phys = supported_phys & ~configurable_phys;
3486
3487         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3488                 return mgmt_cmd_status(sk, hdev->id,
3489                                        MGMT_OP_SET_PHY_CONFIGURATION,
3490                                        MGMT_STATUS_INVALID_PARAMS);
3491
3492         if (selected_phys == get_selected_phys(hdev))
3493                 return mgmt_cmd_complete(sk, hdev->id,
3494                                          MGMT_OP_SET_PHY_CONFIGURATION,
3495                                          0, NULL, 0);
3496
3497         hci_dev_lock(hdev);
3498
3499         if (!hdev_is_powered(hdev)) {
3500                 err = mgmt_cmd_status(sk, hdev->id,
3501                                       MGMT_OP_SET_PHY_CONFIGURATION,
3502                                       MGMT_STATUS_REJECTED);
3503                 goto unlock;
3504         }
3505
3506         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3507                 err = mgmt_cmd_status(sk, hdev->id,
3508                                       MGMT_OP_SET_PHY_CONFIGURATION,
3509                                       MGMT_STATUS_BUSY);
3510                 goto unlock;
3511         }
3512
3513         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3514                 pkt_type |= (HCI_DH3 | HCI_DM3);
3515         else
3516                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3517
3518         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3519                 pkt_type |= (HCI_DH5 | HCI_DM5);
3520         else
3521                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3522
3523         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3524                 pkt_type &= ~HCI_2DH1;
3525         else
3526                 pkt_type |= HCI_2DH1;
3527
3528         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3529                 pkt_type &= ~HCI_2DH3;
3530         else
3531                 pkt_type |= HCI_2DH3;
3532
3533         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3534                 pkt_type &= ~HCI_2DH5;
3535         else
3536                 pkt_type |= HCI_2DH5;
3537
3538         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3539                 pkt_type &= ~HCI_3DH1;
3540         else
3541                 pkt_type |= HCI_3DH1;
3542
3543         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3544                 pkt_type &= ~HCI_3DH3;
3545         else
3546                 pkt_type |= HCI_3DH3;
3547
3548         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3549                 pkt_type &= ~HCI_3DH5;
3550         else
3551                 pkt_type |= HCI_3DH5;
3552
3553         if (pkt_type != hdev->pkt_type) {
3554                 hdev->pkt_type = pkt_type;
3555                 changed = true;
3556         }
3557
3558         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3559             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3560                 if (changed)
3561                         mgmt_phy_configuration_changed(hdev, sk);
3562
3563                 err = mgmt_cmd_complete(sk, hdev->id,
3564                                         MGMT_OP_SET_PHY_CONFIGURATION,
3565                                         0, NULL, 0);
3566
3567                 goto unlock;
3568         }
3569
3570         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3571                                len);
3572         if (!cmd) {
3573                 err = -ENOMEM;
3574                 goto unlock;
3575         }
3576
3577         hci_req_init(&req, hdev);
3578
3579         memset(&cp_phy, 0, sizeof(cp_phy));
3580
3581         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3582                 cp_phy.all_phys |= 0x01;
3583
3584         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3585                 cp_phy.all_phys |= 0x02;
3586
3587         if (selected_phys & MGMT_PHY_LE_1M_TX)
3588                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3589
3590         if (selected_phys & MGMT_PHY_LE_2M_TX)
3591                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3592
3593         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3594                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3595
3596         if (selected_phys & MGMT_PHY_LE_1M_RX)
3597                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3598
3599         if (selected_phys & MGMT_PHY_LE_2M_RX)
3600                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3601
3602         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3603                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3604
3605         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3606
3607         err = hci_req_run_skb(&req, set_default_phy_complete);
3608         if (err < 0)
3609                 mgmt_pending_remove(cmd);
3610
3611 unlock:
3612         hci_dev_unlock(hdev);
3613
3614         return err;
3615 }
3616
3617 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3618                             u16 len)
3619 {
3620         int err = MGMT_STATUS_SUCCESS;
3621         struct mgmt_cp_set_blocked_keys *keys = data;
3622         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3623                                    sizeof(struct mgmt_blocked_key_info));
3624         u16 key_count, expected_len;
3625         int i;
3626
3627         bt_dev_dbg(hdev, "sock %p", sk);
3628
3629         key_count = __le16_to_cpu(keys->key_count);
3630         if (key_count > max_key_count) {
3631                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3632                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3633                                        MGMT_STATUS_INVALID_PARAMS);
3634         }
3635
3636         expected_len = struct_size(keys, keys, key_count);
3637         if (expected_len != len) {
3638                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3639                            expected_len, len);
3640                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3641                                        MGMT_STATUS_INVALID_PARAMS);
3642         }
3643
3644         hci_dev_lock(hdev);
3645
3646         hci_blocked_keys_clear(hdev);
3647
3648         for (i = 0; i < keys->key_count; ++i) {
3649                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3650
3651                 if (!b) {
3652                         err = MGMT_STATUS_NO_RESOURCES;
3653                         break;
3654                 }
3655
3656                 b->type = keys->keys[i].type;
3657                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3658                 list_add_rcu(&b->list, &hdev->blocked_keys);
3659         }
3660         hci_dev_unlock(hdev);
3661
3662         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3663                                 err, NULL, 0);
3664 }
3665
3666 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3667                                void *data, u16 len)
3668 {
3669         struct mgmt_mode *cp = data;
3670         int err;
3671         bool changed = false;
3672
3673         bt_dev_dbg(hdev, "sock %p", sk);
3674
3675         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3676                 return mgmt_cmd_status(sk, hdev->id,
3677                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3678                                        MGMT_STATUS_NOT_SUPPORTED);
3679
3680         if (cp->val != 0x00 && cp->val != 0x01)
3681                 return mgmt_cmd_status(sk, hdev->id,
3682                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3683                                        MGMT_STATUS_INVALID_PARAMS);
3684
3685         hci_dev_lock(hdev);
3686
3687         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3688                 err = mgmt_cmd_status(sk, hdev->id,
3689                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3690                                       MGMT_STATUS_BUSY);
3691                 goto unlock;
3692         }
3693
3694         if (hdev_is_powered(hdev) &&
3695             !!cp->val != hci_dev_test_flag(hdev,
3696                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3697                 err = mgmt_cmd_status(sk, hdev->id,
3698                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3699                                       MGMT_STATUS_REJECTED);
3700                 goto unlock;
3701         }
3702
3703         if (cp->val)
3704                 changed = !hci_dev_test_and_set_flag(hdev,
3705                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3706         else
3707                 changed = hci_dev_test_and_clear_flag(hdev,
3708                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3709
3710         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3711         if (err < 0)
3712                 goto unlock;
3713
3714         if (changed)
3715                 err = new_settings(hdev, sk);
3716
3717 unlock:
3718         hci_dev_unlock(hdev);
3719         return err;
3720 }
3721
3722 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3723                                void *data, u16 data_len)
3724 {
3725         char buf[20];
3726         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3727         u16 cap_len = 0;
3728         u8 flags = 0;
3729         u8 tx_power_range[2];
3730
3731         bt_dev_dbg(hdev, "sock %p", sk);
3732
3733         memset(&buf, 0, sizeof(buf));
3734
3735         hci_dev_lock(hdev);
3736
3737         /* When the Read Simple Pairing Options command is supported, then
3738          * the remote public key validation is supported.
3739          *
3740          * Alternatively, when Microsoft extensions are available, they can
3741          * indicate support for public key validation as well.
3742          */
3743         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3744                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3745
3746         flags |= 0x02;          /* Remote public key validation (LE) */
3747
3748         /* When the Read Encryption Key Size command is supported, then the
3749          * encryption key size is enforced.
3750          */
3751         if (hdev->commands[20] & 0x10)
3752                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3753
3754         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3755
3756         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3757                                   &flags, 1);
3758
3759         /* When the Read Simple Pairing Options command is supported, then
3760          * also max encryption key size information is provided.
3761          */
3762         if (hdev->commands[41] & 0x08)
3763                 cap_len = eir_append_le16(rp->cap, cap_len,
3764                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3765                                           hdev->max_enc_key_size);
3766
3767         cap_len = eir_append_le16(rp->cap, cap_len,
3768                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3769                                   SMP_MAX_ENC_KEY_SIZE);
3770
3771         /* Append the min/max LE tx power parameters if we were able to fetch
3772          * it from the controller
3773          */
3774         if (hdev->commands[38] & 0x80) {
3775                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3776                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3777                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3778                                           tx_power_range, 2);
3779         }
3780
3781         rp->cap_len = cpu_to_le16(cap_len);
3782
3783         hci_dev_unlock(hdev);
3784
3785         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3786                                  rp, sizeof(*rp) + cap_len);
3787 }
3788
3789 #ifdef CONFIG_BT_FEATURE_DEBUG
3790 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3791 static const u8 debug_uuid[16] = {
3792         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3793         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3794 };
3795 #endif
3796
3797 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3798 static const u8 simult_central_periph_uuid[16] = {
3799         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3800         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3801 };
3802
3803 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3804 static const u8 rpa_resolution_uuid[16] = {
3805         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3806         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3807 };
3808
3809 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3810                                   void *data, u16 data_len)
3811 {
3812         char buf[62];   /* Enough space for 3 features */
3813         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3814         u16 idx = 0;
3815         u32 flags;
3816
3817         bt_dev_dbg(hdev, "sock %p", sk);
3818
3819         memset(&buf, 0, sizeof(buf));
3820
3821 #ifdef CONFIG_BT_FEATURE_DEBUG
3822         if (!hdev) {
3823                 flags = bt_dbg_get() ? BIT(0) : 0;
3824
3825                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3826                 rp->features[idx].flags = cpu_to_le32(flags);
3827                 idx++;
3828         }
3829 #endif
3830
3831         if (hdev) {
3832                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3833                     (hdev->le_states[4] & 0x08) &&      /* Central */
3834                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3835                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3836                         flags = BIT(0);
3837                 else
3838                         flags = 0;
3839
3840                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3841                 rp->features[idx].flags = cpu_to_le32(flags);
3842                 idx++;
3843         }
3844
3845         if (hdev && use_ll_privacy(hdev)) {
3846                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3847                         flags = BIT(0) | BIT(1);
3848                 else
3849                         flags = BIT(1);
3850
3851                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3852                 rp->features[idx].flags = cpu_to_le32(flags);
3853                 idx++;
3854         }
3855
3856         rp->feature_count = cpu_to_le16(idx);
3857
3858         /* After reading the experimental features information, enable
3859          * the events to update client on any future change.
3860          */
3861         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3862
3863         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3864                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3865                                  0, rp, sizeof(*rp) + (20 * idx));
3866 }
3867
3868 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3869                                           struct sock *skip)
3870 {
3871         struct mgmt_ev_exp_feature_changed ev;
3872
3873         memset(&ev, 0, sizeof(ev));
3874         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3875         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3876
3877         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3878                                   &ev, sizeof(ev),
3879                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3880
3881 }
3882
3883 #ifdef CONFIG_BT_FEATURE_DEBUG
3884 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3885 {
3886         struct mgmt_ev_exp_feature_changed ev;
3887
3888         memset(&ev, 0, sizeof(ev));
3889         memcpy(ev.uuid, debug_uuid, 16);
3890         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3891
3892         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3893                                   &ev, sizeof(ev),
3894                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3895 }
3896 #endif
3897
3898 #define EXP_FEAT(_uuid, _set_func)      \
3899 {                                       \
3900         .uuid = _uuid,                  \
3901         .set_func = _set_func,          \
3902 }
3903
3904 /* The zero key uuid is special. Multiple exp features are set through it. */
3905 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
3906                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3907 {
3908         struct mgmt_rp_set_exp_feature rp;
3909
3910         memset(rp.uuid, 0, 16);
3911         rp.flags = cpu_to_le32(0);
3912
3913 #ifdef CONFIG_BT_FEATURE_DEBUG
3914         if (!hdev) {
3915                 bool changed = bt_dbg_get();
3916
3917                 bt_dbg_set(false);
3918
3919                 if (changed)
3920                         exp_debug_feature_changed(false, sk);
3921         }
3922 #endif
3923
3924         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3925                 bool changed;
3926
3927                 changed = hci_dev_test_and_clear_flag(hdev,
3928                                                       HCI_ENABLE_LL_PRIVACY);
3929                 if (changed)
3930                         exp_ll_privacy_feature_changed(false, hdev, sk);
3931         }
3932
3933         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3934
3935         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3936                                  MGMT_OP_SET_EXP_FEATURE, 0,
3937                                  &rp, sizeof(rp));
3938 }
3939
3940 #ifdef CONFIG_BT_FEATURE_DEBUG
3941 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
3942                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3943 {
3944         struct mgmt_rp_set_exp_feature rp;
3945
3946         bool val, changed;
3947         int err;
3948
3949         /* Command requires to use the non-controller index */
3950         if (hdev)
3951                 return mgmt_cmd_status(sk, hdev->id,
3952                                        MGMT_OP_SET_EXP_FEATURE,
3953                                        MGMT_STATUS_INVALID_INDEX);
3954
3955         /* Parameters are limited to a single octet */
3956         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3957                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3958                                        MGMT_OP_SET_EXP_FEATURE,
3959                                        MGMT_STATUS_INVALID_PARAMS);
3960
3961         /* Only boolean on/off is supported */
3962         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3963                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3964                                        MGMT_OP_SET_EXP_FEATURE,
3965                                        MGMT_STATUS_INVALID_PARAMS);
3966
3967         val = !!cp->param[0];
3968         changed = val ? !bt_dbg_get() : bt_dbg_get();
3969         bt_dbg_set(val);
3970
3971         memcpy(rp.uuid, debug_uuid, 16);
3972         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3973
3974         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3975
3976         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3977                                 MGMT_OP_SET_EXP_FEATURE, 0,
3978                                 &rp, sizeof(rp));
3979
3980         if (changed)
3981                 exp_debug_feature_changed(val, sk);
3982
3983         return err;
3984 }
3985 #endif
3986
3987 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
3988                                    struct mgmt_cp_set_exp_feature *cp,
3989                                    u16 data_len)
3990 {
3991         struct mgmt_rp_set_exp_feature rp;
3992         bool val, changed;
3993         int err;
3994         u32 flags;
3995
3996         /* Command requires to use the controller index */
3997         if (!hdev)
3998                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3999                                        MGMT_OP_SET_EXP_FEATURE,
4000                                        MGMT_STATUS_INVALID_INDEX);
4001
4002         /* Changes can only be made when controller is powered down */
4003         if (hdev_is_powered(hdev))
4004                 return mgmt_cmd_status(sk, hdev->id,
4005                                        MGMT_OP_SET_EXP_FEATURE,
4006                                        MGMT_STATUS_REJECTED);
4007
4008         /* Parameters are limited to a single octet */
4009         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4010                 return mgmt_cmd_status(sk, hdev->id,
4011                                        MGMT_OP_SET_EXP_FEATURE,
4012                                        MGMT_STATUS_INVALID_PARAMS);
4013
4014         /* Only boolean on/off is supported */
4015         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4016                 return mgmt_cmd_status(sk, hdev->id,
4017                                        MGMT_OP_SET_EXP_FEATURE,
4018                                        MGMT_STATUS_INVALID_PARAMS);
4019
4020         val = !!cp->param[0];
4021
4022         if (val) {
4023                 changed = !hci_dev_test_and_set_flag(hdev,
4024                                                      HCI_ENABLE_LL_PRIVACY);
4025                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4026
4027                 /* Enable LL privacy + supported settings changed */
4028                 flags = BIT(0) | BIT(1);
4029         } else {
4030                 changed = hci_dev_test_and_clear_flag(hdev,
4031                                                       HCI_ENABLE_LL_PRIVACY);
4032
4033                 /* Disable LL privacy + supported settings changed */
4034                 flags = BIT(1);
4035         }
4036
4037         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4038         rp.flags = cpu_to_le32(flags);
4039
4040         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4041
4042         err = mgmt_cmd_complete(sk, hdev->id,
4043                                 MGMT_OP_SET_EXP_FEATURE, 0,
4044                                 &rp, sizeof(rp));
4045
4046         if (changed)
4047                 exp_ll_privacy_feature_changed(val, hdev, sk);
4048
4049         return err;
4050 }
4051
4052 static const struct mgmt_exp_feature {
4053         const u8 *uuid;
4054         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4055                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4056 } exp_features[] = {
4057         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4058 #ifdef CONFIG_BT_FEATURE_DEBUG
4059         EXP_FEAT(debug_uuid, set_debug_func),
4060 #endif
4061         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4062
4063         /* end with a null feature */
4064         EXP_FEAT(NULL, NULL)
4065 };
4066
4067 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
4068                            void *data, u16 data_len)
4069 {
4070         struct mgmt_cp_set_exp_feature *cp = data;
4071         size_t i = 0;
4072
4073         bt_dev_dbg(hdev, "sock %p", sk);
4074
4075         for (i = 0; exp_features[i].uuid; i++) {
4076                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
4077                         return exp_features[i].set_func(sk, hdev, cp, data_len);
4078         }
4079
4080         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4081                                MGMT_OP_SET_EXP_FEATURE,
4082                                MGMT_STATUS_NOT_SUPPORTED);
4083 }
4084
4085 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4086
4087 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4088                             u16 data_len)
4089 {
4090         struct mgmt_cp_get_device_flags *cp = data;
4091         struct mgmt_rp_get_device_flags rp;
4092         struct bdaddr_list_with_flags *br_params;
4093         struct hci_conn_params *params;
4094         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4095         u32 current_flags = 0;
4096         u8 status = MGMT_STATUS_INVALID_PARAMS;
4097
4098         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4099                    &cp->addr.bdaddr, cp->addr.type);
4100
4101         hci_dev_lock(hdev);
4102
4103         memset(&rp, 0, sizeof(rp));
4104
4105         if (cp->addr.type == BDADDR_BREDR) {
4106                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4107                                                               &cp->addr.bdaddr,
4108                                                               cp->addr.type);
4109                 if (!br_params)
4110                         goto done;
4111
4112                 current_flags = br_params->current_flags;
4113         } else {
4114                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4115                                                 le_addr_type(cp->addr.type));
4116
4117                 if (!params)
4118                         goto done;
4119
4120                 current_flags = params->current_flags;
4121         }
4122
4123         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4124         rp.addr.type = cp->addr.type;
4125         rp.supported_flags = cpu_to_le32(supported_flags);
4126         rp.current_flags = cpu_to_le32(current_flags);
4127
4128         status = MGMT_STATUS_SUCCESS;
4129
4130 done:
4131         hci_dev_unlock(hdev);
4132
4133         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4134                                 &rp, sizeof(rp));
4135 }
4136
4137 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4138                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4139                                  u32 supported_flags, u32 current_flags)
4140 {
4141         struct mgmt_ev_device_flags_changed ev;
4142
4143         bacpy(&ev.addr.bdaddr, bdaddr);
4144         ev.addr.type = bdaddr_type;
4145         ev.supported_flags = cpu_to_le32(supported_flags);
4146         ev.current_flags = cpu_to_le32(current_flags);
4147
4148         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4149 }
4150
4151 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4152                             u16 len)
4153 {
4154         struct mgmt_cp_set_device_flags *cp = data;
4155         struct bdaddr_list_with_flags *br_params;
4156         struct hci_conn_params *params;
4157         u8 status = MGMT_STATUS_INVALID_PARAMS;
4158         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4159         u32 current_flags = __le32_to_cpu(cp->current_flags);
4160
4161         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4162                    &cp->addr.bdaddr, cp->addr.type,
4163                    __le32_to_cpu(current_flags));
4164
4165         if ((supported_flags | current_flags) != supported_flags) {
4166                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4167                             current_flags, supported_flags);
4168                 goto done;
4169         }
4170
4171         hci_dev_lock(hdev);
4172
4173         if (cp->addr.type == BDADDR_BREDR) {
4174                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4175                                                               &cp->addr.bdaddr,
4176                                                               cp->addr.type);
4177
4178                 if (br_params) {
4179                         br_params->current_flags = current_flags;
4180                         status = MGMT_STATUS_SUCCESS;
4181                 } else {
4182                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4183                                     &cp->addr.bdaddr, cp->addr.type);
4184                 }
4185         } else {
4186                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4187                                                 le_addr_type(cp->addr.type));
4188                 if (params) {
4189                         params->current_flags = current_flags;
4190                         status = MGMT_STATUS_SUCCESS;
4191                 } else {
4192                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4193                                     &cp->addr.bdaddr,
4194                                     le_addr_type(cp->addr.type));
4195                 }
4196         }
4197
4198 done:
4199         hci_dev_unlock(hdev);
4200
4201         if (status == MGMT_STATUS_SUCCESS)
4202                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4203                                      supported_flags, current_flags);
4204
4205         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4206                                  &cp->addr, sizeof(cp->addr));
4207 }
4208
4209 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4210                                    u16 handle)
4211 {
4212         struct mgmt_ev_adv_monitor_added ev;
4213
4214         ev.monitor_handle = cpu_to_le16(handle);
4215
4216         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4217 }
4218
4219 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4220 {
4221         struct mgmt_ev_adv_monitor_removed ev;
4222         struct mgmt_pending_cmd *cmd;
4223         struct sock *sk_skip = NULL;
4224         struct mgmt_cp_remove_adv_monitor *cp;
4225
4226         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4227         if (cmd) {
4228                 cp = cmd->param;
4229
4230                 if (cp->monitor_handle)
4231                         sk_skip = cmd->sk;
4232         }
4233
4234         ev.monitor_handle = cpu_to_le16(handle);
4235
4236         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4237 }
4238
4239 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4240                                  void *data, u16 len)
4241 {
4242         struct adv_monitor *monitor = NULL;
4243         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4244         int handle, err;
4245         size_t rp_size = 0;
4246         __u32 supported = 0;
4247         __u32 enabled = 0;
4248         __u16 num_handles = 0;
4249         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4250
4251         BT_DBG("request for %s", hdev->name);
4252
4253         hci_dev_lock(hdev);
4254
4255         if (msft_monitor_supported(hdev))
4256                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4257
4258         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4259                 handles[num_handles++] = monitor->handle;
4260
4261         hci_dev_unlock(hdev);
4262
4263         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4264         rp = kmalloc(rp_size, GFP_KERNEL);
4265         if (!rp)
4266                 return -ENOMEM;
4267
4268         /* All supported features are currently enabled */
4269         enabled = supported;
4270
4271         rp->supported_features = cpu_to_le32(supported);
4272         rp->enabled_features = cpu_to_le32(enabled);
4273         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4274         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4275         rp->num_handles = cpu_to_le16(num_handles);
4276         if (num_handles)
4277                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4278
4279         err = mgmt_cmd_complete(sk, hdev->id,
4280                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4281                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4282
4283         kfree(rp);
4284
4285         return err;
4286 }
4287
4288 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4289 {
4290         struct mgmt_rp_add_adv_patterns_monitor rp;
4291         struct mgmt_pending_cmd *cmd;
4292         struct adv_monitor *monitor;
4293         int err = 0;
4294
4295         hci_dev_lock(hdev);
4296
4297         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4298         if (!cmd) {
4299                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4300                 if (!cmd)
4301                         goto done;
4302         }
4303
4304         monitor = cmd->user_data;
4305         rp.monitor_handle = cpu_to_le16(monitor->handle);
4306
4307         if (!status) {
4308                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4309                 hdev->adv_monitors_cnt++;
4310                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4311                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4312                 hci_update_background_scan(hdev);
4313         }
4314
4315         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4316                                 mgmt_status(status), &rp, sizeof(rp));
4317         mgmt_pending_remove(cmd);
4318
4319 done:
4320         hci_dev_unlock(hdev);
4321         bt_dev_dbg(hdev, "add monitor %d complete, status %u",
4322                    rp.monitor_handle, status);
4323
4324         return err;
4325 }
4326
4327 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4328                                       struct adv_monitor *m, u8 status,
4329                                       void *data, u16 len, u16 op)
4330 {
4331         struct mgmt_rp_add_adv_patterns_monitor rp;
4332         struct mgmt_pending_cmd *cmd;
4333         int err;
4334         bool pending;
4335
4336         hci_dev_lock(hdev);
4337
4338         if (status)
4339                 goto unlock;
4340
4341         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4342             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4343             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4344             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4345                 status = MGMT_STATUS_BUSY;
4346                 goto unlock;
4347         }
4348
4349         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4350         if (!cmd) {
4351                 status = MGMT_STATUS_NO_RESOURCES;
4352                 goto unlock;
4353         }
4354
4355         cmd->user_data = m;
4356         pending = hci_add_adv_monitor(hdev, m, &err);
4357         if (err) {
4358                 if (err == -ENOSPC || err == -ENOMEM)
4359                         status = MGMT_STATUS_NO_RESOURCES;
4360                 else if (err == -EINVAL)
4361                         status = MGMT_STATUS_INVALID_PARAMS;
4362                 else
4363                         status = MGMT_STATUS_FAILED;
4364
4365                 mgmt_pending_remove(cmd);
4366                 goto unlock;
4367         }
4368
4369         if (!pending) {
4370                 mgmt_pending_remove(cmd);
4371                 rp.monitor_handle = cpu_to_le16(m->handle);
4372                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4373                 m->state = ADV_MONITOR_STATE_REGISTERED;
4374                 hdev->adv_monitors_cnt++;
4375
4376                 hci_dev_unlock(hdev);
4377                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4378                                          &rp, sizeof(rp));
4379         }
4380
4381         hci_dev_unlock(hdev);
4382
4383         return 0;
4384
4385 unlock:
4386         hci_free_adv_monitor(hdev, m);
4387         hci_dev_unlock(hdev);
4388         return mgmt_cmd_status(sk, hdev->id, op, status);
4389 }
4390
4391 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4392                                    struct mgmt_adv_rssi_thresholds *rssi)
4393 {
4394         if (rssi) {
4395                 m->rssi.low_threshold = rssi->low_threshold;
4396                 m->rssi.low_threshold_timeout =
4397                     __le16_to_cpu(rssi->low_threshold_timeout);
4398                 m->rssi.high_threshold = rssi->high_threshold;
4399                 m->rssi.high_threshold_timeout =
4400                     __le16_to_cpu(rssi->high_threshold_timeout);
4401                 m->rssi.sampling_period = rssi->sampling_period;
4402         } else {
4403                 /* Default values. These numbers are the least constricting
4404                  * parameters for MSFT API to work, so it behaves as if there
4405                  * are no rssi parameter to consider. May need to be changed
4406                  * if other API are to be supported.
4407                  */
4408                 m->rssi.low_threshold = -127;
4409                 m->rssi.low_threshold_timeout = 60;
4410                 m->rssi.high_threshold = -127;
4411                 m->rssi.high_threshold_timeout = 0;
4412                 m->rssi.sampling_period = 0;
4413         }
4414 }
4415
4416 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4417                                     struct mgmt_adv_pattern *patterns)
4418 {
4419         u8 offset = 0, length = 0;
4420         struct adv_pattern *p = NULL;
4421         int i;
4422
4423         for (i = 0; i < pattern_count; i++) {
4424                 offset = patterns[i].offset;
4425                 length = patterns[i].length;
4426                 if (offset >= HCI_MAX_AD_LENGTH ||
4427                     length > HCI_MAX_AD_LENGTH ||
4428                     (offset + length) > HCI_MAX_AD_LENGTH)
4429                         return MGMT_STATUS_INVALID_PARAMS;
4430
4431                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4432                 if (!p)
4433                         return MGMT_STATUS_NO_RESOURCES;
4434
4435                 p->ad_type = patterns[i].ad_type;
4436                 p->offset = patterns[i].offset;
4437                 p->length = patterns[i].length;
4438                 memcpy(p->value, patterns[i].value, p->length);
4439
4440                 INIT_LIST_HEAD(&p->list);
4441                 list_add(&p->list, &m->patterns);
4442         }
4443
4444         return MGMT_STATUS_SUCCESS;
4445 }
4446
4447 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4448                                     void *data, u16 len)
4449 {
4450         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4451         struct adv_monitor *m = NULL;
4452         u8 status = MGMT_STATUS_SUCCESS;
4453         size_t expected_size = sizeof(*cp);
4454
4455         BT_DBG("request for %s", hdev->name);
4456
4457         if (len <= sizeof(*cp)) {
4458                 status = MGMT_STATUS_INVALID_PARAMS;
4459                 goto done;
4460         }
4461
4462         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4463         if (len != expected_size) {
4464                 status = MGMT_STATUS_INVALID_PARAMS;
4465                 goto done;
4466         }
4467
4468         m = kzalloc(sizeof(*m), GFP_KERNEL);
4469         if (!m) {
4470                 status = MGMT_STATUS_NO_RESOURCES;
4471                 goto done;
4472         }
4473
4474         INIT_LIST_HEAD(&m->patterns);
4475
4476         parse_adv_monitor_rssi(m, NULL);
4477         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4478
4479 done:
4480         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4481                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4482 }
4483
4484 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4485                                          void *data, u16 len)
4486 {
4487         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4488         struct adv_monitor *m = NULL;
4489         u8 status = MGMT_STATUS_SUCCESS;
4490         size_t expected_size = sizeof(*cp);
4491
4492         BT_DBG("request for %s", hdev->name);
4493
4494         if (len <= sizeof(*cp)) {
4495                 status = MGMT_STATUS_INVALID_PARAMS;
4496                 goto done;
4497         }
4498
4499         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4500         if (len != expected_size) {
4501                 status = MGMT_STATUS_INVALID_PARAMS;
4502                 goto done;
4503         }
4504
4505         m = kzalloc(sizeof(*m), GFP_KERNEL);
4506         if (!m) {
4507                 status = MGMT_STATUS_NO_RESOURCES;
4508                 goto done;
4509         }
4510
4511         INIT_LIST_HEAD(&m->patterns);
4512
4513         parse_adv_monitor_rssi(m, &cp->rssi);
4514         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4515
4516 done:
4517         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4518                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4519 }
4520
4521 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4522 {
4523         struct mgmt_rp_remove_adv_monitor rp;
4524         struct mgmt_cp_remove_adv_monitor *cp;
4525         struct mgmt_pending_cmd *cmd;
4526         int err = 0;
4527
4528         hci_dev_lock(hdev);
4529
4530         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4531         if (!cmd)
4532                 goto done;
4533
4534         cp = cmd->param;
4535         rp.monitor_handle = cp->monitor_handle;
4536
4537         if (!status)
4538                 hci_update_background_scan(hdev);
4539
4540         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4541                                 mgmt_status(status), &rp, sizeof(rp));
4542         mgmt_pending_remove(cmd);
4543
4544 done:
4545         hci_dev_unlock(hdev);
4546         bt_dev_dbg(hdev, "remove monitor %d complete, status %u",
4547                    rp.monitor_handle, status);
4548
4549         return err;
4550 }
4551
4552 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4553                               void *data, u16 len)
4554 {
4555         struct mgmt_cp_remove_adv_monitor *cp = data;
4556         struct mgmt_rp_remove_adv_monitor rp;
4557         struct mgmt_pending_cmd *cmd;
4558         u16 handle = __le16_to_cpu(cp->monitor_handle);
4559         int err, status;
4560         bool pending;
4561
4562         BT_DBG("request for %s", hdev->name);
4563         rp.monitor_handle = cp->monitor_handle;
4564
4565         hci_dev_lock(hdev);
4566
4567         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4568             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4569             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4570             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4571                 status = MGMT_STATUS_BUSY;
4572                 goto unlock;
4573         }
4574
4575         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4576         if (!cmd) {
4577                 status = MGMT_STATUS_NO_RESOURCES;
4578                 goto unlock;
4579         }
4580
4581         if (handle)
4582                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4583         else
4584                 pending = hci_remove_all_adv_monitor(hdev, &err);
4585
4586         if (err) {
4587                 mgmt_pending_remove(cmd);
4588
4589                 if (err == -ENOENT)
4590                         status = MGMT_STATUS_INVALID_INDEX;
4591                 else
4592                         status = MGMT_STATUS_FAILED;
4593
4594                 goto unlock;
4595         }
4596
4597         /* monitor can be removed without forwarding request to controller */
4598         if (!pending) {
4599                 mgmt_pending_remove(cmd);
4600                 hci_dev_unlock(hdev);
4601
4602                 return mgmt_cmd_complete(sk, hdev->id,
4603                                          MGMT_OP_REMOVE_ADV_MONITOR,
4604                                          MGMT_STATUS_SUCCESS,
4605                                          &rp, sizeof(rp));
4606         }
4607
4608         hci_dev_unlock(hdev);
4609         return 0;
4610
4611 unlock:
4612         hci_dev_unlock(hdev);
4613         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4614                                status);
4615 }
4616
4617 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4618                                          u16 opcode, struct sk_buff *skb)
4619 {
4620         struct mgmt_rp_read_local_oob_data mgmt_rp;
4621         size_t rp_size = sizeof(mgmt_rp);
4622         struct mgmt_pending_cmd *cmd;
4623
4624         bt_dev_dbg(hdev, "status %u", status);
4625
4626         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4627         if (!cmd)
4628                 return;
4629
4630         if (status || !skb) {
4631                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4632                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4633                 goto remove;
4634         }
4635
4636         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4637
4638         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4639                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4640
4641                 if (skb->len < sizeof(*rp)) {
4642                         mgmt_cmd_status(cmd->sk, hdev->id,
4643                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4644                                         MGMT_STATUS_FAILED);
4645                         goto remove;
4646                 }
4647
4648                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4649                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4650
4651                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4652         } else {
4653                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4654
4655                 if (skb->len < sizeof(*rp)) {
4656                         mgmt_cmd_status(cmd->sk, hdev->id,
4657                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4658                                         MGMT_STATUS_FAILED);
4659                         goto remove;
4660                 }
4661
4662                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4663                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4664
4665                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4666                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4667         }
4668
4669         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4670                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4671
4672 remove:
4673         mgmt_pending_remove(cmd);
4674 }
4675
4676 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4677                                void *data, u16 data_len)
4678 {
4679         struct mgmt_pending_cmd *cmd;
4680         struct hci_request req;
4681         int err;
4682
4683         bt_dev_dbg(hdev, "sock %p", sk);
4684
4685         hci_dev_lock(hdev);
4686
4687         if (!hdev_is_powered(hdev)) {
4688                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4689                                       MGMT_STATUS_NOT_POWERED);
4690                 goto unlock;
4691         }
4692
4693         if (!lmp_ssp_capable(hdev)) {
4694                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4695                                       MGMT_STATUS_NOT_SUPPORTED);
4696                 goto unlock;
4697         }
4698
4699         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4700                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4701                                       MGMT_STATUS_BUSY);
4702                 goto unlock;
4703         }
4704
4705         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4706         if (!cmd) {
4707                 err = -ENOMEM;
4708                 goto unlock;
4709         }
4710
4711         hci_req_init(&req, hdev);
4712
4713         if (bredr_sc_enabled(hdev))
4714                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4715         else
4716                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4717
4718         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4719         if (err < 0)
4720                 mgmt_pending_remove(cmd);
4721
4722 unlock:
4723         hci_dev_unlock(hdev);
4724         return err;
4725 }
4726
4727 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4728                                void *data, u16 len)
4729 {
4730         struct mgmt_addr_info *addr = data;
4731         int err;
4732
4733         bt_dev_dbg(hdev, "sock %p", sk);
4734
4735         if (!bdaddr_type_is_valid(addr->type))
4736                 return mgmt_cmd_complete(sk, hdev->id,
4737                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4738                                          MGMT_STATUS_INVALID_PARAMS,
4739                                          addr, sizeof(*addr));
4740
4741         hci_dev_lock(hdev);
4742
4743         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4744                 struct mgmt_cp_add_remote_oob_data *cp = data;
4745                 u8 status;
4746
4747                 if (cp->addr.type != BDADDR_BREDR) {
4748                         err = mgmt_cmd_complete(sk, hdev->id,
4749                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4750                                                 MGMT_STATUS_INVALID_PARAMS,
4751                                                 &cp->addr, sizeof(cp->addr));
4752                         goto unlock;
4753                 }
4754
4755                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4756                                               cp->addr.type, cp->hash,
4757                                               cp->rand, NULL, NULL);
4758                 if (err < 0)
4759                         status = MGMT_STATUS_FAILED;
4760                 else
4761                         status = MGMT_STATUS_SUCCESS;
4762
4763                 err = mgmt_cmd_complete(sk, hdev->id,
4764                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4765                                         &cp->addr, sizeof(cp->addr));
4766         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4767                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4768                 u8 *rand192, *hash192, *rand256, *hash256;
4769                 u8 status;
4770
4771                 if (bdaddr_type_is_le(cp->addr.type)) {
4772                         /* Enforce zero-valued 192-bit parameters as
4773                          * long as legacy SMP OOB isn't implemented.
4774                          */
4775                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4776                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4777                                 err = mgmt_cmd_complete(sk, hdev->id,
4778                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4779                                                         MGMT_STATUS_INVALID_PARAMS,
4780                                                         addr, sizeof(*addr));
4781                                 goto unlock;
4782                         }
4783
4784                         rand192 = NULL;
4785                         hash192 = NULL;
4786                 } else {
4787                         /* In case one of the P-192 values is set to zero,
4788                          * then just disable OOB data for P-192.
4789                          */
4790                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4791                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4792                                 rand192 = NULL;
4793                                 hash192 = NULL;
4794                         } else {
4795                                 rand192 = cp->rand192;
4796                                 hash192 = cp->hash192;
4797                         }
4798                 }
4799
4800                 /* In case one of the P-256 values is set to zero, then just
4801                  * disable OOB data for P-256.
4802                  */
4803                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4804                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4805                         rand256 = NULL;
4806                         hash256 = NULL;
4807                 } else {
4808                         rand256 = cp->rand256;
4809                         hash256 = cp->hash256;
4810                 }
4811
4812                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4813                                               cp->addr.type, hash192, rand192,
4814                                               hash256, rand256);
4815                 if (err < 0)
4816                         status = MGMT_STATUS_FAILED;
4817                 else
4818                         status = MGMT_STATUS_SUCCESS;
4819
4820                 err = mgmt_cmd_complete(sk, hdev->id,
4821                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4822                                         status, &cp->addr, sizeof(cp->addr));
4823         } else {
4824                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4825                            len);
4826                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4827                                       MGMT_STATUS_INVALID_PARAMS);
4828         }
4829
4830 unlock:
4831         hci_dev_unlock(hdev);
4832         return err;
4833 }
4834
4835 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4836                                   void *data, u16 len)
4837 {
4838         struct mgmt_cp_remove_remote_oob_data *cp = data;
4839         u8 status;
4840         int err;
4841
4842         bt_dev_dbg(hdev, "sock %p", sk);
4843
4844         if (cp->addr.type != BDADDR_BREDR)
4845                 return mgmt_cmd_complete(sk, hdev->id,
4846                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4847                                          MGMT_STATUS_INVALID_PARAMS,
4848                                          &cp->addr, sizeof(cp->addr));
4849
4850         hci_dev_lock(hdev);
4851
4852         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4853                 hci_remote_oob_data_clear(hdev);
4854                 status = MGMT_STATUS_SUCCESS;
4855                 goto done;
4856         }
4857
4858         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4859         if (err < 0)
4860                 status = MGMT_STATUS_INVALID_PARAMS;
4861         else
4862                 status = MGMT_STATUS_SUCCESS;
4863
4864 done:
4865         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4866                                 status, &cp->addr, sizeof(cp->addr));
4867
4868         hci_dev_unlock(hdev);
4869         return err;
4870 }
4871
4872 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4873 {
4874         struct mgmt_pending_cmd *cmd;
4875
4876         bt_dev_dbg(hdev, "status %u", status);
4877
4878         hci_dev_lock(hdev);
4879
4880         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4881         if (!cmd)
4882                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4883
4884         if (!cmd)
4885                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4886
4887         if (cmd) {
4888                 cmd->cmd_complete(cmd, mgmt_status(status));
4889                 mgmt_pending_remove(cmd);
4890         }
4891
4892         hci_dev_unlock(hdev);
4893
4894         /* Handle suspend notifier */
4895         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4896                                hdev->suspend_tasks)) {
4897                 bt_dev_dbg(hdev, "Unpaused discovery");
4898                 wake_up(&hdev->suspend_wait_q);
4899         }
4900 }
4901
4902 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4903                                     uint8_t *mgmt_status)
4904 {
4905         switch (type) {
4906         case DISCOV_TYPE_LE:
4907                 *mgmt_status = mgmt_le_support(hdev);
4908                 if (*mgmt_status)
4909                         return false;
4910                 break;
4911         case DISCOV_TYPE_INTERLEAVED:
4912                 *mgmt_status = mgmt_le_support(hdev);
4913                 if (*mgmt_status)
4914                         return false;
4915                 fallthrough;
4916         case DISCOV_TYPE_BREDR:
4917                 *mgmt_status = mgmt_bredr_support(hdev);
4918                 if (*mgmt_status)
4919                         return false;
4920                 break;
4921         default:
4922                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4923                 return false;
4924         }
4925
4926         return true;
4927 }
4928
4929 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4930                                     u16 op, void *data, u16 len)
4931 {
4932         struct mgmt_cp_start_discovery *cp = data;
4933         struct mgmt_pending_cmd *cmd;
4934         u8 status;
4935         int err;
4936
4937         bt_dev_dbg(hdev, "sock %p", sk);
4938
4939         hci_dev_lock(hdev);
4940
4941         if (!hdev_is_powered(hdev)) {
4942                 err = mgmt_cmd_complete(sk, hdev->id, op,
4943                                         MGMT_STATUS_NOT_POWERED,
4944                                         &cp->type, sizeof(cp->type));
4945                 goto failed;
4946         }
4947
4948         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4949             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4950                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4951                                         &cp->type, sizeof(cp->type));
4952                 goto failed;
4953         }
4954
4955         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4956                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4957                                         &cp->type, sizeof(cp->type));
4958                 goto failed;
4959         }
4960
4961         /* Can't start discovery when it is paused */
4962         if (hdev->discovery_paused) {
4963                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4964                                         &cp->type, sizeof(cp->type));
4965                 goto failed;
4966         }
4967
4968         /* Clear the discovery filter first to free any previously
4969          * allocated memory for the UUID list.
4970          */
4971         hci_discovery_filter_clear(hdev);
4972
4973         hdev->discovery.type = cp->type;
4974         hdev->discovery.report_invalid_rssi = false;
4975         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4976                 hdev->discovery.limited = true;
4977         else
4978                 hdev->discovery.limited = false;
4979
4980         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4981         if (!cmd) {
4982                 err = -ENOMEM;
4983                 goto failed;
4984         }
4985
4986         cmd->cmd_complete = generic_cmd_complete;
4987
4988         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4989         queue_work(hdev->req_workqueue, &hdev->discov_update);
4990         err = 0;
4991
4992 failed:
4993         hci_dev_unlock(hdev);
4994         return err;
4995 }
4996
4997 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4998                            void *data, u16 len)
4999 {
5000         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
5001                                         data, len);
5002 }
5003
5004 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5005                                    void *data, u16 len)
5006 {
5007         return start_discovery_internal(sk, hdev,
5008                                         MGMT_OP_START_LIMITED_DISCOVERY,
5009                                         data, len);
5010 }
5011
5012 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
5013                                           u8 status)
5014 {
5015         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
5016                                  cmd->param, 1);
5017 }
5018
5019 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5020                                    void *data, u16 len)
5021 {
5022         struct mgmt_cp_start_service_discovery *cp = data;
5023         struct mgmt_pending_cmd *cmd;
5024         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5025         u16 uuid_count, expected_len;
5026         u8 status;
5027         int err;
5028
5029         bt_dev_dbg(hdev, "sock %p", sk);
5030
5031         hci_dev_lock(hdev);
5032
5033         if (!hdev_is_powered(hdev)) {
5034                 err = mgmt_cmd_complete(sk, hdev->id,
5035                                         MGMT_OP_START_SERVICE_DISCOVERY,
5036                                         MGMT_STATUS_NOT_POWERED,
5037                                         &cp->type, sizeof(cp->type));
5038                 goto failed;
5039         }
5040
5041         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5042             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5043                 err = mgmt_cmd_complete(sk, hdev->id,
5044                                         MGMT_OP_START_SERVICE_DISCOVERY,
5045                                         MGMT_STATUS_BUSY, &cp->type,
5046                                         sizeof(cp->type));
5047                 goto failed;
5048         }
5049
5050         if (hdev->discovery_paused) {
5051                 err = mgmt_cmd_complete(sk, hdev->id,
5052                                         MGMT_OP_START_SERVICE_DISCOVERY,
5053                                         MGMT_STATUS_BUSY, &cp->type,
5054                                         sizeof(cp->type));
5055                 goto failed;
5056         }
5057
5058         uuid_count = __le16_to_cpu(cp->uuid_count);
5059         if (uuid_count > max_uuid_count) {
5060                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5061                            uuid_count);
5062                 err = mgmt_cmd_complete(sk, hdev->id,
5063                                         MGMT_OP_START_SERVICE_DISCOVERY,
5064                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5065                                         sizeof(cp->type));
5066                 goto failed;
5067         }
5068
5069         expected_len = sizeof(*cp) + uuid_count * 16;
5070         if (expected_len != len) {
5071                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5072                            expected_len, len);
5073                 err = mgmt_cmd_complete(sk, hdev->id,
5074                                         MGMT_OP_START_SERVICE_DISCOVERY,
5075                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5076                                         sizeof(cp->type));
5077                 goto failed;
5078         }
5079
5080         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5081                 err = mgmt_cmd_complete(sk, hdev->id,
5082                                         MGMT_OP_START_SERVICE_DISCOVERY,
5083                                         status, &cp->type, sizeof(cp->type));
5084                 goto failed;
5085         }
5086
5087         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5088                                hdev, data, len);
5089         if (!cmd) {
5090                 err = -ENOMEM;
5091                 goto failed;
5092         }
5093
5094         cmd->cmd_complete = service_discovery_cmd_complete;
5095
5096         /* Clear the discovery filter first to free any previously
5097          * allocated memory for the UUID list.
5098          */
5099         hci_discovery_filter_clear(hdev);
5100
5101         hdev->discovery.result_filtering = true;
5102         hdev->discovery.type = cp->type;
5103         hdev->discovery.rssi = cp->rssi;
5104         hdev->discovery.uuid_count = uuid_count;
5105
5106         if (uuid_count > 0) {
5107                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5108                                                 GFP_KERNEL);
5109                 if (!hdev->discovery.uuids) {
5110                         err = mgmt_cmd_complete(sk, hdev->id,
5111                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5112                                                 MGMT_STATUS_FAILED,
5113                                                 &cp->type, sizeof(cp->type));
5114                         mgmt_pending_remove(cmd);
5115                         goto failed;
5116                 }
5117         }
5118
5119         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5120         queue_work(hdev->req_workqueue, &hdev->discov_update);
5121         err = 0;
5122
5123 failed:
5124         hci_dev_unlock(hdev);
5125         return err;
5126 }
5127
5128 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5129 {
5130         struct mgmt_pending_cmd *cmd;
5131
5132         bt_dev_dbg(hdev, "status %u", status);
5133
5134         hci_dev_lock(hdev);
5135
5136         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5137         if (cmd) {
5138                 cmd->cmd_complete(cmd, mgmt_status(status));
5139                 mgmt_pending_remove(cmd);
5140         }
5141
5142         hci_dev_unlock(hdev);
5143
5144         /* Handle suspend notifier */
5145         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5146                 bt_dev_dbg(hdev, "Paused discovery");
5147                 wake_up(&hdev->suspend_wait_q);
5148         }
5149 }
5150
5151 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5152                           u16 len)
5153 {
5154         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5155         struct mgmt_pending_cmd *cmd;
5156         int err;
5157
5158         bt_dev_dbg(hdev, "sock %p", sk);
5159
5160         hci_dev_lock(hdev);
5161
5162         if (!hci_discovery_active(hdev)) {
5163                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5164                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5165                                         sizeof(mgmt_cp->type));
5166                 goto unlock;
5167         }
5168
5169         if (hdev->discovery.type != mgmt_cp->type) {
5170                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5171                                         MGMT_STATUS_INVALID_PARAMS,
5172                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5173                 goto unlock;
5174         }
5175
5176         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5177         if (!cmd) {
5178                 err = -ENOMEM;
5179                 goto unlock;
5180         }
5181
5182         cmd->cmd_complete = generic_cmd_complete;
5183
5184         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5185         queue_work(hdev->req_workqueue, &hdev->discov_update);
5186         err = 0;
5187
5188 unlock:
5189         hci_dev_unlock(hdev);
5190         return err;
5191 }
5192
5193 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5194                         u16 len)
5195 {
5196         struct mgmt_cp_confirm_name *cp = data;
5197         struct inquiry_entry *e;
5198         int err;
5199
5200         bt_dev_dbg(hdev, "sock %p", sk);
5201
5202         hci_dev_lock(hdev);
5203
5204         if (!hci_discovery_active(hdev)) {
5205                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5206                                         MGMT_STATUS_FAILED, &cp->addr,
5207                                         sizeof(cp->addr));
5208                 goto failed;
5209         }
5210
5211         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5212         if (!e) {
5213                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5214                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5215                                         sizeof(cp->addr));
5216                 goto failed;
5217         }
5218
5219         if (cp->name_known) {
5220                 e->name_state = NAME_KNOWN;
5221                 list_del(&e->list);
5222         } else {
5223                 e->name_state = NAME_NEEDED;
5224                 hci_inquiry_cache_update_resolve(hdev, e);
5225         }
5226
5227         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5228                                 &cp->addr, sizeof(cp->addr));
5229
5230 failed:
5231         hci_dev_unlock(hdev);
5232         return err;
5233 }
5234
5235 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5236                         u16 len)
5237 {
5238         struct mgmt_cp_block_device *cp = data;
5239         u8 status;
5240         int err;
5241
5242         bt_dev_dbg(hdev, "sock %p", sk);
5243
5244         if (!bdaddr_type_is_valid(cp->addr.type))
5245                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5246                                          MGMT_STATUS_INVALID_PARAMS,
5247                                          &cp->addr, sizeof(cp->addr));
5248
5249         hci_dev_lock(hdev);
5250
5251         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
5252                                   cp->addr.type);
5253         if (err < 0) {
5254                 status = MGMT_STATUS_FAILED;
5255                 goto done;
5256         }
5257
5258         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5259                    sk);
5260         status = MGMT_STATUS_SUCCESS;
5261
5262 done:
5263         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5264                                 &cp->addr, sizeof(cp->addr));
5265
5266         hci_dev_unlock(hdev);
5267
5268         return err;
5269 }
5270
5271 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5272                           u16 len)
5273 {
5274         struct mgmt_cp_unblock_device *cp = data;
5275         u8 status;
5276         int err;
5277
5278         bt_dev_dbg(hdev, "sock %p", sk);
5279
5280         if (!bdaddr_type_is_valid(cp->addr.type))
5281                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5282                                          MGMT_STATUS_INVALID_PARAMS,
5283                                          &cp->addr, sizeof(cp->addr));
5284
5285         hci_dev_lock(hdev);
5286
5287         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5288                                   cp->addr.type);
5289         if (err < 0) {
5290                 status = MGMT_STATUS_INVALID_PARAMS;
5291                 goto done;
5292         }
5293
5294         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5295                    sk);
5296         status = MGMT_STATUS_SUCCESS;
5297
5298 done:
5299         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5300                                 &cp->addr, sizeof(cp->addr));
5301
5302         hci_dev_unlock(hdev);
5303
5304         return err;
5305 }
5306
5307 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5308                          u16 len)
5309 {
5310         struct mgmt_cp_set_device_id *cp = data;
5311         struct hci_request req;
5312         int err;
5313         __u16 source;
5314
5315         bt_dev_dbg(hdev, "sock %p", sk);
5316
5317         source = __le16_to_cpu(cp->source);
5318
5319         if (source > 0x0002)
5320                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5321                                        MGMT_STATUS_INVALID_PARAMS);
5322
5323         hci_dev_lock(hdev);
5324
5325         hdev->devid_source = source;
5326         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5327         hdev->devid_product = __le16_to_cpu(cp->product);
5328         hdev->devid_version = __le16_to_cpu(cp->version);
5329
5330         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5331                                 NULL, 0);
5332
5333         hci_req_init(&req, hdev);
5334         __hci_req_update_eir(&req);
5335         hci_req_run(&req, NULL);
5336
5337         hci_dev_unlock(hdev);
5338
5339         return err;
5340 }
5341
5342 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5343                                         u16 opcode)
5344 {
5345         bt_dev_dbg(hdev, "status %u", status);
5346 }
5347
5348 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5349                                      u16 opcode)
5350 {
5351         struct cmd_lookup match = { NULL, hdev };
5352         struct hci_request req;
5353         u8 instance;
5354         struct adv_info *adv_instance;
5355         int err;
5356
5357         hci_dev_lock(hdev);
5358
5359         if (status) {
5360                 u8 mgmt_err = mgmt_status(status);
5361
5362                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5363                                      cmd_status_rsp, &mgmt_err);
5364                 goto unlock;
5365         }
5366
5367         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5368                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5369         else
5370                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5371
5372         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5373                              &match);
5374
5375         new_settings(hdev, match.sk);
5376
5377         if (match.sk)
5378                 sock_put(match.sk);
5379
5380         /* Handle suspend notifier */
5381         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5382                                hdev->suspend_tasks)) {
5383                 bt_dev_dbg(hdev, "Paused advertising");
5384                 wake_up(&hdev->suspend_wait_q);
5385         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5386                                       hdev->suspend_tasks)) {
5387                 bt_dev_dbg(hdev, "Unpaused advertising");
5388                 wake_up(&hdev->suspend_wait_q);
5389         }
5390
5391         /* If "Set Advertising" was just disabled and instance advertising was
5392          * set up earlier, then re-enable multi-instance advertising.
5393          */
5394         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5395             list_empty(&hdev->adv_instances))
5396                 goto unlock;
5397
5398         instance = hdev->cur_adv_instance;
5399         if (!instance) {
5400                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5401                                                         struct adv_info, list);
5402                 if (!adv_instance)
5403                         goto unlock;
5404
5405                 instance = adv_instance->instance;
5406         }
5407
5408         hci_req_init(&req, hdev);
5409
5410         err = __hci_req_schedule_adv_instance(&req, instance, true);
5411
5412         if (!err)
5413                 err = hci_req_run(&req, enable_advertising_instance);
5414
5415         if (err)
5416                 bt_dev_err(hdev, "failed to re-configure advertising");
5417
5418 unlock:
5419         hci_dev_unlock(hdev);
5420 }
5421
5422 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5423                            u16 len)
5424 {
5425         struct mgmt_mode *cp = data;
5426         struct mgmt_pending_cmd *cmd;
5427         struct hci_request req;
5428         u8 val, status;
5429         int err;
5430
5431         bt_dev_dbg(hdev, "sock %p", sk);
5432
5433         status = mgmt_le_support(hdev);
5434         if (status)
5435                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5436                                        status);
5437
5438         /* Enabling the experimental LL Privay support disables support for
5439          * advertising.
5440          */
5441         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5442                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5443                                        MGMT_STATUS_NOT_SUPPORTED);
5444
5445         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5446                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5447                                        MGMT_STATUS_INVALID_PARAMS);
5448
5449         if (hdev->advertising_paused)
5450                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5451                                        MGMT_STATUS_BUSY);
5452
5453         hci_dev_lock(hdev);
5454
5455         val = !!cp->val;
5456
5457         /* The following conditions are ones which mean that we should
5458          * not do any HCI communication but directly send a mgmt
5459          * response to user space (after toggling the flag if
5460          * necessary).
5461          */
5462         if (!hdev_is_powered(hdev) ||
5463             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5464              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5465             hci_conn_num(hdev, LE_LINK) > 0 ||
5466             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5467              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5468                 bool changed;
5469
5470                 if (cp->val) {
5471                         hdev->cur_adv_instance = 0x00;
5472                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5473                         if (cp->val == 0x02)
5474                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5475                         else
5476                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5477                 } else {
5478                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5479                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5480                 }
5481
5482                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5483                 if (err < 0)
5484                         goto unlock;
5485
5486                 if (changed)
5487                         err = new_settings(hdev, sk);
5488
5489                 goto unlock;
5490         }
5491
5492         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5493             pending_find(MGMT_OP_SET_LE, hdev)) {
5494                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5495                                       MGMT_STATUS_BUSY);
5496                 goto unlock;
5497         }
5498
5499         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5500         if (!cmd) {
5501                 err = -ENOMEM;
5502                 goto unlock;
5503         }
5504
5505         hci_req_init(&req, hdev);
5506
5507         if (cp->val == 0x02)
5508                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5509         else
5510                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5511
5512         cancel_adv_timeout(hdev);
5513
5514         if (val) {
5515                 /* Switch to instance "0" for the Set Advertising setting.
5516                  * We cannot use update_[adv|scan_rsp]_data() here as the
5517                  * HCI_ADVERTISING flag is not yet set.
5518                  */
5519                 hdev->cur_adv_instance = 0x00;
5520
5521                 if (ext_adv_capable(hdev)) {
5522                         __hci_req_start_ext_adv(&req, 0x00);
5523                 } else {
5524                         __hci_req_update_adv_data(&req, 0x00);
5525                         __hci_req_update_scan_rsp_data(&req, 0x00);
5526                         __hci_req_enable_advertising(&req);
5527                 }
5528         } else {
5529                 __hci_req_disable_advertising(&req);
5530         }
5531
5532         err = hci_req_run(&req, set_advertising_complete);
5533         if (err < 0)
5534                 mgmt_pending_remove(cmd);
5535
5536 unlock:
5537         hci_dev_unlock(hdev);
5538         return err;
5539 }
5540
5541 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5542                               void *data, u16 len)
5543 {
5544         struct mgmt_cp_set_static_address *cp = data;
5545         int err;
5546
5547         bt_dev_dbg(hdev, "sock %p", sk);
5548
5549         if (!lmp_le_capable(hdev))
5550                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5551                                        MGMT_STATUS_NOT_SUPPORTED);
5552
5553         if (hdev_is_powered(hdev))
5554                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5555                                        MGMT_STATUS_REJECTED);
5556
5557         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5558                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5559                         return mgmt_cmd_status(sk, hdev->id,
5560                                                MGMT_OP_SET_STATIC_ADDRESS,
5561                                                MGMT_STATUS_INVALID_PARAMS);
5562
5563                 /* Two most significant bits shall be set */
5564                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5565                         return mgmt_cmd_status(sk, hdev->id,
5566                                                MGMT_OP_SET_STATIC_ADDRESS,
5567                                                MGMT_STATUS_INVALID_PARAMS);
5568         }
5569
5570         hci_dev_lock(hdev);
5571
5572         bacpy(&hdev->static_addr, &cp->bdaddr);
5573
5574         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5575         if (err < 0)
5576                 goto unlock;
5577
5578         err = new_settings(hdev, sk);
5579
5580 unlock:
5581         hci_dev_unlock(hdev);
5582         return err;
5583 }
5584
5585 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5586                            void *data, u16 len)
5587 {
5588         struct mgmt_cp_set_scan_params *cp = data;
5589         __u16 interval, window;
5590         int err;
5591
5592         bt_dev_dbg(hdev, "sock %p", sk);
5593
5594         if (!lmp_le_capable(hdev))
5595                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5596                                        MGMT_STATUS_NOT_SUPPORTED);
5597
5598         interval = __le16_to_cpu(cp->interval);
5599
5600         if (interval < 0x0004 || interval > 0x4000)
5601                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5602                                        MGMT_STATUS_INVALID_PARAMS);
5603
5604         window = __le16_to_cpu(cp->window);
5605
5606         if (window < 0x0004 || window > 0x4000)
5607                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5608                                        MGMT_STATUS_INVALID_PARAMS);
5609
5610         if (window > interval)
5611                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5612                                        MGMT_STATUS_INVALID_PARAMS);
5613
5614         hci_dev_lock(hdev);
5615
5616         hdev->le_scan_interval = interval;
5617         hdev->le_scan_window = window;
5618
5619         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5620                                 NULL, 0);
5621
5622         /* If background scan is running, restart it so new parameters are
5623          * loaded.
5624          */
5625         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5626             hdev->discovery.state == DISCOVERY_STOPPED) {
5627                 struct hci_request req;
5628
5629                 hci_req_init(&req, hdev);
5630
5631                 hci_req_add_le_scan_disable(&req, false);
5632                 hci_req_add_le_passive_scan(&req);
5633
5634                 hci_req_run(&req, NULL);
5635         }
5636
5637         hci_dev_unlock(hdev);
5638
5639         return err;
5640 }
5641
5642 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5643                                       u16 opcode)
5644 {
5645         struct mgmt_pending_cmd *cmd;
5646
5647         bt_dev_dbg(hdev, "status 0x%02x", status);
5648
5649         hci_dev_lock(hdev);
5650
5651         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5652         if (!cmd)
5653                 goto unlock;
5654
5655         if (status) {
5656                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5657                                 mgmt_status(status));
5658         } else {
5659                 struct mgmt_mode *cp = cmd->param;
5660
5661                 if (cp->val)
5662                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5663                 else
5664                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5665
5666                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5667                 new_settings(hdev, cmd->sk);
5668         }
5669
5670         mgmt_pending_remove(cmd);
5671
5672 unlock:
5673         hci_dev_unlock(hdev);
5674 }
5675
5676 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5677                                 void *data, u16 len)
5678 {
5679         struct mgmt_mode *cp = data;
5680         struct mgmt_pending_cmd *cmd;
5681         struct hci_request req;
5682         int err;
5683
5684         bt_dev_dbg(hdev, "sock %p", sk);
5685
5686         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5687             hdev->hci_ver < BLUETOOTH_VER_1_2)
5688                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5689                                        MGMT_STATUS_NOT_SUPPORTED);
5690
5691         if (cp->val != 0x00 && cp->val != 0x01)
5692                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5693                                        MGMT_STATUS_INVALID_PARAMS);
5694
5695         hci_dev_lock(hdev);
5696
5697         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5698                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5699                                       MGMT_STATUS_BUSY);
5700                 goto unlock;
5701         }
5702
5703         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5704                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5705                                         hdev);
5706                 goto unlock;
5707         }
5708
5709         if (!hdev_is_powered(hdev)) {
5710                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5711                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5712                                         hdev);
5713                 new_settings(hdev, sk);
5714                 goto unlock;
5715         }
5716
5717         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5718                                data, len);
5719         if (!cmd) {
5720                 err = -ENOMEM;
5721                 goto unlock;
5722         }
5723
5724         hci_req_init(&req, hdev);
5725
5726         __hci_req_write_fast_connectable(&req, cp->val);
5727
5728         err = hci_req_run(&req, fast_connectable_complete);
5729         if (err < 0) {
5730                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5731                                       MGMT_STATUS_FAILED);
5732                 mgmt_pending_remove(cmd);
5733         }
5734
5735 unlock:
5736         hci_dev_unlock(hdev);
5737
5738         return err;
5739 }
5740
5741 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5742 {
5743         struct mgmt_pending_cmd *cmd;
5744
5745         bt_dev_dbg(hdev, "status 0x%02x", status);
5746
5747         hci_dev_lock(hdev);
5748
5749         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5750         if (!cmd)
5751                 goto unlock;
5752
5753         if (status) {
5754                 u8 mgmt_err = mgmt_status(status);
5755
5756                 /* We need to restore the flag if related HCI commands
5757                  * failed.
5758                  */
5759                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5760
5761                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5762         } else {
5763                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5764                 new_settings(hdev, cmd->sk);
5765         }
5766
5767         mgmt_pending_remove(cmd);
5768
5769 unlock:
5770         hci_dev_unlock(hdev);
5771 }
5772
5773 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5774 {
5775         struct mgmt_mode *cp = data;
5776         struct mgmt_pending_cmd *cmd;
5777         struct hci_request req;
5778         int err;
5779
5780         bt_dev_dbg(hdev, "sock %p", sk);
5781
5782         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5783                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5784                                        MGMT_STATUS_NOT_SUPPORTED);
5785
5786         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5787                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5788                                        MGMT_STATUS_REJECTED);
5789
5790         if (cp->val != 0x00 && cp->val != 0x01)
5791                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5792                                        MGMT_STATUS_INVALID_PARAMS);
5793
5794         hci_dev_lock(hdev);
5795
5796         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5797                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5798                 goto unlock;
5799         }
5800
5801         if (!hdev_is_powered(hdev)) {
5802                 if (!cp->val) {
5803                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5804                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5805                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5806                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5807                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5808                 }
5809
5810                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5811
5812                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5813                 if (err < 0)
5814                         goto unlock;
5815
5816                 err = new_settings(hdev, sk);
5817                 goto unlock;
5818         }
5819
5820         /* Reject disabling when powered on */
5821         if (!cp->val) {
5822                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5823                                       MGMT_STATUS_REJECTED);
5824                 goto unlock;
5825         } else {
5826                 /* When configuring a dual-mode controller to operate
5827                  * with LE only and using a static address, then switching
5828                  * BR/EDR back on is not allowed.
5829                  *
5830                  * Dual-mode controllers shall operate with the public
5831                  * address as its identity address for BR/EDR and LE. So
5832                  * reject the attempt to create an invalid configuration.
5833                  *
5834                  * The same restrictions applies when secure connections
5835                  * has been enabled. For BR/EDR this is a controller feature
5836                  * while for LE it is a host stack feature. This means that
5837                  * switching BR/EDR back on when secure connections has been
5838                  * enabled is not a supported transaction.
5839                  */
5840                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5841                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5842                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5843                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5844                                               MGMT_STATUS_REJECTED);
5845                         goto unlock;
5846                 }
5847         }
5848
5849         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5850                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5851                                       MGMT_STATUS_BUSY);
5852                 goto unlock;
5853         }
5854
5855         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5856         if (!cmd) {
5857                 err = -ENOMEM;
5858                 goto unlock;
5859         }
5860
5861         /* We need to flip the bit already here so that
5862          * hci_req_update_adv_data generates the correct flags.
5863          */
5864         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5865
5866         hci_req_init(&req, hdev);
5867
5868         __hci_req_write_fast_connectable(&req, false);
5869         __hci_req_update_scan(&req);
5870
5871         /* Since only the advertising data flags will change, there
5872          * is no need to update the scan response data.
5873          */
5874         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5875
5876         err = hci_req_run(&req, set_bredr_complete);
5877         if (err < 0)
5878                 mgmt_pending_remove(cmd);
5879
5880 unlock:
5881         hci_dev_unlock(hdev);
5882         return err;
5883 }
5884
5885 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5886 {
5887         struct mgmt_pending_cmd *cmd;
5888         struct mgmt_mode *cp;
5889
5890         bt_dev_dbg(hdev, "status %u", status);
5891
5892         hci_dev_lock(hdev);
5893
5894         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5895         if (!cmd)
5896                 goto unlock;
5897
5898         if (status) {
5899                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5900                                 mgmt_status(status));
5901                 goto remove;
5902         }
5903
5904         cp = cmd->param;
5905
5906         switch (cp->val) {
5907         case 0x00:
5908                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5909                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5910                 break;
5911         case 0x01:
5912                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5913                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5914                 break;
5915         case 0x02:
5916                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5917                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5918                 break;
5919         }
5920
5921         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5922         new_settings(hdev, cmd->sk);
5923
5924 remove:
5925         mgmt_pending_remove(cmd);
5926 unlock:
5927         hci_dev_unlock(hdev);
5928 }
5929
5930 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5931                            void *data, u16 len)
5932 {
5933         struct mgmt_mode *cp = data;
5934         struct mgmt_pending_cmd *cmd;
5935         struct hci_request req;
5936         u8 val;
5937         int err;
5938
5939         bt_dev_dbg(hdev, "sock %p", sk);
5940
5941         if (!lmp_sc_capable(hdev) &&
5942             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5943                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5944                                        MGMT_STATUS_NOT_SUPPORTED);
5945
5946         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5947             lmp_sc_capable(hdev) &&
5948             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5949                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5950                                        MGMT_STATUS_REJECTED);
5951
5952         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5953                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5954                                   MGMT_STATUS_INVALID_PARAMS);
5955
5956         hci_dev_lock(hdev);
5957
5958         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5959             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5960                 bool changed;
5961
5962                 if (cp->val) {
5963                         changed = !hci_dev_test_and_set_flag(hdev,
5964                                                              HCI_SC_ENABLED);
5965                         if (cp->val == 0x02)
5966                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5967                         else
5968                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5969                 } else {
5970                         changed = hci_dev_test_and_clear_flag(hdev,
5971                                                               HCI_SC_ENABLED);
5972                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5973                 }
5974
5975                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5976                 if (err < 0)
5977                         goto failed;
5978
5979                 if (changed)
5980                         err = new_settings(hdev, sk);
5981
5982                 goto failed;
5983         }
5984
5985         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5986                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5987                                       MGMT_STATUS_BUSY);
5988                 goto failed;
5989         }
5990
5991         val = !!cp->val;
5992
5993         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5994             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5995                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5996                 goto failed;
5997         }
5998
5999         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
6000         if (!cmd) {
6001                 err = -ENOMEM;
6002                 goto failed;
6003         }
6004
6005         hci_req_init(&req, hdev);
6006         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
6007         err = hci_req_run(&req, sc_enable_complete);
6008         if (err < 0) {
6009                 mgmt_pending_remove(cmd);
6010                 goto failed;
6011         }
6012
6013 failed:
6014         hci_dev_unlock(hdev);
6015         return err;
6016 }
6017
6018 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6019                           void *data, u16 len)
6020 {
6021         struct mgmt_mode *cp = data;
6022         bool changed, use_changed;
6023         int err;
6024
6025         bt_dev_dbg(hdev, "sock %p", sk);
6026
6027         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6028                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6029                                        MGMT_STATUS_INVALID_PARAMS);
6030
6031         hci_dev_lock(hdev);
6032
6033         if (cp->val)
6034                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6035         else
6036                 changed = hci_dev_test_and_clear_flag(hdev,
6037                                                       HCI_KEEP_DEBUG_KEYS);
6038
6039         if (cp->val == 0x02)
6040                 use_changed = !hci_dev_test_and_set_flag(hdev,
6041                                                          HCI_USE_DEBUG_KEYS);
6042         else
6043                 use_changed = hci_dev_test_and_clear_flag(hdev,
6044                                                           HCI_USE_DEBUG_KEYS);
6045
6046         if (hdev_is_powered(hdev) && use_changed &&
6047             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6048                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6049                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6050                              sizeof(mode), &mode);
6051         }
6052
6053         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6054         if (err < 0)
6055                 goto unlock;
6056
6057         if (changed)
6058                 err = new_settings(hdev, sk);
6059
6060 unlock:
6061         hci_dev_unlock(hdev);
6062         return err;
6063 }
6064
6065 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6066                        u16 len)
6067 {
6068         struct mgmt_cp_set_privacy *cp = cp_data;
6069         bool changed;
6070         int err;
6071
6072         bt_dev_dbg(hdev, "sock %p", sk);
6073
6074         if (!lmp_le_capable(hdev))
6075                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6076                                        MGMT_STATUS_NOT_SUPPORTED);
6077
6078         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6079                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6080                                        MGMT_STATUS_INVALID_PARAMS);
6081
6082         if (hdev_is_powered(hdev))
6083                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6084                                        MGMT_STATUS_REJECTED);
6085
6086         hci_dev_lock(hdev);
6087
6088         /* If user space supports this command it is also expected to
6089          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6090          */
6091         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6092
6093         if (cp->privacy) {
6094                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6095                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6096                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6097                 hci_adv_instances_set_rpa_expired(hdev, true);
6098                 if (cp->privacy == 0x02)
6099                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6100                 else
6101                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6102         } else {
6103                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6104                 memset(hdev->irk, 0, sizeof(hdev->irk));
6105                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6106                 hci_adv_instances_set_rpa_expired(hdev, false);
6107                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6108         }
6109
6110         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6111         if (err < 0)
6112                 goto unlock;
6113
6114         if (changed)
6115                 err = new_settings(hdev, sk);
6116
6117 unlock:
6118         hci_dev_unlock(hdev);
6119         return err;
6120 }
6121
6122 static bool irk_is_valid(struct mgmt_irk_info *irk)
6123 {
6124         switch (irk->addr.type) {
6125         case BDADDR_LE_PUBLIC:
6126                 return true;
6127
6128         case BDADDR_LE_RANDOM:
6129                 /* Two most significant bits shall be set */
6130                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6131                         return false;
6132                 return true;
6133         }
6134
6135         return false;
6136 }
6137
6138 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6139                      u16 len)
6140 {
6141         struct mgmt_cp_load_irks *cp = cp_data;
6142         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6143                                    sizeof(struct mgmt_irk_info));
6144         u16 irk_count, expected_len;
6145         int i, err;
6146
6147         bt_dev_dbg(hdev, "sock %p", sk);
6148
6149         if (!lmp_le_capable(hdev))
6150                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6151                                        MGMT_STATUS_NOT_SUPPORTED);
6152
6153         irk_count = __le16_to_cpu(cp->irk_count);
6154         if (irk_count > max_irk_count) {
6155                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6156                            irk_count);
6157                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6158                                        MGMT_STATUS_INVALID_PARAMS);
6159         }
6160
6161         expected_len = struct_size(cp, irks, irk_count);
6162         if (expected_len != len) {
6163                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6164                            expected_len, len);
6165                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6166                                        MGMT_STATUS_INVALID_PARAMS);
6167         }
6168
6169         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6170
6171         for (i = 0; i < irk_count; i++) {
6172                 struct mgmt_irk_info *key = &cp->irks[i];
6173
6174                 if (!irk_is_valid(key))
6175                         return mgmt_cmd_status(sk, hdev->id,
6176                                                MGMT_OP_LOAD_IRKS,
6177                                                MGMT_STATUS_INVALID_PARAMS);
6178         }
6179
6180         hci_dev_lock(hdev);
6181
6182         hci_smp_irks_clear(hdev);
6183
6184         for (i = 0; i < irk_count; i++) {
6185                 struct mgmt_irk_info *irk = &cp->irks[i];
6186
6187                 if (hci_is_blocked_key(hdev,
6188                                        HCI_BLOCKED_KEY_TYPE_IRK,
6189                                        irk->val)) {
6190                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6191                                     &irk->addr.bdaddr);
6192                         continue;
6193                 }
6194
6195                 hci_add_irk(hdev, &irk->addr.bdaddr,
6196                             le_addr_type(irk->addr.type), irk->val,
6197                             BDADDR_ANY);
6198         }
6199
6200         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6201
6202         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6203
6204         hci_dev_unlock(hdev);
6205
6206         return err;
6207 }
6208
6209 #ifdef TIZEN_BT
6210 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
6211                         void *data, u16 len)
6212 {
6213         struct mgmt_cp_set_advertising_params *cp = data;
6214         __u16 min_interval;
6215         __u16 max_interval;
6216         int err;
6217
6218         BT_DBG("%s", hdev->name);
6219
6220         if (!lmp_le_capable(hdev))
6221                 return mgmt_cmd_status(sk, hdev->id,
6222                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6223                                 MGMT_STATUS_NOT_SUPPORTED);
6224
6225         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6226                 return mgmt_cmd_status(sk, hdev->id,
6227                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6228                                 MGMT_STATUS_BUSY);
6229
6230         min_interval = __le16_to_cpu(cp->interval_min);
6231         max_interval = __le16_to_cpu(cp->interval_max);
6232
6233         if (min_interval > max_interval ||
6234             min_interval < 0x0020 || max_interval > 0x4000)
6235                 return mgmt_cmd_status(sk, hdev->id,
6236                                 MGMT_OP_SET_ADVERTISING_PARAMS,
6237                                 MGMT_STATUS_INVALID_PARAMS);
6238
6239         hci_dev_lock(hdev);
6240
6241         hdev->le_adv_min_interval = min_interval;
6242         hdev->le_adv_max_interval = max_interval;
6243         hdev->adv_filter_policy = cp->filter_policy;
6244         hdev->adv_type = cp->type;
6245
6246         err = mgmt_cmd_complete(sk, hdev->id,
6247                         MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
6248
6249         hci_dev_unlock(hdev);
6250
6251         return err;
6252 }
6253
6254 static void set_advertising_data_complete(struct hci_dev *hdev,
6255                         u8 status, u16 opcode)
6256 {
6257         struct mgmt_cp_set_advertising_data *cp;
6258         struct mgmt_pending_cmd *cmd;
6259
6260         BT_DBG("status 0x%02x", status);
6261
6262         hci_dev_lock(hdev);
6263
6264         cmd = pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
6265         if (!cmd)
6266                 goto unlock;
6267
6268         cp = cmd->param;
6269
6270         if (status)
6271                 mgmt_cmd_status(cmd->sk, hdev->id,
6272                                 MGMT_OP_SET_ADVERTISING_DATA,
6273                                 mgmt_status(status));
6274         else
6275                 mgmt_cmd_complete(cmd->sk, hdev->id,
6276                                 MGMT_OP_SET_ADVERTISING_DATA, 0,
6277                                 cp, sizeof(*cp));
6278
6279         mgmt_pending_remove(cmd);
6280
6281 unlock:
6282         hci_dev_unlock(hdev);
6283 }
6284
6285 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
6286                         void *data, u16 len)
6287 {
6288         struct mgmt_pending_cmd *cmd;
6289         struct hci_request req;
6290         struct mgmt_cp_set_advertising_data *cp = data;
6291         struct hci_cp_le_set_adv_data adv;
6292         int err;
6293
6294         BT_DBG("%s", hdev->name);
6295
6296         if (!lmp_le_capable(hdev)) {
6297                 return mgmt_cmd_status(sk, hdev->id,
6298                                 MGMT_OP_SET_ADVERTISING_DATA,
6299                                 MGMT_STATUS_NOT_SUPPORTED);
6300         }
6301
6302         hci_dev_lock(hdev);
6303
6304         if (pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
6305                 err = mgmt_cmd_status(sk, hdev->id,
6306                                 MGMT_OP_SET_ADVERTISING_DATA,
6307                                 MGMT_STATUS_BUSY);
6308                 goto unlocked;
6309         }
6310
6311         if (len > HCI_MAX_AD_LENGTH) {
6312                 err = mgmt_cmd_status(sk, hdev->id,
6313                                 MGMT_OP_SET_ADVERTISING_DATA,
6314                                 MGMT_STATUS_INVALID_PARAMS);
6315                 goto unlocked;
6316         }
6317
6318         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
6319                                hdev, data, len);
6320         if (!cmd) {
6321                 err = -ENOMEM;
6322                 goto unlocked;
6323         }
6324
6325         hci_req_init(&req, hdev);
6326
6327         memset(&adv, 0, sizeof(adv));
6328         memcpy(adv.data, cp->data, len);
6329         adv.length = len;
6330
6331         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
6332
6333         err = hci_req_run(&req, set_advertising_data_complete);
6334         if (err < 0)
6335                 mgmt_pending_remove(cmd);
6336
6337 unlocked:
6338         hci_dev_unlock(hdev);
6339
6340         return err;
6341 }
6342
6343 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status,
6344                         u16 opcode)
6345 {
6346         struct mgmt_cp_set_scan_rsp_data *cp;
6347         struct mgmt_pending_cmd *cmd;
6348
6349         BT_DBG("status 0x%02x", status);
6350
6351         hci_dev_lock(hdev);
6352
6353         cmd = pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
6354         if (!cmd)
6355                 goto unlock;
6356
6357         cp = cmd->param;
6358
6359         if (status)
6360                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6361                                 mgmt_status(status));
6362         else
6363                 mgmt_cmd_complete(cmd->sk, hdev->id,
6364                                 MGMT_OP_SET_SCAN_RSP_DATA, 0,
6365                                 cp, sizeof(*cp));
6366
6367         mgmt_pending_remove(cmd);
6368
6369 unlock:
6370         hci_dev_unlock(hdev);
6371 }
6372
6373 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
6374                         u16 len)
6375 {
6376         struct mgmt_pending_cmd *cmd;
6377         struct hci_request req;
6378         struct mgmt_cp_set_scan_rsp_data *cp = data;
6379         struct hci_cp_le_set_scan_rsp_data rsp;
6380         int err;
6381
6382         BT_DBG("%s", hdev->name);
6383
6384         if (!lmp_le_capable(hdev))
6385                 return mgmt_cmd_status(sk, hdev->id,
6386                                 MGMT_OP_SET_SCAN_RSP_DATA,
6387                                 MGMT_STATUS_NOT_SUPPORTED);
6388
6389         hci_dev_lock(hdev);
6390
6391         if (pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
6392                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6393                                 MGMT_STATUS_BUSY);
6394                 goto unlocked;
6395         }
6396
6397         if (len > HCI_MAX_AD_LENGTH) {
6398                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
6399                                 MGMT_STATUS_INVALID_PARAMS);
6400                 goto unlocked;
6401         }
6402
6403         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
6404         if (!cmd) {
6405                 err = -ENOMEM;
6406                 goto unlocked;
6407         }
6408
6409         hci_req_init(&req, hdev);
6410
6411         memset(&rsp, 0, sizeof(rsp));
6412         memcpy(rsp.data, cp->data, len);
6413         rsp.length = len;
6414
6415         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
6416
6417         err = hci_req_run(&req, set_scan_rsp_data_complete);
6418         if (err < 0)
6419                 mgmt_pending_remove(cmd);
6420
6421 unlocked:
6422         hci_dev_unlock(hdev);
6423
6424         return err;
6425 }
6426
6427 /* Adv White List feature */
6428 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6429 {
6430         struct mgmt_cp_add_dev_white_list *cp;
6431         struct mgmt_pending_cmd *cmd;
6432
6433         BT_DBG("status 0x%02x", status);
6434
6435         hci_dev_lock(hdev);
6436
6437         cmd = pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
6438         if (!cmd)
6439                 goto unlock;
6440
6441         cp = cmd->param;
6442
6443         if (status)
6444                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6445                            mgmt_status(status));
6446         else
6447                 mgmt_cmd_complete(cmd->sk, hdev->id,
6448                                 MGMT_OP_ADD_DEV_WHITE_LIST, 0, cp, sizeof(*cp));
6449
6450         mgmt_pending_remove(cmd);
6451
6452 unlock:
6453         hci_dev_unlock(hdev);
6454 }
6455
6456 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
6457                            void *data, u16 len)
6458 {
6459         struct mgmt_pending_cmd *cmd;
6460         struct mgmt_cp_add_dev_white_list *cp = data;
6461         struct hci_request req;
6462         int err;
6463
6464         BT_DBG("%s", hdev->name);
6465
6466         if (!lmp_le_capable(hdev))
6467                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6468                                   MGMT_STATUS_NOT_SUPPORTED);
6469
6470         if (!hdev_is_powered(hdev))
6471                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6472                                   MGMT_STATUS_REJECTED);
6473
6474         hci_dev_lock(hdev);
6475
6476         if (pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
6477                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
6478                                 MGMT_STATUS_BUSY);
6479                 goto unlocked;
6480         }
6481
6482         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
6483         if (!cmd) {
6484                 err = -ENOMEM;
6485                 goto unlocked;
6486         }
6487
6488         hci_req_init(&req, hdev);
6489
6490         hci_req_add(&req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(*cp), cp);
6491
6492         err = hci_req_run(&req, add_white_list_complete);
6493         if (err < 0) {
6494                 mgmt_pending_remove(cmd);
6495                 goto unlocked;
6496         }
6497
6498 unlocked:
6499         hci_dev_unlock(hdev);
6500
6501         return err;
6502 }
6503
6504 static void remove_from_white_list_complete(struct hci_dev *hdev,
6505                         u8 status, u16 opcode)
6506 {
6507         struct mgmt_cp_remove_dev_from_white_list *cp;
6508         struct mgmt_pending_cmd *cmd;
6509
6510         BT_DBG("status 0x%02x", status);
6511
6512         hci_dev_lock(hdev);
6513
6514         cmd = pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
6515         if (!cmd)
6516                 goto unlock;
6517
6518         cp = cmd->param;
6519
6520         if (status)
6521                 mgmt_cmd_status(cmd->sk, hdev->id,
6522                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6523                         mgmt_status(status));
6524         else
6525                 mgmt_cmd_complete(cmd->sk, hdev->id,
6526                         MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
6527                         cp, sizeof(*cp));
6528
6529         mgmt_pending_remove(cmd);
6530
6531 unlock:
6532         hci_dev_unlock(hdev);
6533 }
6534
6535 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
6536                            void *data, u16 len)
6537 {
6538         struct mgmt_pending_cmd *cmd;
6539         struct mgmt_cp_remove_dev_from_white_list *cp = data;
6540         struct hci_request req;
6541         int err;
6542
6543         BT_DBG("%s", hdev->name);
6544
6545         if (!lmp_le_capable(hdev))
6546                 return mgmt_cmd_status(sk, hdev->id,
6547                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6548                                 MGMT_STATUS_NOT_SUPPORTED);
6549
6550         if (!hdev_is_powered(hdev))
6551                 return mgmt_cmd_status(sk, hdev->id,
6552                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6553                                 MGMT_STATUS_REJECTED);
6554
6555         hci_dev_lock(hdev);
6556
6557         if (pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
6558                 err = mgmt_cmd_status(sk, hdev->id,
6559                                 MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6560                                 MGMT_STATUS_BUSY);
6561                 goto unlocked;
6562         }
6563
6564         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
6565                                 hdev, data, len);
6566         if (!cmd) {
6567                 err = -ENOMEM;
6568                 goto unlocked;
6569         }
6570
6571         hci_req_init(&req, hdev);
6572
6573         hci_req_add(&req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(*cp), cp);
6574
6575         err = hci_req_run(&req, remove_from_white_list_complete);
6576         if (err < 0) {
6577                 mgmt_pending_remove(cmd);
6578                 goto unlocked;
6579         }
6580
6581 unlocked:
6582         hci_dev_unlock(hdev);
6583
6584         return err;
6585 }
6586
6587 static void clear_white_list_complete(struct hci_dev *hdev, u8 status,
6588                         u16 opcode)
6589 {
6590         struct mgmt_pending_cmd *cmd;
6591
6592         BT_DBG("status 0x%02x", status);
6593
6594         hci_dev_lock(hdev);
6595
6596         cmd = pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
6597         if (!cmd)
6598                 goto unlock;
6599
6600         if (status)
6601                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6602                            mgmt_status(status));
6603         else
6604                 mgmt_cmd_complete(cmd->sk, hdev->id,
6605                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6606                                 0, NULL, 0);
6607
6608         mgmt_pending_remove(cmd);
6609
6610 unlock:
6611         hci_dev_unlock(hdev);
6612 }
6613
6614 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
6615                            void *data, u16 len)
6616 {
6617         struct mgmt_pending_cmd *cmd;
6618         struct hci_request req;
6619         int err;
6620
6621         BT_DBG("%s", hdev->name);
6622
6623         if (!lmp_le_capable(hdev))
6624                 return mgmt_cmd_status(sk, hdev->id,
6625                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6626                                 MGMT_STATUS_NOT_SUPPORTED);
6627
6628         if (!hdev_is_powered(hdev))
6629                 return mgmt_cmd_status(sk, hdev->id,
6630                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6631                                 MGMT_STATUS_REJECTED);
6632
6633         hci_dev_lock(hdev);
6634
6635         if (pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
6636                 err = mgmt_cmd_status(sk, hdev->id,
6637                                 MGMT_OP_CLEAR_DEV_WHITE_LIST,
6638                                 MGMT_STATUS_BUSY);
6639                 goto unlocked;
6640         }
6641
6642         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST,
6643                                 hdev, NULL, 0);
6644         if (!cmd) {
6645                 err = -ENOMEM;
6646                 goto unlocked;
6647         }
6648
6649         hci_req_init(&req, hdev);
6650
6651         hci_req_add(&req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
6652
6653         err = hci_req_run(&req, clear_white_list_complete);
6654         if (err < 0) {
6655                 mgmt_pending_remove(cmd);
6656                 goto unlocked;
6657         }
6658
6659 unlocked:
6660         hci_dev_unlock(hdev);
6661
6662         return err;
6663 }
6664
6665 static void set_rssi_threshold_complete(struct hci_dev *hdev,
6666                         u8 status, u16 opcode)
6667 {
6668         struct mgmt_pending_cmd *cmd;
6669
6670         BT_DBG("status 0x%02x", status);
6671
6672         hci_dev_lock(hdev);
6673
6674         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6675         if (!cmd)
6676                 goto unlock;
6677
6678         if (status)
6679                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6680                                 mgmt_status(status));
6681         else
6682                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6683                                 NULL, 0);
6684
6685         mgmt_pending_remove(cmd);
6686
6687 unlock:
6688         hci_dev_unlock(hdev);
6689 }
6690
6691 static void set_rssi_disable_complete(struct hci_dev *hdev,
6692                         u8 status, u16 opcode)
6693 {
6694         struct mgmt_pending_cmd *cmd;
6695
6696         BT_DBG("status 0x%02x", status);
6697
6698         hci_dev_lock(hdev);
6699
6700         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6701         if (!cmd)
6702                 goto unlock;
6703
6704         if (status)
6705                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6706                                 mgmt_status(status));
6707         else
6708                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6709                                 0, NULL, 0);
6710
6711         mgmt_pending_remove(cmd);
6712
6713 unlock:
6714         hci_dev_unlock(hdev);
6715 }
6716
6717 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6718                 void *data, u16 len)
6719 {
6720         int err = 0;
6721         struct hci_cp_set_rssi_threshold th = { 0, };
6722         struct mgmt_cp_set_enable_rssi *cp = data;
6723         struct hci_conn *conn;
6724         struct mgmt_pending_cmd *cmd;
6725         struct hci_request req;
6726         __u8 dest_type;
6727
6728         hci_dev_lock(hdev);
6729
6730         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6731         if (!cmd) {
6732                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6733                                 MGMT_STATUS_FAILED);
6734                 goto unlocked;
6735         }
6736
6737         if (!lmp_le_capable(hdev)) {
6738                 mgmt_pending_remove(cmd);
6739                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6740                                 MGMT_STATUS_NOT_SUPPORTED);
6741                 goto unlocked;
6742         }
6743
6744         if (!hdev_is_powered(hdev)) {
6745                 BT_DBG("%s", hdev->name);
6746                 mgmt_pending_remove(cmd);
6747                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6748                                 MGMT_STATUS_NOT_POWERED);
6749                 goto unlocked;
6750         }
6751
6752         if (cp->link_type == 0x01)
6753                 dest_type = LE_LINK;
6754         else
6755                 dest_type = ACL_LINK;
6756
6757         /* Get LE/ACL link handle info */
6758         conn = hci_conn_hash_lookup_ba(hdev,
6759                         dest_type, &cp->bdaddr);
6760
6761         if (!conn) {
6762                 err = mgmt_cmd_complete(sk, hdev->id,
6763                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6764                 mgmt_pending_remove(cmd);
6765                 goto unlocked;
6766         }
6767
6768         hci_req_init(&req, hdev);
6769
6770         th.hci_le_ext_opcode = 0x0B;
6771         th.mode = 0x01;
6772         th.conn_handle = conn->handle;
6773         th.alert_mask = 0x07;
6774         th.low_th = cp->low_th;
6775         th.in_range_th = cp->in_range_th;
6776         th.high_th = cp->high_th;
6777
6778         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6779         err = hci_req_run(&req, set_rssi_threshold_complete);
6780
6781         if (err < 0) {
6782                 mgmt_pending_remove(cmd);
6783                 BT_ERR("Error in requesting hci_req_run");
6784                 goto unlocked;
6785         }
6786
6787 unlocked:
6788         hci_dev_unlock(hdev);
6789         return err;
6790 }
6791
6792 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6793                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6794 {
6795         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6796         struct mgmt_cp_set_enable_rssi *cp = data;
6797         struct mgmt_pending_cmd *cmd;
6798
6799         if (!cp || !rp)
6800                 goto remove_cmd;
6801
6802         mgmt_rp.status = rp->status;
6803         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6804         mgmt_rp.bt_address = cp->bdaddr;
6805         mgmt_rp.link_type = cp->link_type;
6806
6807         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6808                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6809                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6810
6811         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6812                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6813
6814         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6815         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6816                         &mgmt_rp.bt_address, true);
6817
6818 remove_cmd:
6819         hci_dev_lock(hdev);
6820         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6821         if (cmd)
6822                 mgmt_pending_remove(cmd);
6823
6824         hci_dev_unlock(hdev);
6825 }
6826
6827 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6828                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6829 {
6830         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6831         struct mgmt_cp_disable_rssi *cp = data;
6832         struct mgmt_pending_cmd *cmd;
6833
6834         if (!cp || !rp)
6835                 goto remove_cmd;
6836
6837         mgmt_rp.status = rp->status;
6838         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6839         mgmt_rp.bt_address = cp->bdaddr;
6840         mgmt_rp.link_type = cp->link_type;
6841
6842         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6843                         MGMT_STATUS_SUCCESS, &mgmt_rp,
6844                         sizeof(struct mgmt_cc_rsp_enable_rssi));
6845
6846         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6847                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6848
6849         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6850                         &mgmt_rp.bt_address, false);
6851
6852 remove_cmd:
6853         hci_dev_lock(hdev);
6854         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6855         if (cmd)
6856                 mgmt_pending_remove(cmd);
6857
6858         hci_dev_unlock(hdev);
6859 }
6860
6861 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6862                 void *data, u16 len)
6863 {
6864         struct mgmt_pending_cmd *cmd;
6865         struct hci_request req;
6866         struct hci_cp_set_enable_rssi cp_en = { 0, };
6867         int err;
6868
6869         BT_DBG("Set Disable RSSI.");
6870
6871         cp_en.hci_le_ext_opcode = 0x01;
6872         cp_en.le_enable_cs_Features = 0x00;
6873         cp_en.data[0] = 0x00;
6874         cp_en.data[1] = 0x00;
6875         cp_en.data[2] = 0x00;
6876
6877         hci_dev_lock(hdev);
6878
6879         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6880         if (!cmd) {
6881                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6882                                 MGMT_STATUS_FAILED);
6883                 goto unlocked;
6884         }
6885
6886         if (!lmp_le_capable(hdev)) {
6887                 mgmt_pending_remove(cmd);
6888                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6889                                 MGMT_STATUS_NOT_SUPPORTED);
6890                 goto unlocked;
6891         }
6892
6893         if (!hdev_is_powered(hdev)) {
6894                 BT_DBG("%s", hdev->name);
6895                 mgmt_pending_remove(cmd);
6896                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6897                                 MGMT_STATUS_NOT_POWERED);
6898                 goto unlocked;
6899         }
6900
6901         hci_req_init(&req, hdev);
6902
6903         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6904                         sizeof(struct hci_cp_set_enable_rssi),
6905                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6906                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6907
6908         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6909         err = hci_req_run(&req, set_rssi_disable_complete);
6910
6911         if (err < 0) {
6912                 mgmt_pending_remove(cmd);
6913                 BT_ERR("Error in requesting hci_req_run");
6914                 goto unlocked;
6915         }
6916
6917 unlocked:
6918         hci_dev_unlock(hdev);
6919         return err;
6920 }
6921
6922 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6923 {
6924         struct hci_cc_rsp_enable_rssi *rp = response;
6925         struct mgmt_pending_cmd *cmd_enable = NULL;
6926         struct mgmt_pending_cmd *cmd_disable = NULL;
6927         struct mgmt_cp_set_enable_rssi *cp_en;
6928         struct mgmt_cp_disable_rssi *cp_dis;
6929
6930         hci_dev_lock(hdev);
6931         cmd_enable = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6932         cmd_disable = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6933         hci_dev_unlock(hdev);
6934
6935         if (cmd_enable)
6936                 BT_DBG("Enable Request");
6937
6938         if (cmd_disable)
6939                 BT_DBG("Disable Request");
6940
6941         if (cmd_enable) {
6942                 cp_en = cmd_enable->param;
6943
6944                 if (status != 0x00)
6945                         return;
6946
6947                 switch (rp->le_ext_opcode) {
6948                 case 0x01:
6949                         BT_DBG("RSSI enabled.. Setting Threshold...");
6950                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6951                                         cp_en, sizeof(*cp_en));
6952                         break;
6953
6954                 case 0x0B:
6955                         BT_DBG("Sending RSSI enable success");
6956                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6957                                         cp_en, rp, rp->status);
6958                         break;
6959                 }
6960
6961         } else if (cmd_disable) {
6962                 cp_dis = cmd_disable->param;
6963
6964                 if (status != 0x00)
6965                         return;
6966
6967                 switch (rp->le_ext_opcode) {
6968                 case 0x01:
6969                         BT_DBG("Sending RSSI disable success");
6970                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6971                                         cp_dis, rp, rp->status);
6972                         break;
6973
6974                 case 0x0B:
6975                         /*
6976                          * Only unset RSSI Threshold values for the Link if
6977                          * RSSI is monitored for other BREDR or LE Links
6978                          */
6979                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6980                                 BT_DBG("Unset Threshold. Other links being monitored");
6981                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6982                                                 cp_dis, rp, rp->status);
6983                         } else {
6984                                 BT_DBG("Unset Threshold. Disabling...");
6985                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6986                                                 cp_dis, sizeof(*cp_dis));
6987                         }
6988                         break;
6989                 }
6990         }
6991 }
6992
6993 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status,
6994                 u16 opcode)
6995 {
6996         struct mgmt_pending_cmd *cmd;
6997
6998         BT_DBG("status 0x%02x", status);
6999
7000         hci_dev_lock(hdev);
7001
7002         cmd = pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
7003         if (!cmd)
7004                 goto unlock;
7005
7006         if (status)
7007                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7008                                 mgmt_status(status));
7009         else
7010                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
7011                                 NULL, 0);
7012
7013         mgmt_pending_remove(cmd);
7014
7015 unlock:
7016         hci_dev_unlock(hdev);
7017 }
7018
7019 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
7020                 void *data, u16 len)
7021 {
7022         struct mgmt_pending_cmd *cmd;
7023         struct hci_request req;
7024         struct mgmt_cp_set_enable_rssi *cp = data;
7025         struct hci_cp_set_enable_rssi cp_en = { 0, };
7026         int err;
7027
7028         BT_DBG("Set Enable RSSI.");
7029
7030         cp_en.hci_le_ext_opcode = 0x01;
7031         cp_en.le_enable_cs_Features = 0x04;
7032         cp_en.data[0] = 0x00;
7033         cp_en.data[1] = 0x00;
7034         cp_en.data[2] = 0x00;
7035
7036         hci_dev_lock(hdev);
7037
7038         if (!lmp_le_capable(hdev)) {
7039                 err =  mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7040                                 MGMT_STATUS_NOT_SUPPORTED);
7041                 goto unlocked;
7042         }
7043
7044         if (!hdev_is_powered(hdev)) {
7045                 BT_DBG("%s", hdev->name);
7046                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7047                                 MGMT_STATUS_NOT_POWERED);
7048                 goto unlocked;
7049         }
7050
7051         if (pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
7052                 BT_DBG("%s", hdev->name);
7053                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
7054                                 MGMT_STATUS_BUSY);
7055                 goto unlocked;
7056         }
7057
7058         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp,
7059                         sizeof(*cp));
7060         if (!cmd) {
7061                 BT_DBG("%s", hdev->name);
7062                 err = -ENOMEM;
7063                 goto unlocked;
7064         }
7065
7066         /* If RSSI is already enabled directly set Threshold values */
7067         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
7068                 hci_dev_unlock(hdev);
7069                 BT_DBG("RSSI Enabled. Directly set Threshold");
7070                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
7071                 return err;
7072         }
7073
7074         hci_req_init(&req, hdev);
7075
7076         BT_DBG("Enable Len: %zu [%2.2X %2.2X %2.2X %2.2X %2.2X]",
7077                         sizeof(struct hci_cp_set_enable_rssi),
7078                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
7079                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
7080
7081         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
7082         err = hci_req_run(&req, set_rssi_enable_complete);
7083
7084         if (err < 0) {
7085                 mgmt_pending_remove(cmd);
7086                 BT_ERR("Error in requesting hci_req_run");
7087                 goto unlocked;
7088         }
7089
7090 unlocked:
7091         hci_dev_unlock(hdev);
7092
7093         return err;
7094 }
7095
7096 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7097 {
7098         struct mgmt_pending_cmd *cmd;
7099
7100         BT_DBG("status 0x%02x", status);
7101
7102         hci_dev_lock(hdev);
7103
7104         cmd = pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
7105         if (!cmd)
7106                 goto unlock;
7107
7108         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7109                         MGMT_STATUS_SUCCESS, &status, 1);
7110
7111         mgmt_pending_remove(cmd);
7112
7113 unlock:
7114         hci_dev_unlock(hdev);
7115 }
7116
7117 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
7118                         u16 len)
7119 {
7120         struct mgmt_pending_cmd *cmd;
7121         struct hci_request req;
7122         struct mgmt_cp_get_raw_rssi *cp = data;
7123         struct hci_cp_get_raw_rssi hci_cp;
7124
7125         struct hci_conn *conn;
7126         int err;
7127         __u8 dest_type;
7128
7129         BT_DBG("Get Raw RSSI.");
7130
7131         hci_dev_lock(hdev);
7132
7133         if (!lmp_le_capable(hdev)) {
7134                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7135                                 MGMT_STATUS_NOT_SUPPORTED);
7136                 goto unlocked;
7137         }
7138
7139         if (cp->link_type == 0x01)
7140                 dest_type = LE_LINK;
7141         else
7142                 dest_type = ACL_LINK;
7143
7144         /* Get LE/BREDR link handle info */
7145         conn = hci_conn_hash_lookup_ba(hdev,
7146                         dest_type, &cp->bt_address);
7147         if (!conn) {
7148                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7149                                                    MGMT_STATUS_NOT_CONNECTED);
7150                 goto unlocked;
7151         }
7152         hci_cp.conn_handle = conn->handle;
7153
7154         if (!hdev_is_powered(hdev)) {
7155                 BT_DBG("%s", hdev->name);
7156                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7157                                 MGMT_STATUS_NOT_POWERED);
7158                 goto unlocked;
7159         }
7160
7161         if (pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
7162                 BT_DBG("%s", hdev->name);
7163                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
7164                                 MGMT_STATUS_BUSY);
7165                 goto unlocked;
7166         }
7167
7168         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
7169         if (!cmd) {
7170                 BT_DBG("%s", hdev->name);
7171                 err = -ENOMEM;
7172                 goto unlocked;
7173         }
7174
7175         hci_req_init(&req, hdev);
7176
7177         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
7178         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
7179         err = hci_req_run(&req, get_raw_rssi_complete);
7180
7181         if (err < 0) {
7182                 mgmt_pending_remove(cmd);
7183                 BT_ERR("Error in requesting hci_req_run");
7184         }
7185
7186 unlocked:
7187         hci_dev_unlock(hdev);
7188
7189         return err;
7190 }
7191
7192 void mgmt_raw_rssi_response(struct hci_dev *hdev,
7193                 struct hci_cc_rp_get_raw_rssi *rp, int success)
7194 {
7195         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
7196         struct hci_conn *conn;
7197
7198         mgmt_rp.status = rp->status;
7199         mgmt_rp.rssi_dbm = rp->rssi_dbm;
7200
7201         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
7202         if (!conn)
7203                 return;
7204
7205         bacpy(&mgmt_rp.bt_address, &conn->dst);
7206         if (conn->type == LE_LINK)
7207                 mgmt_rp.link_type = 0x01;
7208         else
7209                 mgmt_rp.link_type = 0x00;
7210
7211         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
7212                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
7213 }
7214
7215 static void set_disable_threshold_complete(struct hci_dev *hdev,
7216                         u8 status, u16 opcode)
7217 {
7218         struct mgmt_pending_cmd *cmd;
7219
7220         BT_DBG("status 0x%02x", status);
7221
7222         hci_dev_lock(hdev);
7223
7224         cmd = pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
7225         if (!cmd)
7226                 goto unlock;
7227
7228         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7229                         MGMT_STATUS_SUCCESS, &status, 1);
7230
7231         mgmt_pending_remove(cmd);
7232
7233 unlock:
7234         hci_dev_unlock(hdev);
7235 }
7236
7237 /** Removes monitoring for a link*/
7238 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
7239                 void *data, u16 len)
7240 {
7241         int err = 0;
7242         struct hci_cp_set_rssi_threshold th = { 0, };
7243         struct mgmt_cp_disable_rssi *cp = data;
7244         struct hci_conn *conn;
7245         struct mgmt_pending_cmd *cmd;
7246         struct hci_request req;
7247         __u8 dest_type;
7248
7249         BT_DBG("Set Disable RSSI.");
7250
7251         hci_dev_lock(hdev);
7252
7253         if (!lmp_le_capable(hdev)) {
7254                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7255                                 MGMT_STATUS_NOT_SUPPORTED);
7256                 goto unlocked;
7257         }
7258
7259         /* Get LE/ACL link handle info*/
7260         if (cp->link_type == 0x01)
7261                 dest_type = LE_LINK;
7262         else
7263                 dest_type = ACL_LINK;
7264
7265         conn = hci_conn_hash_lookup_ba(hdev, dest_type, &cp->bdaddr);
7266         if (!conn) {
7267                 err = mgmt_cmd_complete(sk, hdev->id,
7268                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
7269                 goto unlocked;
7270         }
7271
7272         th.hci_le_ext_opcode = 0x0B;
7273         th.mode = 0x01;
7274         th.conn_handle = conn->handle;
7275         th.alert_mask = 0x00;
7276         th.low_th = 0x00;
7277         th.in_range_th = 0x00;
7278         th.high_th = 0x00;
7279
7280         if (!hdev_is_powered(hdev)) {
7281                 BT_DBG("%s", hdev->name);
7282                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7283                                 0, data, len);
7284                 goto unlocked;
7285         }
7286
7287         if (pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
7288                 BT_DBG("%s", hdev->name);
7289                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
7290                                 MGMT_STATUS_BUSY);
7291                 goto unlocked;
7292         }
7293
7294         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp,
7295                         sizeof(*cp));
7296         if (!cmd) {
7297                 BT_DBG("%s", hdev->name);
7298                 err = -ENOMEM;
7299                 goto unlocked;
7300         }
7301
7302         hci_req_init(&req, hdev);
7303
7304         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
7305         err = hci_req_run(&req, set_disable_threshold_complete);
7306         if (err < 0) {
7307                 mgmt_pending_remove(cmd);
7308                 BT_ERR("Error in requesting hci_req_run");
7309                 goto unlocked;
7310         }
7311
7312 unlocked:
7313         hci_dev_unlock(hdev);
7314
7315         return err;
7316 }
7317
7318 void mgmt_rssi_alert_evt(struct hci_dev *hdev, struct sk_buff *skb)
7319 {
7320         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
7321         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
7322         struct hci_conn *conn;
7323
7324         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
7325                         ev->conn_handle, ev->alert_type, ev->rssi_dbm);
7326
7327         conn = hci_conn_hash_lookup_handle(hdev, ev->conn_handle);
7328
7329         if (!conn) {
7330                 BT_ERR("RSSI alert Error: Device not found for handle");
7331                 return;
7332         }
7333         bacpy(&mgmt_ev.bdaddr, &conn->dst);
7334
7335         if (conn->type == LE_LINK)
7336                 mgmt_ev.link_type = 0x01;
7337         else
7338                 mgmt_ev.link_type = 0x00;
7339
7340         mgmt_ev.alert_type = ev->alert_type;
7341         mgmt_ev.rssi_dbm = ev->rssi_dbm;
7342
7343         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
7344                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert),
7345                         NULL);
7346 }
7347
7348 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
7349 {
7350         struct mgmt_pending_cmd *cmd;
7351         u8 type;
7352         int err;
7353
7354         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7355
7356         cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7357         if (!cmd)
7358                 return -ENOENT;
7359
7360         type = hdev->le_discovery.type;
7361
7362         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7363                                 mgmt_status(status), &type, sizeof(type));
7364         mgmt_pending_remove(cmd);
7365
7366         return err;
7367 }
7368
7369 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status,
7370                 u16 opcode)
7371 {
7372         unsigned long timeout = 0;
7373
7374         BT_DBG("status %d", status);
7375
7376         if (status) {
7377                 hci_dev_lock(hdev);
7378                 mgmt_start_le_discovery_failed(hdev, status);
7379                 hci_dev_unlock(hdev);
7380                 return;
7381         }
7382
7383         hci_dev_lock(hdev);
7384         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
7385         hci_dev_unlock(hdev);
7386
7387         if (hdev->le_discovery.type != DISCOV_TYPE_LE)
7388                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
7389
7390         if (!timeout)
7391                 return;
7392
7393         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
7394 }
7395
7396 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
7397                 void *data, u16 len)
7398 {
7399         struct mgmt_cp_start_le_discovery *cp = data;
7400         struct mgmt_pending_cmd *cmd;
7401         struct hci_cp_le_set_scan_param param_cp;
7402         struct hci_cp_le_set_scan_enable enable_cp;
7403         struct hci_request req;
7404         u8 status, own_addr_type;
7405         int err;
7406
7407         BT_DBG("%s", hdev->name);
7408
7409         hci_dev_lock(hdev);
7410
7411         if (!hdev_is_powered(hdev)) {
7412                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7413                                 MGMT_STATUS_NOT_POWERED);
7414                 goto unlock;
7415         }
7416
7417         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
7418                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7419                                 MGMT_STATUS_BUSY);
7420                 goto unlock;
7421         }
7422
7423         if (cp->type != DISCOV_TYPE_LE) {
7424                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7425                                 MGMT_STATUS_INVALID_PARAMS);
7426                 goto unlock;
7427         }
7428
7429         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
7430         if (!cmd) {
7431                 err = -ENOMEM;
7432                 goto unlock;
7433         }
7434
7435         hdev->le_discovery.type = cp->type;
7436
7437         hci_req_init(&req, hdev);
7438
7439         status = mgmt_le_support(hdev);
7440         if (status) {
7441                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7442                                 status);
7443                 mgmt_pending_remove(cmd);
7444                 goto unlock;
7445         }
7446
7447         /* If controller is scanning, it means the background scanning
7448          * is running. Thus, we should temporarily stop it in order to
7449          * set the discovery scanning parameters.
7450          */
7451         if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
7452                 hci_req_add_le_scan_disable(&req, false);
7453
7454         memset(&param_cp, 0, sizeof(param_cp));
7455
7456         /* All active scans will be done with either a resolvable
7457          * private address (when privacy feature has been enabled)
7458          * or unresolvable private address.
7459          */
7460         err = hci_update_random_address(&req, true, hci_dev_test_flag(hdev, HCI_PRIVACY), &own_addr_type);
7461         if (err < 0) {
7462                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
7463                                 MGMT_STATUS_FAILED);
7464                 mgmt_pending_remove(cmd);
7465                 goto unlock;
7466         }
7467
7468         param_cp.type = hdev->le_scan_type;
7469         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
7470         param_cp.window = cpu_to_le16(hdev->le_scan_window);
7471         param_cp.own_address_type = own_addr_type;
7472         hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
7473                     &param_cp);
7474
7475         memset(&enable_cp, 0, sizeof(enable_cp));
7476         enable_cp.enable = LE_SCAN_ENABLE;
7477         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
7478
7479         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
7480                     &enable_cp);
7481
7482         err = hci_req_run(&req, start_le_discovery_complete);
7483         if (err < 0)
7484                 mgmt_pending_remove(cmd);
7485         else
7486                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
7487
7488 unlock:
7489         hci_dev_unlock(hdev);
7490         return err;
7491 }
7492
7493 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
7494 {
7495         struct mgmt_pending_cmd *cmd;
7496         int err;
7497
7498         cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7499         if (!cmd)
7500                 return -ENOENT;
7501
7502         err = mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode,
7503                                 mgmt_status(status), &hdev->le_discovery.type,
7504                                 sizeof(hdev->le_discovery.type));
7505         mgmt_pending_remove(cmd);
7506
7507         return err;
7508 }
7509
7510 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status,
7511                 u16 opcode)
7512 {
7513         BT_DBG("status %d", status);
7514
7515         hci_dev_lock(hdev);
7516
7517         if (status) {
7518                 mgmt_stop_le_discovery_failed(hdev, status);
7519                 goto unlock;
7520         }
7521
7522         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
7523
7524 unlock:
7525         hci_dev_unlock(hdev);
7526 }
7527
7528 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev,
7529                 void *data, u16 len)
7530 {
7531         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
7532         struct mgmt_pending_cmd *cmd;
7533         struct hci_request req;
7534         int err;
7535
7536         BT_DBG("%s", hdev->name);
7537
7538         hci_dev_lock(hdev);
7539
7540         if (!hci_le_discovery_active(hdev)) {
7541                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7542                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
7543                                         sizeof(mgmt_cp->type));
7544                 goto unlock;
7545         }
7546
7547         if (hdev->le_discovery.type != mgmt_cp->type) {
7548                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7549                                         MGMT_STATUS_INVALID_PARAMS,
7550                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
7551                 goto unlock;
7552         }
7553
7554         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
7555         if (!cmd) {
7556                 err = -ENOMEM;
7557                 goto unlock;
7558         }
7559
7560         hci_req_init(&req, hdev);
7561
7562         if (hdev->le_discovery.state  != DISCOVERY_FINDING) {
7563                 BT_DBG("unknown le discovery state %u",
7564                                         hdev->le_discovery.state);
7565
7566                 mgmt_pending_remove(cmd);
7567                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
7568                                         MGMT_STATUS_FAILED, &mgmt_cp->type,
7569                                         sizeof(mgmt_cp->type));
7570                 goto unlock;
7571         }
7572
7573         cancel_delayed_work(&hdev->le_scan_disable);
7574         hci_req_add_le_scan_disable(&req, false);
7575
7576         err = hci_req_run(&req, stop_le_discovery_complete);
7577         if (err < 0)
7578                 mgmt_pending_remove(cmd);
7579         else
7580                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
7581
7582 unlock:
7583         hci_dev_unlock(hdev);
7584         return err;
7585 }
7586
7587 /* Separate LE discovery */
7588 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
7589 {
7590         struct mgmt_ev_discovering ev;
7591         struct mgmt_pending_cmd *cmd;
7592
7593         BT_DBG("%s le discovering %u", hdev->name, discovering);
7594
7595         if (discovering)
7596                 cmd = pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
7597         else
7598                 cmd = pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
7599
7600         if (cmd) {
7601                 u8 type = hdev->le_discovery.type;
7602
7603                 mgmt_cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
7604                                   sizeof(type));
7605                 mgmt_pending_remove(cmd);
7606         }
7607
7608         memset(&ev, 0, sizeof(ev));
7609         ev.type = hdev->le_discovery.type;
7610         ev.discovering = discovering;
7611
7612         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7613 }
7614
7615 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
7616                         void *data, u16 len)
7617 {
7618         int err;
7619
7620         BT_DBG("%s", hdev->name);
7621
7622         hci_dev_lock(hdev);
7623
7624         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
7625         if (err < 0)
7626                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
7627
7628         hci_dev_unlock(hdev);
7629
7630         return err;
7631 }
7632
7633 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
7634                 u16 to_multiplier)
7635 {
7636         u16 max_latency;
7637
7638         if (min > max || min < 6 || max > 3200)
7639                 return -EINVAL;
7640
7641         if (to_multiplier < 10 || to_multiplier > 3200)
7642                 return -EINVAL;
7643
7644         if (max >= to_multiplier * 8)
7645                 return -EINVAL;
7646
7647         max_latency = (to_multiplier * 8 / max) - 1;
7648
7649         if (latency > 499 || latency > max_latency)
7650                 return -EINVAL;
7651
7652         return 0;
7653 }
7654
7655 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
7656                 u16 len)
7657 {
7658         struct mgmt_cp_le_conn_update *cp = data;
7659
7660         struct hci_conn *conn;
7661         u16 min, max, latency, supervision_timeout;
7662         int err = -1;
7663
7664         if (!hdev_is_powered(hdev))
7665                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7666                                 MGMT_STATUS_NOT_POWERED);
7667
7668         min = __le16_to_cpu(cp->conn_interval_min);
7669         max = __le16_to_cpu(cp->conn_interval_max);
7670         latency = __le16_to_cpu(cp->conn_latency);
7671         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
7672
7673         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
7674                         min, max, latency, supervision_timeout);
7675
7676         err = check_le_conn_update_param(min, max, latency,
7677                         supervision_timeout);
7678
7679         if (err < 0)
7680                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7681                                 MGMT_STATUS_INVALID_PARAMS);
7682
7683         hci_dev_lock(hdev);
7684
7685         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
7686         if (!conn) {
7687                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
7688                                 MGMT_STATUS_NOT_CONNECTED);
7689                 hci_dev_unlock(hdev);
7690                 return err;
7691         }
7692
7693         hci_dev_unlock(hdev);
7694
7695         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
7696
7697         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
7698                                  NULL, 0);
7699 }
7700
7701 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status,
7702                 u16 opcode)
7703 {
7704         struct mgmt_cp_set_manufacturer_data *cp;
7705         struct mgmt_pending_cmd *cmd;
7706
7707         BT_DBG("status 0x%02x", status);
7708
7709         hci_dev_lock(hdev);
7710
7711         cmd = pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
7712         if (!cmd)
7713                 goto unlock;
7714
7715         cp = cmd->param;
7716
7717         if (status)
7718                 mgmt_cmd_status(cmd->sk, hdev->id,
7719                                 MGMT_OP_SET_MANUFACTURER_DATA,
7720                                 mgmt_status(status));
7721         else
7722                 mgmt_cmd_complete(cmd->sk, hdev->id,
7723                                   MGMT_OP_SET_MANUFACTURER_DATA, 0,
7724                                   cp, sizeof(*cp));
7725
7726         mgmt_pending_remove(cmd);
7727
7728 unlock:
7729         hci_dev_unlock(hdev);
7730 }
7731
7732 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
7733                 void *data, u16 len)
7734 {
7735         struct mgmt_pending_cmd *cmd;
7736         struct hci_request req;
7737         struct mgmt_cp_set_manufacturer_data *cp = data;
7738         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
7739         u8 old_len;
7740         int err;
7741
7742         BT_DBG("%s", hdev->name);
7743
7744         if (!lmp_bredr_capable(hdev))
7745                 return mgmt_cmd_status(sk, hdev->id,
7746                                 MGMT_OP_SET_MANUFACTURER_DATA,
7747                                 MGMT_STATUS_NOT_SUPPORTED);
7748
7749         if (cp->data[0] == 0 ||
7750                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data))
7751                 return mgmt_cmd_status(sk, hdev->id,
7752                                 MGMT_OP_SET_MANUFACTURER_DATA,
7753                                 MGMT_STATUS_INVALID_PARAMS);
7754
7755         if (cp->data[1] != 0xFF)
7756                 return mgmt_cmd_status(sk, hdev->id,
7757                                 MGMT_OP_SET_MANUFACTURER_DATA,
7758                                 MGMT_STATUS_NOT_SUPPORTED);
7759
7760         hci_dev_lock(hdev);
7761
7762         if (pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
7763                 err = mgmt_cmd_status(sk, hdev->id,
7764                                 MGMT_OP_SET_MANUFACTURER_DATA,
7765                                 MGMT_STATUS_BUSY);
7766                 goto unlocked;
7767         }
7768
7769         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data,
7770                         len);
7771         if (!cmd) {
7772                 err = -ENOMEM;
7773                 goto unlocked;
7774         }
7775
7776         hci_req_init(&req, hdev);
7777
7778         /* if new data is same as previous data then return command
7779          * complete event
7780          */
7781         if (hdev->manufacturer_len == cp->data[0] - 1 &&
7782             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
7783                 mgmt_pending_remove(cmd);
7784                 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
7785                                   0, cp, sizeof(*cp));
7786                 err = 0;
7787                 goto unlocked;
7788         }
7789
7790         old_len = hdev->manufacturer_len;
7791         if (old_len > 0)
7792                 memcpy(old_data, hdev->manufacturer_data, old_len);
7793
7794         hdev->manufacturer_len = cp->data[0] - 1;
7795         if (hdev->manufacturer_len > 0)
7796                 memcpy(hdev->manufacturer_data, cp->data + 2,
7797                                 hdev->manufacturer_len);
7798
7799         __hci_req_update_eir(&req);
7800
7801         err = hci_req_run(&req, set_manufacturer_data_complete);
7802         if (err < 0) {
7803                 mgmt_pending_remove(cmd);
7804                 goto failed;
7805         }
7806
7807 unlocked:
7808         hci_dev_unlock(hdev);
7809
7810         return err;
7811
7812 failed:
7813         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
7814         hdev->manufacturer_len = old_len;
7815         if (hdev->manufacturer_len > 0)
7816                 memcpy(hdev->manufacturer_data, old_data,
7817                        hdev->manufacturer_len);
7818         hci_dev_unlock(hdev);
7819         return err;
7820 }
7821
7822 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
7823                 void *data, u16 len)
7824 {
7825         struct mgmt_cp_le_set_scan_params *cp = data;
7826         __u16 interval, window;
7827         int err;
7828
7829         BT_DBG("%s", hdev->name);
7830
7831         if (!lmp_le_capable(hdev))
7832                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7833                                 MGMT_STATUS_NOT_SUPPORTED);
7834
7835         interval = __le16_to_cpu(cp->interval);
7836
7837         if (interval < 0x0004 || interval > 0x4000)
7838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7839                                 MGMT_STATUS_INVALID_PARAMS);
7840
7841         window = __le16_to_cpu(cp->window);
7842
7843         if (window < 0x0004 || window > 0x4000)
7844                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7845                                 MGMT_STATUS_INVALID_PARAMS);
7846
7847         if (window > interval)
7848                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
7849                                 MGMT_STATUS_INVALID_PARAMS);
7850
7851         hci_dev_lock(hdev);
7852
7853         hdev->le_scan_type = cp->type;
7854         hdev->le_scan_interval = interval;
7855         hdev->le_scan_window = window;
7856
7857         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0,
7858                                 NULL, 0);
7859
7860         /* If background scan is running, restart it so new parameters are
7861          * loaded.
7862          */
7863         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
7864             hdev->discovery.state == DISCOVERY_STOPPED) {
7865                 struct hci_request req;
7866
7867                 hci_req_init(&req, hdev);
7868
7869                 hci_req_add_le_scan_disable(&req, false);
7870                 hci_req_add_le_passive_scan(&req);
7871
7872                 hci_req_run(&req, NULL);
7873         }
7874
7875         hci_dev_unlock(hdev);
7876
7877         return err;
7878 }
7879
7880 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
7881 {
7882         struct mgmt_ev_hardware_error ev;
7883
7884         ev.error_code = err_code;
7885         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
7886 }
7887
7888 void mgmt_tx_timeout_error(struct hci_dev *hdev)
7889 {
7890         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
7891 }
7892 #endif /* TIZEN_BT */
7893
7894 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7895 {
7896         if (key->initiator != 0x00 && key->initiator != 0x01)
7897                 return false;
7898
7899         switch (key->addr.type) {
7900         case BDADDR_LE_PUBLIC:
7901                 return true;
7902
7903         case BDADDR_LE_RANDOM:
7904                 /* Two most significant bits shall be set */
7905                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7906                         return false;
7907                 return true;
7908         }
7909
7910         return false;
7911 }
7912
7913 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7914                                void *cp_data, u16 len)
7915 {
7916         struct mgmt_cp_load_long_term_keys *cp = cp_data;
7917         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7918                                    sizeof(struct mgmt_ltk_info));
7919         u16 key_count, expected_len;
7920         int i, err;
7921
7922         bt_dev_dbg(hdev, "sock %p", sk);
7923
7924         if (!lmp_le_capable(hdev))
7925                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7926                                        MGMT_STATUS_NOT_SUPPORTED);
7927
7928         key_count = __le16_to_cpu(cp->key_count);
7929         if (key_count > max_key_count) {
7930                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7931                            key_count);
7932                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7933                                        MGMT_STATUS_INVALID_PARAMS);
7934         }
7935
7936         expected_len = struct_size(cp, keys, key_count);
7937         if (expected_len != len) {
7938                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7939                            expected_len, len);
7940                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7941                                        MGMT_STATUS_INVALID_PARAMS);
7942         }
7943
7944         bt_dev_dbg(hdev, "key_count %u", key_count);
7945
7946         for (i = 0; i < key_count; i++) {
7947                 struct mgmt_ltk_info *key = &cp->keys[i];
7948
7949                 if (!ltk_is_valid(key))
7950                         return mgmt_cmd_status(sk, hdev->id,
7951                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
7952                                                MGMT_STATUS_INVALID_PARAMS);
7953         }
7954
7955         hci_dev_lock(hdev);
7956
7957         hci_smp_ltks_clear(hdev);
7958
7959         for (i = 0; i < key_count; i++) {
7960                 struct mgmt_ltk_info *key = &cp->keys[i];
7961                 u8 type, authenticated;
7962
7963                 if (hci_is_blocked_key(hdev,
7964                                        HCI_BLOCKED_KEY_TYPE_LTK,
7965                                        key->val)) {
7966                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7967                                     &key->addr.bdaddr);
7968                         continue;
7969                 }
7970
7971                 switch (key->type) {
7972                 case MGMT_LTK_UNAUTHENTICATED:
7973                         authenticated = 0x00;
7974                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7975                         break;
7976                 case MGMT_LTK_AUTHENTICATED:
7977                         authenticated = 0x01;
7978                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7979                         break;
7980                 case MGMT_LTK_P256_UNAUTH:
7981                         authenticated = 0x00;
7982                         type = SMP_LTK_P256;
7983                         break;
7984                 case MGMT_LTK_P256_AUTH:
7985                         authenticated = 0x01;
7986                         type = SMP_LTK_P256;
7987                         break;
7988                 case MGMT_LTK_P256_DEBUG:
7989                         authenticated = 0x00;
7990                         type = SMP_LTK_P256_DEBUG;
7991                         fallthrough;
7992                 default:
7993                         continue;
7994                 }
7995
7996                 hci_add_ltk(hdev, &key->addr.bdaddr,
7997                             le_addr_type(key->addr.type), type, authenticated,
7998                             key->val, key->enc_size, key->ediv, key->rand);
7999         }
8000
8001         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
8002                            NULL, 0);
8003
8004         hci_dev_unlock(hdev);
8005
8006         return err;
8007 }
8008
8009 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8010 {
8011         struct hci_conn *conn = cmd->user_data;
8012         struct mgmt_rp_get_conn_info rp;
8013         int err;
8014
8015         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8016
8017         if (status == MGMT_STATUS_SUCCESS) {
8018                 rp.rssi = conn->rssi;
8019                 rp.tx_power = conn->tx_power;
8020                 rp.max_tx_power = conn->max_tx_power;
8021         } else {
8022                 rp.rssi = HCI_RSSI_INVALID;
8023                 rp.tx_power = HCI_TX_POWER_INVALID;
8024                 rp.max_tx_power = HCI_TX_POWER_INVALID;
8025         }
8026
8027         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
8028                                 status, &rp, sizeof(rp));
8029
8030         hci_conn_drop(conn);
8031         hci_conn_put(conn);
8032
8033         return err;
8034 }
8035
8036 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
8037                                        u16 opcode)
8038 {
8039         struct hci_cp_read_rssi *cp;
8040         struct mgmt_pending_cmd *cmd;
8041         struct hci_conn *conn;
8042         u16 handle;
8043         u8 status;
8044
8045         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
8046
8047         hci_dev_lock(hdev);
8048
8049         /* Commands sent in request are either Read RSSI or Read Transmit Power
8050          * Level so we check which one was last sent to retrieve connection
8051          * handle.  Both commands have handle as first parameter so it's safe to
8052          * cast data on the same command struct.
8053          *
8054          * First command sent is always Read RSSI and we fail only if it fails.
8055          * In other case we simply override error to indicate success as we
8056          * already remembered if TX power value is actually valid.
8057          */
8058         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
8059         if (!cp) {
8060                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
8061                 status = MGMT_STATUS_SUCCESS;
8062         } else {
8063                 status = mgmt_status(hci_status);
8064         }
8065
8066         if (!cp) {
8067                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
8068                 goto unlock;
8069         }
8070
8071         handle = __le16_to_cpu(cp->handle);
8072         conn = hci_conn_hash_lookup_handle(hdev, handle);
8073         if (!conn) {
8074                 bt_dev_err(hdev, "unknown handle (%u) in conn_info response",
8075                            handle);
8076                 goto unlock;
8077         }
8078
8079         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
8080         if (!cmd)
8081                 goto unlock;
8082
8083         cmd->cmd_complete(cmd, status);
8084         mgmt_pending_remove(cmd);
8085
8086 unlock:
8087         hci_dev_unlock(hdev);
8088 }
8089
8090 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
8091                          u16 len)
8092 {
8093         struct mgmt_cp_get_conn_info *cp = data;
8094         struct mgmt_rp_get_conn_info rp;
8095         struct hci_conn *conn;
8096         unsigned long conn_info_age;
8097         int err = 0;
8098
8099         bt_dev_dbg(hdev, "sock %p", sk);
8100
8101         memset(&rp, 0, sizeof(rp));
8102         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8103         rp.addr.type = cp->addr.type;
8104
8105         if (!bdaddr_type_is_valid(cp->addr.type))
8106                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8107                                          MGMT_STATUS_INVALID_PARAMS,
8108                                          &rp, sizeof(rp));
8109
8110         hci_dev_lock(hdev);
8111
8112         if (!hdev_is_powered(hdev)) {
8113                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8114                                         MGMT_STATUS_NOT_POWERED, &rp,
8115                                         sizeof(rp));
8116                 goto unlock;
8117         }
8118
8119         if (cp->addr.type == BDADDR_BREDR)
8120                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8121                                                &cp->addr.bdaddr);
8122         else
8123                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
8124
8125         if (!conn || conn->state != BT_CONNECTED) {
8126                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8127                                         MGMT_STATUS_NOT_CONNECTED, &rp,
8128                                         sizeof(rp));
8129                 goto unlock;
8130         }
8131
8132         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
8133                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8134                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
8135                 goto unlock;
8136         }
8137
8138         /* To avoid client trying to guess when to poll again for information we
8139          * calculate conn info age as random value between min/max set in hdev.
8140          */
8141         conn_info_age = hdev->conn_info_min_age +
8142                         prandom_u32_max(hdev->conn_info_max_age -
8143                                         hdev->conn_info_min_age);
8144
8145         /* Query controller to refresh cached values if they are too old or were
8146          * never read.
8147          */
8148         if (time_after(jiffies, conn->conn_info_timestamp +
8149                        msecs_to_jiffies(conn_info_age)) ||
8150             !conn->conn_info_timestamp) {
8151                 struct hci_request req;
8152                 struct hci_cp_read_tx_power req_txp_cp;
8153                 struct hci_cp_read_rssi req_rssi_cp;
8154                 struct mgmt_pending_cmd *cmd;
8155
8156                 hci_req_init(&req, hdev);
8157                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
8158                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
8159                             &req_rssi_cp);
8160
8161                 /* For LE links TX power does not change thus we don't need to
8162                  * query for it once value is known.
8163                  */
8164                 if (!bdaddr_type_is_le(cp->addr.type) ||
8165                     conn->tx_power == HCI_TX_POWER_INVALID) {
8166                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8167                         req_txp_cp.type = 0x00;
8168                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8169                                     sizeof(req_txp_cp), &req_txp_cp);
8170                 }
8171
8172                 /* Max TX power needs to be read only once per connection */
8173                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
8174                         req_txp_cp.handle = cpu_to_le16(conn->handle);
8175                         req_txp_cp.type = 0x01;
8176                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
8177                                     sizeof(req_txp_cp), &req_txp_cp);
8178                 }
8179
8180                 err = hci_req_run(&req, conn_info_refresh_complete);
8181                 if (err < 0)
8182                         goto unlock;
8183
8184                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
8185                                        data, len);
8186                 if (!cmd) {
8187                         err = -ENOMEM;
8188                         goto unlock;
8189                 }
8190
8191                 hci_conn_hold(conn);
8192                 cmd->user_data = hci_conn_get(conn);
8193                 cmd->cmd_complete = conn_info_cmd_complete;
8194
8195                 conn->conn_info_timestamp = jiffies;
8196         } else {
8197                 /* Cache is valid, just reply with values cached in hci_conn */
8198                 rp.rssi = conn->rssi;
8199                 rp.tx_power = conn->tx_power;
8200                 rp.max_tx_power = conn->max_tx_power;
8201
8202                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
8203                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8204         }
8205
8206 unlock:
8207         hci_dev_unlock(hdev);
8208         return err;
8209 }
8210
8211 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
8212 {
8213         struct hci_conn *conn = cmd->user_data;
8214         struct mgmt_rp_get_clock_info rp;
8215         struct hci_dev *hdev;
8216         int err;
8217
8218         memset(&rp, 0, sizeof(rp));
8219         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
8220
8221         if (status)
8222                 goto complete;
8223
8224         hdev = hci_dev_get(cmd->index);
8225         if (hdev) {
8226                 rp.local_clock = cpu_to_le32(hdev->clock);
8227                 hci_dev_put(hdev);
8228         }
8229
8230         if (conn) {
8231                 rp.piconet_clock = cpu_to_le32(conn->clock);
8232                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
8233         }
8234
8235 complete:
8236         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
8237                                 sizeof(rp));
8238
8239         if (conn) {
8240                 hci_conn_drop(conn);
8241                 hci_conn_put(conn);
8242         }
8243
8244         return err;
8245 }
8246
8247 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8248 {
8249         struct hci_cp_read_clock *hci_cp;
8250         struct mgmt_pending_cmd *cmd;
8251         struct hci_conn *conn;
8252
8253         bt_dev_dbg(hdev, "status %u", status);
8254
8255         hci_dev_lock(hdev);
8256
8257         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
8258         if (!hci_cp)
8259                 goto unlock;
8260
8261         if (hci_cp->which) {
8262                 u16 handle = __le16_to_cpu(hci_cp->handle);
8263                 conn = hci_conn_hash_lookup_handle(hdev, handle);
8264         } else {
8265                 conn = NULL;
8266         }
8267
8268         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
8269         if (!cmd)
8270                 goto unlock;
8271
8272         cmd->cmd_complete(cmd, mgmt_status(status));
8273         mgmt_pending_remove(cmd);
8274
8275 unlock:
8276         hci_dev_unlock(hdev);
8277 }
8278
8279 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
8280                          u16 len)
8281 {
8282         struct mgmt_cp_get_clock_info *cp = data;
8283         struct mgmt_rp_get_clock_info rp;
8284         struct hci_cp_read_clock hci_cp;
8285         struct mgmt_pending_cmd *cmd;
8286         struct hci_request req;
8287         struct hci_conn *conn;
8288         int err;
8289
8290         bt_dev_dbg(hdev, "sock %p", sk);
8291
8292         memset(&rp, 0, sizeof(rp));
8293         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
8294         rp.addr.type = cp->addr.type;
8295
8296         if (cp->addr.type != BDADDR_BREDR)
8297                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8298                                          MGMT_STATUS_INVALID_PARAMS,
8299                                          &rp, sizeof(rp));
8300
8301         hci_dev_lock(hdev);
8302
8303         if (!hdev_is_powered(hdev)) {
8304                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
8305                                         MGMT_STATUS_NOT_POWERED, &rp,
8306                                         sizeof(rp));
8307                 goto unlock;
8308         }
8309
8310         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8311                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
8312                                                &cp->addr.bdaddr);
8313                 if (!conn || conn->state != BT_CONNECTED) {
8314                         err = mgmt_cmd_complete(sk, hdev->id,
8315                                                 MGMT_OP_GET_CLOCK_INFO,
8316                                                 MGMT_STATUS_NOT_CONNECTED,
8317                                                 &rp, sizeof(rp));
8318                         goto unlock;
8319                 }
8320         } else {
8321                 conn = NULL;
8322         }
8323
8324         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
8325         if (!cmd) {
8326                 err = -ENOMEM;
8327                 goto unlock;
8328         }
8329
8330         cmd->cmd_complete = clock_info_cmd_complete;
8331
8332         hci_req_init(&req, hdev);
8333
8334         memset(&hci_cp, 0, sizeof(hci_cp));
8335         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8336
8337         if (conn) {
8338                 hci_conn_hold(conn);
8339                 cmd->user_data = hci_conn_get(conn);
8340
8341                 hci_cp.handle = cpu_to_le16(conn->handle);
8342                 hci_cp.which = 0x01; /* Piconet clock */
8343                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
8344         }
8345
8346         err = hci_req_run(&req, get_clock_info_complete);
8347         if (err < 0)
8348                 mgmt_pending_remove(cmd);
8349
8350 unlock:
8351         hci_dev_unlock(hdev);
8352         return err;
8353 }
8354
8355 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
8356 {
8357         struct hci_conn *conn;
8358
8359         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
8360         if (!conn)
8361                 return false;
8362
8363         if (conn->dst_type != type)
8364                 return false;
8365
8366         if (conn->state != BT_CONNECTED)
8367                 return false;
8368
8369         return true;
8370 }
8371
8372 /* This function requires the caller holds hdev->lock */
8373 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
8374                                u8 addr_type, u8 auto_connect)
8375 {
8376         struct hci_conn_params *params;
8377
8378         params = hci_conn_params_add(hdev, addr, addr_type);
8379         if (!params)
8380                 return -EIO;
8381
8382         if (params->auto_connect == auto_connect)
8383                 return 0;
8384
8385         list_del_init(&params->action);
8386
8387         switch (auto_connect) {
8388         case HCI_AUTO_CONN_DISABLED:
8389         case HCI_AUTO_CONN_LINK_LOSS:
8390                 /* If auto connect is being disabled when we're trying to
8391                  * connect to device, keep connecting.
8392                  */
8393                 if (params->explicit_connect)
8394                         list_add(&params->action, &hdev->pend_le_conns);
8395                 break;
8396         case HCI_AUTO_CONN_REPORT:
8397                 if (params->explicit_connect)
8398                         list_add(&params->action, &hdev->pend_le_conns);
8399                 else
8400                         list_add(&params->action, &hdev->pend_le_reports);
8401                 break;
8402         case HCI_AUTO_CONN_DIRECT:
8403         case HCI_AUTO_CONN_ALWAYS:
8404                 if (!is_connected(hdev, addr, addr_type))
8405                         list_add(&params->action, &hdev->pend_le_conns);
8406                 break;
8407         }
8408
8409         params->auto_connect = auto_connect;
8410
8411         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
8412                    addr, addr_type, auto_connect);
8413
8414         return 0;
8415 }
8416
8417 static void device_added(struct sock *sk, struct hci_dev *hdev,
8418                          bdaddr_t *bdaddr, u8 type, u8 action)
8419 {
8420         struct mgmt_ev_device_added ev;
8421
8422         bacpy(&ev.addr.bdaddr, bdaddr);
8423         ev.addr.type = type;
8424         ev.action = action;
8425
8426         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
8427 }
8428
8429 static int add_device(struct sock *sk, struct hci_dev *hdev,
8430                       void *data, u16 len)
8431 {
8432         struct mgmt_cp_add_device *cp = data;
8433         u8 auto_conn, addr_type;
8434         struct hci_conn_params *params;
8435         int err;
8436         u32 current_flags = 0;
8437
8438         bt_dev_dbg(hdev, "sock %p", sk);
8439
8440         if (!bdaddr_type_is_valid(cp->addr.type) ||
8441             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
8442                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8443                                          MGMT_STATUS_INVALID_PARAMS,
8444                                          &cp->addr, sizeof(cp->addr));
8445
8446         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
8447                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8448                                          MGMT_STATUS_INVALID_PARAMS,
8449                                          &cp->addr, sizeof(cp->addr));
8450
8451         hci_dev_lock(hdev);
8452
8453         if (cp->addr.type == BDADDR_BREDR) {
8454                 /* Only incoming connections action is supported for now */
8455                 if (cp->action != 0x01) {
8456                         err = mgmt_cmd_complete(sk, hdev->id,
8457                                                 MGMT_OP_ADD_DEVICE,
8458                                                 MGMT_STATUS_INVALID_PARAMS,
8459                                                 &cp->addr, sizeof(cp->addr));
8460                         goto unlock;
8461                 }
8462
8463                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
8464                                                      &cp->addr.bdaddr,
8465                                                      cp->addr.type, 0);
8466                 if (err)
8467                         goto unlock;
8468
8469                 hci_req_update_scan(hdev);
8470
8471                 goto added;
8472         }
8473
8474         addr_type = le_addr_type(cp->addr.type);
8475
8476         if (cp->action == 0x02)
8477                 auto_conn = HCI_AUTO_CONN_ALWAYS;
8478         else if (cp->action == 0x01)
8479                 auto_conn = HCI_AUTO_CONN_DIRECT;
8480         else
8481                 auto_conn = HCI_AUTO_CONN_REPORT;
8482
8483         /* Kernel internally uses conn_params with resolvable private
8484          * address, but Add Device allows only identity addresses.
8485          * Make sure it is enforced before calling
8486          * hci_conn_params_lookup.
8487          */
8488         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8489                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8490                                         MGMT_STATUS_INVALID_PARAMS,
8491                                         &cp->addr, sizeof(cp->addr));
8492                 goto unlock;
8493         }
8494
8495         /* If the connection parameters don't exist for this device,
8496          * they will be created and configured with defaults.
8497          */
8498         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
8499                                 auto_conn) < 0) {
8500                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8501                                         MGMT_STATUS_FAILED, &cp->addr,
8502                                         sizeof(cp->addr));
8503                 goto unlock;
8504         } else {
8505                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8506                                                 addr_type);
8507                 if (params)
8508                         current_flags = params->current_flags;
8509         }
8510
8511         hci_update_background_scan(hdev);
8512
8513 added:
8514         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
8515         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
8516                              SUPPORTED_DEVICE_FLAGS(), current_flags);
8517
8518         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
8519                                 MGMT_STATUS_SUCCESS, &cp->addr,
8520                                 sizeof(cp->addr));
8521
8522 unlock:
8523         hci_dev_unlock(hdev);
8524         return err;
8525 }
8526
8527 static void device_removed(struct sock *sk, struct hci_dev *hdev,
8528                            bdaddr_t *bdaddr, u8 type)
8529 {
8530         struct mgmt_ev_device_removed ev;
8531
8532         bacpy(&ev.addr.bdaddr, bdaddr);
8533         ev.addr.type = type;
8534
8535         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
8536 }
8537
8538 static int remove_device(struct sock *sk, struct hci_dev *hdev,
8539                          void *data, u16 len)
8540 {
8541         struct mgmt_cp_remove_device *cp = data;
8542         int err;
8543
8544         bt_dev_dbg(hdev, "sock %p", sk);
8545
8546         hci_dev_lock(hdev);
8547
8548         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
8549                 struct hci_conn_params *params;
8550                 u8 addr_type;
8551
8552                 if (!bdaddr_type_is_valid(cp->addr.type)) {
8553                         err = mgmt_cmd_complete(sk, hdev->id,
8554                                                 MGMT_OP_REMOVE_DEVICE,
8555                                                 MGMT_STATUS_INVALID_PARAMS,
8556                                                 &cp->addr, sizeof(cp->addr));
8557                         goto unlock;
8558                 }
8559
8560                 if (cp->addr.type == BDADDR_BREDR) {
8561                         err = hci_bdaddr_list_del(&hdev->accept_list,
8562                                                   &cp->addr.bdaddr,
8563                                                   cp->addr.type);
8564                         if (err) {
8565                                 err = mgmt_cmd_complete(sk, hdev->id,
8566                                                         MGMT_OP_REMOVE_DEVICE,
8567                                                         MGMT_STATUS_INVALID_PARAMS,
8568                                                         &cp->addr,
8569                                                         sizeof(cp->addr));
8570                                 goto unlock;
8571                         }
8572
8573                         hci_req_update_scan(hdev);
8574
8575                         device_removed(sk, hdev, &cp->addr.bdaddr,
8576                                        cp->addr.type);
8577                         goto complete;
8578                 }
8579
8580                 addr_type = le_addr_type(cp->addr.type);
8581
8582                 /* Kernel internally uses conn_params with resolvable private
8583                  * address, but Remove Device allows only identity addresses.
8584                  * Make sure it is enforced before calling
8585                  * hci_conn_params_lookup.
8586                  */
8587                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
8588                         err = mgmt_cmd_complete(sk, hdev->id,
8589                                                 MGMT_OP_REMOVE_DEVICE,
8590                                                 MGMT_STATUS_INVALID_PARAMS,
8591                                                 &cp->addr, sizeof(cp->addr));
8592                         goto unlock;
8593                 }
8594
8595                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
8596                                                 addr_type);
8597                 if (!params) {
8598                         err = mgmt_cmd_complete(sk, hdev->id,
8599                                                 MGMT_OP_REMOVE_DEVICE,
8600                                                 MGMT_STATUS_INVALID_PARAMS,
8601                                                 &cp->addr, sizeof(cp->addr));
8602                         goto unlock;
8603                 }
8604
8605                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
8606                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
8607                         err = mgmt_cmd_complete(sk, hdev->id,
8608                                                 MGMT_OP_REMOVE_DEVICE,
8609                                                 MGMT_STATUS_INVALID_PARAMS,
8610                                                 &cp->addr, sizeof(cp->addr));
8611                         goto unlock;
8612                 }
8613
8614                 list_del(&params->action);
8615                 list_del(&params->list);
8616                 kfree(params);
8617                 hci_update_background_scan(hdev);
8618
8619                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8620         } else {
8621                 struct hci_conn_params *p, *tmp;
8622                 struct bdaddr_list *b, *btmp;
8623
8624                 if (cp->addr.type) {
8625                         err = mgmt_cmd_complete(sk, hdev->id,
8626                                                 MGMT_OP_REMOVE_DEVICE,
8627                                                 MGMT_STATUS_INVALID_PARAMS,
8628                                                 &cp->addr, sizeof(cp->addr));
8629                         goto unlock;
8630                 }
8631
8632                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
8633                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8634                         list_del(&b->list);
8635                         kfree(b);
8636                 }
8637
8638                 hci_req_update_scan(hdev);
8639
8640                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8641                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8642                                 continue;
8643                         device_removed(sk, hdev, &p->addr, p->addr_type);
8644                         if (p->explicit_connect) {
8645                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8646                                 continue;
8647                         }
8648                         list_del(&p->action);
8649                         list_del(&p->list);
8650                         kfree(p);
8651                 }
8652
8653                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8654
8655                 hci_update_background_scan(hdev);
8656         }
8657
8658 complete:
8659         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
8660                                 MGMT_STATUS_SUCCESS, &cp->addr,
8661                                 sizeof(cp->addr));
8662 unlock:
8663         hci_dev_unlock(hdev);
8664         return err;
8665 }
8666
8667 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
8668                            u16 len)
8669 {
8670         struct mgmt_cp_load_conn_param *cp = data;
8671         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8672                                      sizeof(struct mgmt_conn_param));
8673         u16 param_count, expected_len;
8674         int i;
8675
8676         if (!lmp_le_capable(hdev))
8677                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8678                                        MGMT_STATUS_NOT_SUPPORTED);
8679
8680         param_count = __le16_to_cpu(cp->param_count);
8681         if (param_count > max_param_count) {
8682                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
8683                            param_count);
8684                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8685                                        MGMT_STATUS_INVALID_PARAMS);
8686         }
8687
8688         expected_len = struct_size(cp, params, param_count);
8689         if (expected_len != len) {
8690                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
8691                            expected_len, len);
8692                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8693                                        MGMT_STATUS_INVALID_PARAMS);
8694         }
8695
8696         bt_dev_dbg(hdev, "param_count %u", param_count);
8697
8698         hci_dev_lock(hdev);
8699
8700         hci_conn_params_clear_disabled(hdev);
8701
8702         for (i = 0; i < param_count; i++) {
8703                 struct mgmt_conn_param *param = &cp->params[i];
8704                 struct hci_conn_params *hci_param;
8705                 u16 min, max, latency, timeout;
8706                 u8 addr_type;
8707
8708                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
8709                            param->addr.type);
8710
8711                 if (param->addr.type == BDADDR_LE_PUBLIC) {
8712                         addr_type = ADDR_LE_DEV_PUBLIC;
8713                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8714                         addr_type = ADDR_LE_DEV_RANDOM;
8715                 } else {
8716                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8717                         continue;
8718                 }
8719
8720                 min = le16_to_cpu(param->min_interval);
8721                 max = le16_to_cpu(param->max_interval);
8722                 latency = le16_to_cpu(param->latency);
8723                 timeout = le16_to_cpu(param->timeout);
8724
8725                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
8726                            min, max, latency, timeout);
8727
8728                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
8729                         bt_dev_err(hdev, "ignoring invalid connection parameters");
8730                         continue;
8731                 }
8732
8733                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
8734                                                 addr_type);
8735                 if (!hci_param) {
8736                         bt_dev_err(hdev, "failed to add connection parameters");
8737                         continue;
8738                 }
8739
8740                 hci_param->conn_min_interval = min;
8741                 hci_param->conn_max_interval = max;
8742                 hci_param->conn_latency = latency;
8743                 hci_param->supervision_timeout = timeout;
8744         }
8745
8746         hci_dev_unlock(hdev);
8747
8748         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
8749                                  NULL, 0);
8750 }
8751
8752 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
8753                                void *data, u16 len)
8754 {
8755         struct mgmt_cp_set_external_config *cp = data;
8756         bool changed;
8757         int err;
8758
8759         bt_dev_dbg(hdev, "sock %p", sk);
8760
8761         if (hdev_is_powered(hdev))
8762                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8763                                        MGMT_STATUS_REJECTED);
8764
8765         if (cp->config != 0x00 && cp->config != 0x01)
8766                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8767                                          MGMT_STATUS_INVALID_PARAMS);
8768
8769         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
8770                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8771                                        MGMT_STATUS_NOT_SUPPORTED);
8772
8773         hci_dev_lock(hdev);
8774
8775         if (cp->config)
8776                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
8777         else
8778                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
8779
8780         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
8781         if (err < 0)
8782                 goto unlock;
8783
8784         if (!changed)
8785                 goto unlock;
8786
8787         err = new_options(hdev, sk);
8788
8789         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
8790                 mgmt_index_removed(hdev);
8791
8792                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
8793                         hci_dev_set_flag(hdev, HCI_CONFIG);
8794                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8795
8796                         queue_work(hdev->req_workqueue, &hdev->power_on);
8797                 } else {
8798                         set_bit(HCI_RAW, &hdev->flags);
8799                         mgmt_index_added(hdev);
8800                 }
8801         }
8802
8803 unlock:
8804         hci_dev_unlock(hdev);
8805         return err;
8806 }
8807
8808 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8809                               void *data, u16 len)
8810 {
8811         struct mgmt_cp_set_public_address *cp = data;
8812         bool changed;
8813         int err;
8814
8815         bt_dev_dbg(hdev, "sock %p", sk);
8816
8817         if (hdev_is_powered(hdev))
8818                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8819                                        MGMT_STATUS_REJECTED);
8820
8821         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8822                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8823                                        MGMT_STATUS_INVALID_PARAMS);
8824
8825         if (!hdev->set_bdaddr)
8826                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8827                                        MGMT_STATUS_NOT_SUPPORTED);
8828
8829         hci_dev_lock(hdev);
8830
8831         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8832         bacpy(&hdev->public_addr, &cp->bdaddr);
8833
8834         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8835         if (err < 0)
8836                 goto unlock;
8837
8838         if (!changed)
8839                 goto unlock;
8840
8841         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8842                 err = new_options(hdev, sk);
8843
8844         if (is_configured(hdev)) {
8845                 mgmt_index_removed(hdev);
8846
8847                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8848
8849                 hci_dev_set_flag(hdev, HCI_CONFIG);
8850                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8851
8852                 queue_work(hdev->req_workqueue, &hdev->power_on);
8853         }
8854
8855 unlock:
8856         hci_dev_unlock(hdev);
8857         return err;
8858 }
8859
8860 #ifdef TIZEN_BT
8861 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
8862                             u8 name_len)
8863 {
8864         char buf[512];
8865         struct mgmt_ev_device_name_update *ev = (void *)buf;
8866         u16 eir_len = 0;
8867
8868         if (name_len <= 0)
8869                 return -EINVAL;
8870
8871         bacpy(&ev->addr.bdaddr, bdaddr);
8872         ev->addr.type = BDADDR_BREDR;
8873
8874         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8875                                   name_len);
8876
8877         ev->eir_len = cpu_to_le16(eir_len);
8878
8879         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
8880                           sizeof(*ev) + eir_len, NULL);
8881 }
8882
8883 int mgmt_le_conn_update_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8884                                u8 link_type, u8 addr_type, u8 status)
8885 {
8886         struct mgmt_ev_conn_update_failed ev;
8887
8888         bacpy(&ev.addr.bdaddr, bdaddr);
8889         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8890         ev.status = status;
8891
8892         return mgmt_event(MGMT_EV_CONN_UPDATE_FAILED, hdev,
8893                                 &ev, sizeof(ev), NULL);
8894 }
8895
8896 int mgmt_le_conn_updated(struct hci_dev *hdev, bdaddr_t *bdaddr,
8897                          u8 link_type, u8 addr_type, u16 conn_interval,
8898                          u16 conn_latency, u16 supervision_timeout)
8899 {
8900         struct mgmt_ev_conn_updated ev;
8901
8902         bacpy(&ev.addr.bdaddr, bdaddr);
8903         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8904         ev.conn_interval = cpu_to_le16(conn_interval);
8905         ev.conn_latency = cpu_to_le16(conn_latency);
8906         ev.supervision_timeout = cpu_to_le16(supervision_timeout);
8907
8908         return mgmt_event(MGMT_EV_CONN_UPDATED, hdev,
8909                                 &ev, sizeof(ev), NULL);
8910 }
8911 #endif
8912
8913 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
8914                                              u16 opcode, struct sk_buff *skb)
8915 {
8916         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8917         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8918         u8 *h192, *r192, *h256, *r256;
8919         struct mgmt_pending_cmd *cmd;
8920         u16 eir_len;
8921         int err;
8922
8923         bt_dev_dbg(hdev, "status %u", status);
8924
8925         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
8926         if (!cmd)
8927                 return;
8928
8929         mgmt_cp = cmd->param;
8930
8931         if (status) {
8932                 status = mgmt_status(status);
8933                 eir_len = 0;
8934
8935                 h192 = NULL;
8936                 r192 = NULL;
8937                 h256 = NULL;
8938                 r256 = NULL;
8939         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
8940                 struct hci_rp_read_local_oob_data *rp;
8941
8942                 if (skb->len != sizeof(*rp)) {
8943                         status = MGMT_STATUS_FAILED;
8944                         eir_len = 0;
8945                 } else {
8946                         status = MGMT_STATUS_SUCCESS;
8947                         rp = (void *)skb->data;
8948
8949                         eir_len = 5 + 18 + 18;
8950                         h192 = rp->hash;
8951                         r192 = rp->rand;
8952                         h256 = NULL;
8953                         r256 = NULL;
8954                 }
8955         } else {
8956                 struct hci_rp_read_local_oob_ext_data *rp;
8957
8958                 if (skb->len != sizeof(*rp)) {
8959                         status = MGMT_STATUS_FAILED;
8960                         eir_len = 0;
8961                 } else {
8962                         status = MGMT_STATUS_SUCCESS;
8963                         rp = (void *)skb->data;
8964
8965                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8966                                 eir_len = 5 + 18 + 18;
8967                                 h192 = NULL;
8968                                 r192 = NULL;
8969                         } else {
8970                                 eir_len = 5 + 18 + 18 + 18 + 18;
8971                                 h192 = rp->hash192;
8972                                 r192 = rp->rand192;
8973                         }
8974
8975                         h256 = rp->hash256;
8976                         r256 = rp->rand256;
8977                 }
8978         }
8979
8980         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8981         if (!mgmt_rp)
8982                 goto done;
8983
8984         if (eir_len == 0)
8985                 goto send_rsp;
8986
8987         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8988                                   hdev->dev_class, 3);
8989
8990         if (h192 && r192) {
8991                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8992                                           EIR_SSP_HASH_C192, h192, 16);
8993                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8994                                           EIR_SSP_RAND_R192, r192, 16);
8995         }
8996
8997         if (h256 && r256) {
8998                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8999                                           EIR_SSP_HASH_C256, h256, 16);
9000                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
9001                                           EIR_SSP_RAND_R256, r256, 16);
9002         }
9003
9004 send_rsp:
9005         mgmt_rp->type = mgmt_cp->type;
9006         mgmt_rp->eir_len = cpu_to_le16(eir_len);
9007
9008         err = mgmt_cmd_complete(cmd->sk, hdev->id,
9009                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
9010                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
9011         if (err < 0 || status)
9012                 goto done;
9013
9014         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
9015
9016         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9017                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
9018                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
9019 done:
9020         kfree(mgmt_rp);
9021         mgmt_pending_remove(cmd);
9022 }
9023
9024 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
9025                                   struct mgmt_cp_read_local_oob_ext_data *cp)
9026 {
9027         struct mgmt_pending_cmd *cmd;
9028         struct hci_request req;
9029         int err;
9030
9031         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
9032                                cp, sizeof(*cp));
9033         if (!cmd)
9034                 return -ENOMEM;
9035
9036         hci_req_init(&req, hdev);
9037
9038         if (bredr_sc_enabled(hdev))
9039                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
9040         else
9041                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
9042
9043         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
9044         if (err < 0) {
9045                 mgmt_pending_remove(cmd);
9046                 return err;
9047         }
9048
9049         return 0;
9050 }
9051
9052 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
9053                                    void *data, u16 data_len)
9054 {
9055         struct mgmt_cp_read_local_oob_ext_data *cp = data;
9056         struct mgmt_rp_read_local_oob_ext_data *rp;
9057         size_t rp_len;
9058         u16 eir_len;
9059         u8 status, flags, role, addr[7], hash[16], rand[16];
9060         int err;
9061
9062         bt_dev_dbg(hdev, "sock %p", sk);
9063
9064         if (hdev_is_powered(hdev)) {
9065                 switch (cp->type) {
9066                 case BIT(BDADDR_BREDR):
9067                         status = mgmt_bredr_support(hdev);
9068                         if (status)
9069                                 eir_len = 0;
9070                         else
9071                                 eir_len = 5;
9072                         break;
9073                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9074                         status = mgmt_le_support(hdev);
9075                         if (status)
9076                                 eir_len = 0;
9077                         else
9078                                 eir_len = 9 + 3 + 18 + 18 + 3;
9079                         break;
9080                 default:
9081                         status = MGMT_STATUS_INVALID_PARAMS;
9082                         eir_len = 0;
9083                         break;
9084                 }
9085         } else {
9086                 status = MGMT_STATUS_NOT_POWERED;
9087                 eir_len = 0;
9088         }
9089
9090         rp_len = sizeof(*rp) + eir_len;
9091         rp = kmalloc(rp_len, GFP_ATOMIC);
9092         if (!rp)
9093                 return -ENOMEM;
9094
9095         if (status)
9096                 goto complete;
9097
9098         hci_dev_lock(hdev);
9099
9100         eir_len = 0;
9101         switch (cp->type) {
9102         case BIT(BDADDR_BREDR):
9103                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9104                         err = read_local_ssp_oob_req(hdev, sk, cp);
9105                         hci_dev_unlock(hdev);
9106                         if (!err)
9107                                 goto done;
9108
9109                         status = MGMT_STATUS_FAILED;
9110                         goto complete;
9111                 } else {
9112                         eir_len = eir_append_data(rp->eir, eir_len,
9113                                                   EIR_CLASS_OF_DEV,
9114                                                   hdev->dev_class, 3);
9115                 }
9116                 break;
9117         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
9118                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
9119                     smp_generate_oob(hdev, hash, rand) < 0) {
9120                         hci_dev_unlock(hdev);
9121                         status = MGMT_STATUS_FAILED;
9122                         goto complete;
9123                 }
9124
9125                 /* This should return the active RPA, but since the RPA
9126                  * is only programmed on demand, it is really hard to fill
9127                  * this in at the moment. For now disallow retrieving
9128                  * local out-of-band data when privacy is in use.
9129                  *
9130                  * Returning the identity address will not help here since
9131                  * pairing happens before the identity resolving key is
9132                  * known and thus the connection establishment happens
9133                  * based on the RPA and not the identity address.
9134                  */
9135                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
9136                         hci_dev_unlock(hdev);
9137                         status = MGMT_STATUS_REJECTED;
9138                         goto complete;
9139                 }
9140
9141                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
9142                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
9143                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
9144                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
9145                         memcpy(addr, &hdev->static_addr, 6);
9146                         addr[6] = 0x01;
9147                 } else {
9148                         memcpy(addr, &hdev->bdaddr, 6);
9149                         addr[6] = 0x00;
9150                 }
9151
9152                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
9153                                           addr, sizeof(addr));
9154
9155                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
9156                         role = 0x02;
9157                 else
9158                         role = 0x01;
9159
9160                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
9161                                           &role, sizeof(role));
9162
9163                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
9164                         eir_len = eir_append_data(rp->eir, eir_len,
9165                                                   EIR_LE_SC_CONFIRM,
9166                                                   hash, sizeof(hash));
9167
9168                         eir_len = eir_append_data(rp->eir, eir_len,
9169                                                   EIR_LE_SC_RANDOM,
9170                                                   rand, sizeof(rand));
9171                 }
9172
9173                 flags = mgmt_get_adv_discov_flags(hdev);
9174
9175                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9176                         flags |= LE_AD_NO_BREDR;
9177
9178                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
9179                                           &flags, sizeof(flags));
9180                 break;
9181         }
9182
9183         hci_dev_unlock(hdev);
9184
9185         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
9186
9187         status = MGMT_STATUS_SUCCESS;
9188
9189 complete:
9190         rp->type = cp->type;
9191         rp->eir_len = cpu_to_le16(eir_len);
9192
9193         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
9194                                 status, rp, sizeof(*rp) + eir_len);
9195         if (err < 0 || status)
9196                 goto done;
9197
9198         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
9199                                  rp, sizeof(*rp) + eir_len,
9200                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
9201
9202 done:
9203         kfree(rp);
9204
9205         return err;
9206 }
9207
9208 static u32 get_supported_adv_flags(struct hci_dev *hdev)
9209 {
9210         u32 flags = 0;
9211
9212         flags |= MGMT_ADV_FLAG_CONNECTABLE;
9213         flags |= MGMT_ADV_FLAG_DISCOV;
9214         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
9215         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
9216         flags |= MGMT_ADV_FLAG_APPEARANCE;
9217         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
9218         flags |= MGMT_ADV_PARAM_DURATION;
9219         flags |= MGMT_ADV_PARAM_TIMEOUT;
9220         flags |= MGMT_ADV_PARAM_INTERVALS;
9221         flags |= MGMT_ADV_PARAM_TX_POWER;
9222         flags |= MGMT_ADV_PARAM_SCAN_RSP;
9223
9224         /* In extended adv TX_POWER returned from Set Adv Param
9225          * will be always valid.
9226          */
9227         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
9228             ext_adv_capable(hdev))
9229                 flags |= MGMT_ADV_FLAG_TX_POWER;
9230
9231         if (ext_adv_capable(hdev)) {
9232                 flags |= MGMT_ADV_FLAG_SEC_1M;
9233                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
9234                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
9235
9236                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
9237                         flags |= MGMT_ADV_FLAG_SEC_2M;
9238
9239                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
9240                         flags |= MGMT_ADV_FLAG_SEC_CODED;
9241         }
9242
9243         return flags;
9244 }
9245
9246 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
9247                              void *data, u16 data_len)
9248 {
9249         struct mgmt_rp_read_adv_features *rp;
9250         size_t rp_len;
9251         int err;
9252         struct adv_info *adv_instance;
9253         u32 supported_flags;
9254         u8 *instance;
9255
9256         bt_dev_dbg(hdev, "sock %p", sk);
9257
9258         if (!lmp_le_capable(hdev))
9259                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9260                                        MGMT_STATUS_REJECTED);
9261
9262         /* Enabling the experimental LL Privay support disables support for
9263          * advertising.
9264          */
9265         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9266                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9267                                        MGMT_STATUS_NOT_SUPPORTED);
9268
9269         hci_dev_lock(hdev);
9270
9271         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
9272         rp = kmalloc(rp_len, GFP_ATOMIC);
9273         if (!rp) {
9274                 hci_dev_unlock(hdev);
9275                 return -ENOMEM;
9276         }
9277
9278         supported_flags = get_supported_adv_flags(hdev);
9279
9280         rp->supported_flags = cpu_to_le32(supported_flags);
9281         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
9282         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
9283         rp->max_instances = hdev->le_num_of_adv_sets;
9284         rp->num_instances = hdev->adv_instance_cnt;
9285
9286         instance = rp->instance;
9287         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
9288                 *instance = adv_instance->instance;
9289                 instance++;
9290         }
9291
9292         hci_dev_unlock(hdev);
9293
9294         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
9295                                 MGMT_STATUS_SUCCESS, rp, rp_len);
9296
9297         kfree(rp);
9298
9299         return err;
9300 }
9301
9302 static u8 calculate_name_len(struct hci_dev *hdev)
9303 {
9304         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
9305
9306         return append_local_name(hdev, buf, 0);
9307 }
9308
9309 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
9310                            bool is_adv_data)
9311 {
9312         u8 max_len = HCI_MAX_AD_LENGTH;
9313
9314         if (is_adv_data) {
9315                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
9316                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
9317                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
9318                         max_len -= 3;
9319
9320                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
9321                         max_len -= 3;
9322         } else {
9323                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
9324                         max_len -= calculate_name_len(hdev);
9325
9326                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
9327                         max_len -= 4;
9328         }
9329
9330         return max_len;
9331 }
9332
9333 static bool flags_managed(u32 adv_flags)
9334 {
9335         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
9336                             MGMT_ADV_FLAG_LIMITED_DISCOV |
9337                             MGMT_ADV_FLAG_MANAGED_FLAGS);
9338 }
9339
9340 static bool tx_power_managed(u32 adv_flags)
9341 {
9342         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
9343 }
9344
9345 static bool name_managed(u32 adv_flags)
9346 {
9347         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
9348 }
9349
9350 static bool appearance_managed(u32 adv_flags)
9351 {
9352         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
9353 }
9354
9355 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
9356                               u8 len, bool is_adv_data)
9357 {
9358         int i, cur_len;
9359         u8 max_len;
9360
9361         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
9362
9363         if (len > max_len)
9364                 return false;
9365
9366         /* Make sure that the data is correctly formatted. */
9367         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
9368                 cur_len = data[i];
9369
9370                 if (!cur_len)
9371                         continue;
9372
9373                 if (data[i + 1] == EIR_FLAGS &&
9374                     (!is_adv_data || flags_managed(adv_flags)))
9375                         return false;
9376
9377                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
9378                         return false;
9379
9380                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
9381                         return false;
9382
9383                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
9384                         return false;
9385
9386                 if (data[i + 1] == EIR_APPEARANCE &&
9387                     appearance_managed(adv_flags))
9388                         return false;
9389
9390                 /* If the current field length would exceed the total data
9391                  * length, then it's invalid.
9392                  */
9393                 if (i + cur_len >= len)
9394                         return false;
9395         }
9396
9397         return true;
9398 }
9399
9400 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
9401 {
9402         u32 supported_flags, phy_flags;
9403
9404         /* The current implementation only supports a subset of the specified
9405          * flags. Also need to check mutual exclusiveness of sec flags.
9406          */
9407         supported_flags = get_supported_adv_flags(hdev);
9408         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
9409         if (adv_flags & ~supported_flags ||
9410             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
9411                 return false;
9412
9413         return true;
9414 }
9415
9416 static bool adv_busy(struct hci_dev *hdev)
9417 {
9418         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
9419                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
9420                 pending_find(MGMT_OP_SET_LE, hdev) ||
9421                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
9422                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
9423 }
9424
9425 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
9426                                      u16 opcode)
9427 {
9428         struct mgmt_pending_cmd *cmd;
9429         struct mgmt_cp_add_advertising *cp;
9430         struct mgmt_rp_add_advertising rp;
9431         struct adv_info *adv_instance, *n;
9432         u8 instance;
9433
9434         bt_dev_dbg(hdev, "status %u", status);
9435
9436         hci_dev_lock(hdev);
9437
9438         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
9439         if (!cmd)
9440                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
9441
9442         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
9443                 if (!adv_instance->pending)
9444                         continue;
9445
9446                 if (!status) {
9447                         adv_instance->pending = false;
9448                         continue;
9449                 }
9450
9451                 instance = adv_instance->instance;
9452
9453                 if (hdev->cur_adv_instance == instance)
9454                         cancel_adv_timeout(hdev);
9455
9456                 hci_remove_adv_instance(hdev, instance);
9457                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
9458         }
9459
9460         if (!cmd)
9461                 goto unlock;
9462
9463         cp = cmd->param;
9464         rp.instance = cp->instance;
9465
9466         if (status)
9467                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9468                                 mgmt_status(status));
9469         else
9470                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9471                                   mgmt_status(status), &rp, sizeof(rp));
9472
9473         mgmt_pending_remove(cmd);
9474
9475 unlock:
9476         hci_dev_unlock(hdev);
9477 }
9478
9479 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
9480                            void *data, u16 data_len)
9481 {
9482         struct mgmt_cp_add_advertising *cp = data;
9483         struct mgmt_rp_add_advertising rp;
9484         u32 flags;
9485         u8 status;
9486         u16 timeout, duration;
9487         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
9488         u8 schedule_instance = 0;
9489         struct adv_info *next_instance;
9490         int err;
9491         struct mgmt_pending_cmd *cmd;
9492         struct hci_request req;
9493
9494         bt_dev_dbg(hdev, "sock %p", sk);
9495
9496         status = mgmt_le_support(hdev);
9497         if (status)
9498                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9499                                        status);
9500
9501         /* Enabling the experimental LL Privay support disables support for
9502          * advertising.
9503          */
9504         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
9505                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9506                                        MGMT_STATUS_NOT_SUPPORTED);
9507
9508         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9509                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9510                                        MGMT_STATUS_INVALID_PARAMS);
9511
9512         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9513                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9514                                        MGMT_STATUS_INVALID_PARAMS);
9515
9516         flags = __le32_to_cpu(cp->flags);
9517         timeout = __le16_to_cpu(cp->timeout);
9518         duration = __le16_to_cpu(cp->duration);
9519
9520         if (!requested_adv_flags_are_valid(hdev, flags))
9521                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9522                                        MGMT_STATUS_INVALID_PARAMS);
9523
9524         hci_dev_lock(hdev);
9525
9526         if (timeout && !hdev_is_powered(hdev)) {
9527                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9528                                       MGMT_STATUS_REJECTED);
9529                 goto unlock;
9530         }
9531
9532         if (adv_busy(hdev)) {
9533                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9534                                       MGMT_STATUS_BUSY);
9535                 goto unlock;
9536         }
9537
9538         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9539             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9540                                cp->scan_rsp_len, false)) {
9541                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9542                                       MGMT_STATUS_INVALID_PARAMS);
9543                 goto unlock;
9544         }
9545
9546         err = hci_add_adv_instance(hdev, cp->instance, flags,
9547                                    cp->adv_data_len, cp->data,
9548                                    cp->scan_rsp_len,
9549                                    cp->data + cp->adv_data_len,
9550                                    timeout, duration,
9551                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
9552                                    hdev->le_adv_min_interval,
9553                                    hdev->le_adv_max_interval);
9554         if (err < 0) {
9555                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9556                                       MGMT_STATUS_FAILED);
9557                 goto unlock;
9558         }
9559
9560         /* Only trigger an advertising added event if a new instance was
9561          * actually added.
9562          */
9563         if (hdev->adv_instance_cnt > prev_instance_cnt)
9564                 mgmt_advertising_added(sk, hdev, cp->instance);
9565
9566         if (hdev->cur_adv_instance == cp->instance) {
9567                 /* If the currently advertised instance is being changed then
9568                  * cancel the current advertising and schedule the next
9569                  * instance. If there is only one instance then the overridden
9570                  * advertising data will be visible right away.
9571                  */
9572                 cancel_adv_timeout(hdev);
9573
9574                 next_instance = hci_get_next_instance(hdev, cp->instance);
9575                 if (next_instance)
9576                         schedule_instance = next_instance->instance;
9577         } else if (!hdev->adv_instance_timeout) {
9578                 /* Immediately advertise the new instance if no other
9579                  * instance is currently being advertised.
9580                  */
9581                 schedule_instance = cp->instance;
9582         }
9583
9584         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9585          * there is no instance to be advertised then we have no HCI
9586          * communication to make. Simply return.
9587          */
9588         if (!hdev_is_powered(hdev) ||
9589             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9590             !schedule_instance) {
9591                 rp.instance = cp->instance;
9592                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9593                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9594                 goto unlock;
9595         }
9596
9597         /* We're good to go, update advertising data, parameters, and start
9598          * advertising.
9599          */
9600         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9601                                data_len);
9602         if (!cmd) {
9603                 err = -ENOMEM;
9604                 goto unlock;
9605         }
9606
9607         hci_req_init(&req, hdev);
9608
9609         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
9610
9611         if (!err)
9612                 err = hci_req_run(&req, add_advertising_complete);
9613
9614         if (err < 0) {
9615                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9616                                       MGMT_STATUS_FAILED);
9617                 mgmt_pending_remove(cmd);
9618         }
9619
9620 unlock:
9621         hci_dev_unlock(hdev);
9622
9623         return err;
9624 }
9625
9626 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
9627                                         u16 opcode)
9628 {
9629         struct mgmt_pending_cmd *cmd;
9630         struct mgmt_cp_add_ext_adv_params *cp;
9631         struct mgmt_rp_add_ext_adv_params rp;
9632         struct adv_info *adv_instance;
9633         u32 flags;
9634
9635         BT_DBG("%s", hdev->name);
9636
9637         hci_dev_lock(hdev);
9638
9639         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
9640         if (!cmd)
9641                 goto unlock;
9642
9643         cp = cmd->param;
9644         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9645         if (!adv_instance)
9646                 goto unlock;
9647
9648         rp.instance = cp->instance;
9649         rp.tx_power = adv_instance->tx_power;
9650
9651         /* While we're at it, inform userspace of the available space for this
9652          * advertisement, given the flags that will be used.
9653          */
9654         flags = __le32_to_cpu(cp->flags);
9655         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9656         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9657
9658         if (status) {
9659                 /* If this advertisement was previously advertising and we
9660                  * failed to update it, we signal that it has been removed and
9661                  * delete its structure
9662                  */
9663                 if (!adv_instance->pending)
9664                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
9665
9666                 hci_remove_adv_instance(hdev, cp->instance);
9667
9668                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
9669                                 mgmt_status(status));
9670
9671         } else {
9672                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
9673                                   mgmt_status(status), &rp, sizeof(rp));
9674         }
9675
9676 unlock:
9677         if (cmd)
9678                 mgmt_pending_remove(cmd);
9679
9680         hci_dev_unlock(hdev);
9681 }
9682
9683 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
9684                               void *data, u16 data_len)
9685 {
9686         struct mgmt_cp_add_ext_adv_params *cp = data;
9687         struct mgmt_rp_add_ext_adv_params rp;
9688         struct mgmt_pending_cmd *cmd = NULL;
9689         struct adv_info *adv_instance;
9690         struct hci_request req;
9691         u32 flags, min_interval, max_interval;
9692         u16 timeout, duration;
9693         u8 status;
9694         s8 tx_power;
9695         int err;
9696
9697         BT_DBG("%s", hdev->name);
9698
9699         status = mgmt_le_support(hdev);
9700         if (status)
9701                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9702                                        status);
9703
9704         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9705                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9706                                        MGMT_STATUS_INVALID_PARAMS);
9707
9708         /* The purpose of breaking add_advertising into two separate MGMT calls
9709          * for params and data is to allow more parameters to be added to this
9710          * structure in the future. For this reason, we verify that we have the
9711          * bare minimum structure we know of when the interface was defined. Any
9712          * extra parameters we don't know about will be ignored in this request.
9713          */
9714         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
9715                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9716                                        MGMT_STATUS_INVALID_PARAMS);
9717
9718         flags = __le32_to_cpu(cp->flags);
9719
9720         if (!requested_adv_flags_are_valid(hdev, flags))
9721                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9722                                        MGMT_STATUS_INVALID_PARAMS);
9723
9724         hci_dev_lock(hdev);
9725
9726         /* In new interface, we require that we are powered to register */
9727         if (!hdev_is_powered(hdev)) {
9728                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9729                                       MGMT_STATUS_REJECTED);
9730                 goto unlock;
9731         }
9732
9733         if (adv_busy(hdev)) {
9734                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9735                                       MGMT_STATUS_BUSY);
9736                 goto unlock;
9737         }
9738
9739         /* Parse defined parameters from request, use defaults otherwise */
9740         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
9741                   __le16_to_cpu(cp->timeout) : 0;
9742
9743         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
9744                    __le16_to_cpu(cp->duration) :
9745                    hdev->def_multi_adv_rotation_duration;
9746
9747         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9748                        __le32_to_cpu(cp->min_interval) :
9749                        hdev->le_adv_min_interval;
9750
9751         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9752                        __le32_to_cpu(cp->max_interval) :
9753                        hdev->le_adv_max_interval;
9754
9755         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
9756                    cp->tx_power :
9757                    HCI_ADV_TX_POWER_NO_PREFERENCE;
9758
9759         /* Create advertising instance with no advertising or response data */
9760         err = hci_add_adv_instance(hdev, cp->instance, flags,
9761                                    0, NULL, 0, NULL, timeout, duration,
9762                                    tx_power, min_interval, max_interval);
9763
9764         if (err < 0) {
9765                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9766                                       MGMT_STATUS_FAILED);
9767                 goto unlock;
9768         }
9769
9770         /* Submit request for advertising params if ext adv available */
9771         if (ext_adv_capable(hdev)) {
9772                 hci_req_init(&req, hdev);
9773                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
9774
9775                 /* Updating parameters of an active instance will return a
9776                  * Command Disallowed error, so we must first disable the
9777                  * instance if it is active.
9778                  */
9779                 if (!adv_instance->pending)
9780                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
9781
9782                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
9783
9784                 err = hci_req_run(&req, add_ext_adv_params_complete);
9785
9786                 if (!err)
9787                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
9788                                                hdev, data, data_len);
9789                 if (!cmd) {
9790                         err = -ENOMEM;
9791                         hci_remove_adv_instance(hdev, cp->instance);
9792                         goto unlock;
9793                 }
9794
9795         } else {
9796                 rp.instance = cp->instance;
9797                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
9798                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9799                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9800                 err = mgmt_cmd_complete(sk, hdev->id,
9801                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
9802                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9803         }
9804
9805 unlock:
9806         hci_dev_unlock(hdev);
9807
9808         return err;
9809 }
9810
9811 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
9812                             u16 data_len)
9813 {
9814         struct mgmt_cp_add_ext_adv_data *cp = data;
9815         struct mgmt_rp_add_ext_adv_data rp;
9816         u8 schedule_instance = 0;
9817         struct adv_info *next_instance;
9818         struct adv_info *adv_instance;
9819         int err = 0;
9820         struct mgmt_pending_cmd *cmd;
9821         struct hci_request req;
9822
9823         BT_DBG("%s", hdev->name);
9824
9825         hci_dev_lock(hdev);
9826
9827         adv_instance = hci_find_adv_instance(hdev, cp->instance);
9828
9829         if (!adv_instance) {
9830                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9831                                       MGMT_STATUS_INVALID_PARAMS);
9832                 goto unlock;
9833         }
9834
9835         /* In new interface, we require that we are powered to register */
9836         if (!hdev_is_powered(hdev)) {
9837                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9838                                       MGMT_STATUS_REJECTED);
9839                 goto clear_new_instance;
9840         }
9841
9842         if (adv_busy(hdev)) {
9843                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9844                                       MGMT_STATUS_BUSY);
9845                 goto clear_new_instance;
9846         }
9847
9848         /* Validate new data */
9849         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
9850                                cp->adv_data_len, true) ||
9851             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
9852                                cp->adv_data_len, cp->scan_rsp_len, false)) {
9853                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9854                                       MGMT_STATUS_INVALID_PARAMS);
9855                 goto clear_new_instance;
9856         }
9857
9858         /* Set the data in the advertising instance */
9859         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
9860                                   cp->data, cp->scan_rsp_len,
9861                                   cp->data + cp->adv_data_len);
9862
9863         /* We're good to go, update advertising data, parameters, and start
9864          * advertising.
9865          */
9866
9867         hci_req_init(&req, hdev);
9868
9869         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
9870
9871         if (ext_adv_capable(hdev)) {
9872                 __hci_req_update_adv_data(&req, cp->instance);
9873                 __hci_req_update_scan_rsp_data(&req, cp->instance);
9874                 __hci_req_enable_ext_advertising(&req, cp->instance);
9875
9876         } else {
9877                 /* If using software rotation, determine next instance to use */
9878
9879                 if (hdev->cur_adv_instance == cp->instance) {
9880                         /* If the currently advertised instance is being changed
9881                          * then cancel the current advertising and schedule the
9882                          * next instance. If there is only one instance then the
9883                          * overridden advertising data will be visible right
9884                          * away
9885                          */
9886                         cancel_adv_timeout(hdev);
9887
9888                         next_instance = hci_get_next_instance(hdev,
9889                                                               cp->instance);
9890                         if (next_instance)
9891                                 schedule_instance = next_instance->instance;
9892                 } else if (!hdev->adv_instance_timeout) {
9893                         /* Immediately advertise the new instance if no other
9894                          * instance is currently being advertised.
9895                          */
9896                         schedule_instance = cp->instance;
9897                 }
9898
9899                 /* If the HCI_ADVERTISING flag is set or there is no instance to
9900                  * be advertised then we have no HCI communication to make.
9901                  * Simply return.
9902                  */
9903                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9904                     !schedule_instance) {
9905                         if (adv_instance->pending) {
9906                                 mgmt_advertising_added(sk, hdev, cp->instance);
9907                                 adv_instance->pending = false;
9908                         }
9909                         rp.instance = cp->instance;
9910                         err = mgmt_cmd_complete(sk, hdev->id,
9911                                                 MGMT_OP_ADD_EXT_ADV_DATA,
9912                                                 MGMT_STATUS_SUCCESS, &rp,
9913                                                 sizeof(rp));
9914                         goto unlock;
9915                 }
9916
9917                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
9918                                                       true);
9919         }
9920
9921         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
9922                                data_len);
9923         if (!cmd) {
9924                 err = -ENOMEM;
9925                 goto clear_new_instance;
9926         }
9927
9928         if (!err)
9929                 err = hci_req_run(&req, add_advertising_complete);
9930
9931         if (err < 0) {
9932                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9933                                       MGMT_STATUS_FAILED);
9934                 mgmt_pending_remove(cmd);
9935                 goto clear_new_instance;
9936         }
9937
9938         /* We were successful in updating data, so trigger advertising_added
9939          * event if this is an instance that wasn't previously advertising. If
9940          * a failure occurs in the requests we initiated, we will remove the
9941          * instance again in add_advertising_complete
9942          */
9943         if (adv_instance->pending)
9944                 mgmt_advertising_added(sk, hdev, cp->instance);
9945
9946         goto unlock;
9947
9948 clear_new_instance:
9949         hci_remove_adv_instance(hdev, cp->instance);
9950
9951 unlock:
9952         hci_dev_unlock(hdev);
9953
9954         return err;
9955 }
9956
9957 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
9958                                         u16 opcode)
9959 {
9960         struct mgmt_pending_cmd *cmd;
9961         struct mgmt_cp_remove_advertising *cp;
9962         struct mgmt_rp_remove_advertising rp;
9963
9964         bt_dev_dbg(hdev, "status %u", status);
9965
9966         hci_dev_lock(hdev);
9967
9968         /* A failure status here only means that we failed to disable
9969          * advertising. Otherwise, the advertising instance has been removed,
9970          * so report success.
9971          */
9972         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
9973         if (!cmd)
9974                 goto unlock;
9975
9976         cp = cmd->param;
9977         rp.instance = cp->instance;
9978
9979         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
9980                           &rp, sizeof(rp));
9981         mgmt_pending_remove(cmd);
9982
9983 unlock:
9984         hci_dev_unlock(hdev);
9985 }
9986
9987 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9988                               void *data, u16 data_len)
9989 {
9990         struct mgmt_cp_remove_advertising *cp = data;
9991         struct mgmt_rp_remove_advertising rp;
9992         struct mgmt_pending_cmd *cmd;
9993         struct hci_request req;
9994         int err;
9995
9996         bt_dev_dbg(hdev, "sock %p", sk);
9997
9998         /* Enabling the experimental LL Privay support disables support for
9999          * advertising.
10000          */
10001         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
10002                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
10003                                        MGMT_STATUS_NOT_SUPPORTED);
10004
10005         hci_dev_lock(hdev);
10006
10007         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
10008                 err = mgmt_cmd_status(sk, hdev->id,
10009                                       MGMT_OP_REMOVE_ADVERTISING,
10010                                       MGMT_STATUS_INVALID_PARAMS);
10011                 goto unlock;
10012         }
10013
10014         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
10015             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
10016             pending_find(MGMT_OP_SET_LE, hdev)) {
10017                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10018                                       MGMT_STATUS_BUSY);
10019                 goto unlock;
10020         }
10021
10022         if (list_empty(&hdev->adv_instances)) {
10023                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
10024                                       MGMT_STATUS_INVALID_PARAMS);
10025                 goto unlock;
10026         }
10027
10028         hci_req_init(&req, hdev);
10029
10030         /* If we use extended advertising, instance is disabled and removed */
10031         if (ext_adv_capable(hdev)) {
10032                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
10033                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
10034         }
10035
10036         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
10037
10038         if (list_empty(&hdev->adv_instances))
10039                 __hci_req_disable_advertising(&req);
10040
10041         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
10042          * flag is set or the device isn't powered then we have no HCI
10043          * communication to make. Simply return.
10044          */
10045         if (skb_queue_empty(&req.cmd_q) ||
10046             !hdev_is_powered(hdev) ||
10047             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
10048                 hci_req_purge(&req);
10049                 rp.instance = cp->instance;
10050                 err = mgmt_cmd_complete(sk, hdev->id,
10051                                         MGMT_OP_REMOVE_ADVERTISING,
10052                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10053                 goto unlock;
10054         }
10055
10056         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
10057                                data_len);
10058         if (!cmd) {
10059                 err = -ENOMEM;
10060                 goto unlock;
10061         }
10062
10063         err = hci_req_run(&req, remove_advertising_complete);
10064         if (err < 0)
10065                 mgmt_pending_remove(cmd);
10066
10067 unlock:
10068         hci_dev_unlock(hdev);
10069
10070         return err;
10071 }
10072
10073 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
10074                              void *data, u16 data_len)
10075 {
10076         struct mgmt_cp_get_adv_size_info *cp = data;
10077         struct mgmt_rp_get_adv_size_info rp;
10078         u32 flags, supported_flags;
10079         int err;
10080
10081         bt_dev_dbg(hdev, "sock %p", sk);
10082
10083         if (!lmp_le_capable(hdev))
10084                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10085                                        MGMT_STATUS_REJECTED);
10086
10087         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
10088                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10089                                        MGMT_STATUS_INVALID_PARAMS);
10090
10091         flags = __le32_to_cpu(cp->flags);
10092
10093         /* The current implementation only supports a subset of the specified
10094          * flags.
10095          */
10096         supported_flags = get_supported_adv_flags(hdev);
10097         if (flags & ~supported_flags)
10098                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10099                                        MGMT_STATUS_INVALID_PARAMS);
10100
10101         rp.instance = cp->instance;
10102         rp.flags = cp->flags;
10103         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
10104         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
10105
10106         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
10107                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
10108
10109         return err;
10110 }
10111
10112 static const struct hci_mgmt_handler mgmt_handlers[] = {
10113         { NULL }, /* 0x0000 (no command) */
10114         { read_version,            MGMT_READ_VERSION_SIZE,
10115                                                 HCI_MGMT_NO_HDEV |
10116                                                 HCI_MGMT_UNTRUSTED },
10117         { read_commands,           MGMT_READ_COMMANDS_SIZE,
10118                                                 HCI_MGMT_NO_HDEV |
10119                                                 HCI_MGMT_UNTRUSTED },
10120         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
10121                                                 HCI_MGMT_NO_HDEV |
10122                                                 HCI_MGMT_UNTRUSTED },
10123         { read_controller_info,    MGMT_READ_INFO_SIZE,
10124                                                 HCI_MGMT_UNTRUSTED },
10125         { set_powered,             MGMT_SETTING_SIZE },
10126         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
10127         { set_connectable,         MGMT_SETTING_SIZE },
10128         { set_fast_connectable,    MGMT_SETTING_SIZE },
10129         { set_bondable,            MGMT_SETTING_SIZE },
10130         { set_link_security,       MGMT_SETTING_SIZE },
10131         { set_ssp,                 MGMT_SETTING_SIZE },
10132         { set_hs,                  MGMT_SETTING_SIZE },
10133         { set_le,                  MGMT_SETTING_SIZE },
10134         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
10135         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
10136         { add_uuid,                MGMT_ADD_UUID_SIZE },
10137         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
10138         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
10139                                                 HCI_MGMT_VAR_LEN },
10140         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
10141                                                 HCI_MGMT_VAR_LEN },
10142         { disconnect,              MGMT_DISCONNECT_SIZE },
10143         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
10144         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
10145         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
10146         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
10147         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
10148         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
10149         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
10150         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
10151         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
10152         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
10153         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
10154         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
10155         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
10156                                                 HCI_MGMT_VAR_LEN },
10157         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
10158         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
10159         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
10160         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
10161         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
10162         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
10163         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
10164         { set_advertising,         MGMT_SETTING_SIZE },
10165         { set_bredr,               MGMT_SETTING_SIZE },
10166         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
10167         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
10168         { set_secure_conn,         MGMT_SETTING_SIZE },
10169         { set_debug_keys,          MGMT_SETTING_SIZE },
10170         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
10171         { load_irks,               MGMT_LOAD_IRKS_SIZE,
10172                                                 HCI_MGMT_VAR_LEN },
10173         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
10174         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
10175         { add_device,              MGMT_ADD_DEVICE_SIZE },
10176         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
10177         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
10178                                                 HCI_MGMT_VAR_LEN },
10179         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
10180                                                 HCI_MGMT_NO_HDEV |
10181                                                 HCI_MGMT_UNTRUSTED },
10182         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
10183                                                 HCI_MGMT_UNCONFIGURED |
10184                                                 HCI_MGMT_UNTRUSTED },
10185         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
10186                                                 HCI_MGMT_UNCONFIGURED },
10187         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
10188                                                 HCI_MGMT_UNCONFIGURED },
10189         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
10190                                                 HCI_MGMT_VAR_LEN },
10191         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
10192         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
10193                                                 HCI_MGMT_NO_HDEV |
10194                                                 HCI_MGMT_UNTRUSTED },
10195         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
10196         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
10197                                                 HCI_MGMT_VAR_LEN },
10198         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
10199         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
10200         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
10201         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
10202                                                 HCI_MGMT_UNTRUSTED },
10203         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
10204         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
10205         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
10206         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
10207                                                 HCI_MGMT_VAR_LEN },
10208         { set_wideband_speech,     MGMT_SETTING_SIZE },
10209         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
10210                                                 HCI_MGMT_UNTRUSTED },
10211         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
10212                                                 HCI_MGMT_UNTRUSTED |
10213                                                 HCI_MGMT_HDEV_OPTIONAL },
10214         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
10215                                                 HCI_MGMT_VAR_LEN |
10216                                                 HCI_MGMT_HDEV_OPTIONAL },
10217         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
10218                                                 HCI_MGMT_UNTRUSTED },
10219         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
10220                                                 HCI_MGMT_VAR_LEN },
10221         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
10222                                                 HCI_MGMT_UNTRUSTED },
10223         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
10224                                                 HCI_MGMT_VAR_LEN },
10225         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
10226         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
10227         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
10228         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
10229                                                 HCI_MGMT_VAR_LEN },
10230         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
10231         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
10232                                                 HCI_MGMT_VAR_LEN },
10233         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
10234                                                 HCI_MGMT_VAR_LEN },
10235         { add_adv_patterns_monitor_rssi,
10236                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
10237                                                 HCI_MGMT_VAR_LEN },
10238 };
10239
10240 #ifdef TIZEN_BT
10241 static const struct hci_mgmt_handler tizen_mgmt_handlers[] = {
10242         { NULL }, /* 0x0000 (no command) */
10243         { set_advertising_params,  MGMT_SET_ADVERTISING_PARAMS_SIZE },
10244         { set_advertising_data,    MGMT_SET_ADV_MIN_APP_DATA_SIZE,
10245                                                 HCI_MGMT_VAR_LEN },
10246         { set_scan_rsp_data,       MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE,
10247                                                 HCI_MGMT_VAR_LEN },
10248         { add_white_list,          MGMT_ADD_DEV_WHITE_LIST_SIZE },
10249         { remove_from_white_list,  MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
10250         { clear_white_list,        MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
10251         { set_enable_rssi,         MGMT_SET_RSSI_ENABLE_SIZE },
10252         { get_raw_rssi,            MGMT_GET_RAW_RSSI_SIZE },
10253         { set_disable_threshold,   MGMT_SET_RSSI_DISABLE_SIZE },
10254         { start_le_discovery,      MGMT_START_LE_DISCOVERY_SIZE },
10255         { stop_le_discovery,       MGMT_STOP_LE_DISCOVERY_SIZE },
10256         { disable_le_auto_connect, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
10257         { le_conn_update,          MGMT_LE_CONN_UPDATE_SIZE },
10258         { set_manufacturer_data,   MGMT_SET_MANUFACTURER_DATA_SIZE },
10259         { le_set_scan_params,      MGMT_LE_SET_SCAN_PARAMS_SIZE },
10260 };
10261 #endif
10262
10263 void mgmt_index_added(struct hci_dev *hdev)
10264 {
10265         struct mgmt_ev_ext_index ev;
10266
10267         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10268                 return;
10269
10270         switch (hdev->dev_type) {
10271         case HCI_PRIMARY:
10272                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10273                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
10274                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10275                         ev.type = 0x01;
10276                 } else {
10277                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
10278                                          HCI_MGMT_INDEX_EVENTS);
10279                         ev.type = 0x00;
10280                 }
10281                 break;
10282         case HCI_AMP:
10283                 ev.type = 0x02;
10284                 break;
10285         default:
10286                 return;
10287         }
10288
10289         ev.bus = hdev->bus;
10290
10291         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
10292                          HCI_MGMT_EXT_INDEX_EVENTS);
10293 }
10294
10295 void mgmt_index_removed(struct hci_dev *hdev)
10296 {
10297         struct mgmt_ev_ext_index ev;
10298         u8 status = MGMT_STATUS_INVALID_INDEX;
10299
10300         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
10301                 return;
10302
10303         switch (hdev->dev_type) {
10304         case HCI_PRIMARY:
10305                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10306
10307                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
10308                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
10309                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
10310                         ev.type = 0x01;
10311                 } else {
10312                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
10313                                          HCI_MGMT_INDEX_EVENTS);
10314                         ev.type = 0x00;
10315                 }
10316                 break;
10317         case HCI_AMP:
10318                 ev.type = 0x02;
10319                 break;
10320         default:
10321                 return;
10322         }
10323
10324         ev.bus = hdev->bus;
10325
10326         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
10327                          HCI_MGMT_EXT_INDEX_EVENTS);
10328 }
10329
10330 /* This function requires the caller holds hdev->lock */
10331 static void restart_le_actions(struct hci_dev *hdev)
10332 {
10333         struct hci_conn_params *p;
10334
10335         list_for_each_entry(p, &hdev->le_conn_params, list) {
10336                 /* Needed for AUTO_OFF case where might not "really"
10337                  * have been powered off.
10338                  */
10339                 list_del_init(&p->action);
10340
10341                 switch (p->auto_connect) {
10342                 case HCI_AUTO_CONN_DIRECT:
10343                 case HCI_AUTO_CONN_ALWAYS:
10344                         list_add(&p->action, &hdev->pend_le_conns);
10345                         break;
10346                 case HCI_AUTO_CONN_REPORT:
10347                         list_add(&p->action, &hdev->pend_le_reports);
10348                         break;
10349                 default:
10350                         break;
10351                 }
10352         }
10353 }
10354
10355 void mgmt_power_on(struct hci_dev *hdev, int err)
10356 {
10357         struct cmd_lookup match = { NULL, hdev };
10358
10359         bt_dev_dbg(hdev, "err %d", err);
10360
10361         hci_dev_lock(hdev);
10362
10363         if (!err) {
10364                 restart_le_actions(hdev);
10365                 hci_update_background_scan(hdev);
10366         }
10367
10368         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10369
10370         new_settings(hdev, match.sk);
10371
10372         if (match.sk)
10373                 sock_put(match.sk);
10374
10375         hci_dev_unlock(hdev);
10376 }
10377
10378 void __mgmt_power_off(struct hci_dev *hdev)
10379 {
10380         struct cmd_lookup match = { NULL, hdev };
10381         u8 status, zero_cod[] = { 0, 0, 0 };
10382
10383         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
10384
10385         /* If the power off is because of hdev unregistration let
10386          * use the appropriate INVALID_INDEX status. Otherwise use
10387          * NOT_POWERED. We cover both scenarios here since later in
10388          * mgmt_index_removed() any hci_conn callbacks will have already
10389          * been triggered, potentially causing misleading DISCONNECTED
10390          * status responses.
10391          */
10392         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
10393                 status = MGMT_STATUS_INVALID_INDEX;
10394         else
10395                 status = MGMT_STATUS_NOT_POWERED;
10396
10397         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
10398
10399         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
10400                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
10401                                    zero_cod, sizeof(zero_cod),
10402                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10403                 ext_info_changed(hdev, NULL);
10404         }
10405
10406         new_settings(hdev, match.sk);
10407
10408         if (match.sk)
10409                 sock_put(match.sk);
10410 }
10411
10412 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
10413 {
10414         struct mgmt_pending_cmd *cmd;
10415         u8 status;
10416
10417         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10418         if (!cmd)
10419                 return;
10420
10421         if (err == -ERFKILL)
10422                 status = MGMT_STATUS_RFKILLED;
10423         else
10424                 status = MGMT_STATUS_FAILED;
10425
10426         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
10427
10428         mgmt_pending_remove(cmd);
10429 }
10430
10431 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
10432                        bool persistent)
10433 {
10434         struct mgmt_ev_new_link_key ev;
10435
10436         memset(&ev, 0, sizeof(ev));
10437
10438         ev.store_hint = persistent;
10439         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10440         ev.key.addr.type = BDADDR_BREDR;
10441         ev.key.type = key->type;
10442         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
10443         ev.key.pin_len = key->pin_len;
10444
10445         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
10446 }
10447
10448 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
10449 {
10450         switch (ltk->type) {
10451         case SMP_LTK:
10452         case SMP_LTK_RESPONDER:
10453                 if (ltk->authenticated)
10454                         return MGMT_LTK_AUTHENTICATED;
10455                 return MGMT_LTK_UNAUTHENTICATED;
10456         case SMP_LTK_P256:
10457                 if (ltk->authenticated)
10458                         return MGMT_LTK_P256_AUTH;
10459                 return MGMT_LTK_P256_UNAUTH;
10460         case SMP_LTK_P256_DEBUG:
10461                 return MGMT_LTK_P256_DEBUG;
10462         }
10463
10464         return MGMT_LTK_UNAUTHENTICATED;
10465 }
10466
10467 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
10468 {
10469         struct mgmt_ev_new_long_term_key ev;
10470
10471         memset(&ev, 0, sizeof(ev));
10472
10473         /* Devices using resolvable or non-resolvable random addresses
10474          * without providing an identity resolving key don't require
10475          * to store long term keys. Their addresses will change the
10476          * next time around.
10477          *
10478          * Only when a remote device provides an identity address
10479          * make sure the long term key is stored. If the remote
10480          * identity is known, the long term keys are internally
10481          * mapped to the identity address. So allow static random
10482          * and public addresses here.
10483          */
10484         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10485             (key->bdaddr.b[5] & 0xc0) != 0xc0)
10486                 ev.store_hint = 0x00;
10487         else
10488                 ev.store_hint = persistent;
10489
10490         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
10491         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
10492         ev.key.type = mgmt_ltk_type(key);
10493         ev.key.enc_size = key->enc_size;
10494         ev.key.ediv = key->ediv;
10495         ev.key.rand = key->rand;
10496
10497         if (key->type == SMP_LTK)
10498                 ev.key.initiator = 1;
10499
10500         /* Make sure we copy only the significant bytes based on the
10501          * encryption key size, and set the rest of the value to zeroes.
10502          */
10503         memcpy(ev.key.val, key->val, key->enc_size);
10504         memset(ev.key.val + key->enc_size, 0,
10505                sizeof(ev.key.val) - key->enc_size);
10506
10507         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
10508 }
10509
10510 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
10511 {
10512         struct mgmt_ev_new_irk ev;
10513
10514         memset(&ev, 0, sizeof(ev));
10515
10516         ev.store_hint = persistent;
10517
10518         bacpy(&ev.rpa, &irk->rpa);
10519         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
10520         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
10521         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
10522
10523         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
10524 }
10525
10526 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
10527                    bool persistent)
10528 {
10529         struct mgmt_ev_new_csrk ev;
10530
10531         memset(&ev, 0, sizeof(ev));
10532
10533         /* Devices using resolvable or non-resolvable random addresses
10534          * without providing an identity resolving key don't require
10535          * to store signature resolving keys. Their addresses will change
10536          * the next time around.
10537          *
10538          * Only when a remote device provides an identity address
10539          * make sure the signature resolving key is stored. So allow
10540          * static random and public addresses here.
10541          */
10542         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
10543             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
10544                 ev.store_hint = 0x00;
10545         else
10546                 ev.store_hint = persistent;
10547
10548         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
10549         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
10550         ev.key.type = csrk->type;
10551         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
10552
10553         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
10554 }
10555
10556 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
10557                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
10558                          u16 max_interval, u16 latency, u16 timeout)
10559 {
10560         struct mgmt_ev_new_conn_param ev;
10561
10562         if (!hci_is_identity_address(bdaddr, bdaddr_type))
10563                 return;
10564
10565         memset(&ev, 0, sizeof(ev));
10566         bacpy(&ev.addr.bdaddr, bdaddr);
10567         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
10568         ev.store_hint = store_hint;
10569         ev.min_interval = cpu_to_le16(min_interval);
10570         ev.max_interval = cpu_to_le16(max_interval);
10571         ev.latency = cpu_to_le16(latency);
10572         ev.timeout = cpu_to_le16(timeout);
10573
10574         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
10575 }
10576
10577 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
10578                            u8 *name, u8 name_len)
10579 {
10580         char buf[512];
10581         struct mgmt_ev_device_connected *ev = (void *) buf;
10582         u16 eir_len = 0;
10583         u32 flags = 0;
10584
10585         bacpy(&ev->addr.bdaddr, &conn->dst);
10586         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10587
10588         if (conn->out)
10589                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
10590
10591         ev->flags = __cpu_to_le32(flags);
10592
10593         /* We must ensure that the EIR Data fields are ordered and
10594          * unique. Keep it simple for now and avoid the problem by not
10595          * adding any BR/EDR data to the LE adv.
10596          */
10597         if (conn->le_adv_data_len > 0) {
10598                 memcpy(&ev->eir[eir_len],
10599                        conn->le_adv_data, conn->le_adv_data_len);
10600                 eir_len = conn->le_adv_data_len;
10601         } else {
10602                 if (name_len > 0)
10603                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
10604                                                   name, name_len);
10605
10606                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
10607                         eir_len = eir_append_data(ev->eir, eir_len,
10608                                                   EIR_CLASS_OF_DEV,
10609                                                   conn->dev_class, 3);
10610         }
10611
10612         ev->eir_len = cpu_to_le16(eir_len);
10613
10614         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
10615                     sizeof(*ev) + eir_len, NULL);
10616 }
10617
10618 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
10619 {
10620         struct sock **sk = data;
10621
10622         cmd->cmd_complete(cmd, 0);
10623
10624         *sk = cmd->sk;
10625         sock_hold(*sk);
10626
10627         mgmt_pending_remove(cmd);
10628 }
10629
10630 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
10631 {
10632         struct hci_dev *hdev = data;
10633         struct mgmt_cp_unpair_device *cp = cmd->param;
10634
10635         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
10636
10637         cmd->cmd_complete(cmd, 0);
10638         mgmt_pending_remove(cmd);
10639 }
10640
10641 bool mgmt_powering_down(struct hci_dev *hdev)
10642 {
10643         struct mgmt_pending_cmd *cmd;
10644         struct mgmt_mode *cp;
10645
10646         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10647         if (!cmd)
10648                 return false;
10649
10650         cp = cmd->param;
10651         if (!cp->val)
10652                 return true;
10653
10654         return false;
10655 }
10656
10657 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10658                               u8 link_type, u8 addr_type, u8 reason,
10659                               bool mgmt_connected)
10660 {
10661         struct mgmt_ev_device_disconnected ev;
10662         struct sock *sk = NULL;
10663
10664         /* The connection is still in hci_conn_hash so test for 1
10665          * instead of 0 to know if this is the last one.
10666          */
10667         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10668                 cancel_delayed_work(&hdev->power_off);
10669                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10670         }
10671
10672         if (!mgmt_connected)
10673                 return;
10674
10675         if (link_type != ACL_LINK && link_type != LE_LINK)
10676                 return;
10677
10678         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
10679
10680         bacpy(&ev.addr.bdaddr, bdaddr);
10681         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10682         ev.reason = reason;
10683
10684         /* Report disconnects due to suspend */
10685         if (hdev->suspended)
10686                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10687
10688         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10689
10690         if (sk)
10691                 sock_put(sk);
10692
10693         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10694                              hdev);
10695 }
10696
10697 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10698                             u8 link_type, u8 addr_type, u8 status)
10699 {
10700         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10701         struct mgmt_cp_disconnect *cp;
10702         struct mgmt_pending_cmd *cmd;
10703
10704         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
10705                              hdev);
10706
10707         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10708         if (!cmd)
10709                 return;
10710
10711         cp = cmd->param;
10712
10713         if (bacmp(bdaddr, &cp->addr.bdaddr))
10714                 return;
10715
10716         if (cp->addr.type != bdaddr_type)
10717                 return;
10718
10719         cmd->cmd_complete(cmd, mgmt_status(status));
10720         mgmt_pending_remove(cmd);
10721 }
10722
10723 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10724                          u8 addr_type, u8 status)
10725 {
10726         struct mgmt_ev_connect_failed ev;
10727
10728         /* The connection is still in hci_conn_hash so test for 1
10729          * instead of 0 to know if this is the last one.
10730          */
10731         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
10732                 cancel_delayed_work(&hdev->power_off);
10733                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
10734         }
10735
10736         bacpy(&ev.addr.bdaddr, bdaddr);
10737         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10738         ev.status = mgmt_status(status);
10739
10740         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
10741 }
10742
10743 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
10744 {
10745         struct mgmt_ev_pin_code_request ev;
10746
10747         bacpy(&ev.addr.bdaddr, bdaddr);
10748         ev.addr.type = BDADDR_BREDR;
10749         ev.secure = secure;
10750
10751         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
10752 }
10753
10754 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10755                                   u8 status)
10756 {
10757         struct mgmt_pending_cmd *cmd;
10758
10759         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
10760         if (!cmd)
10761                 return;
10762
10763         cmd->cmd_complete(cmd, mgmt_status(status));
10764         mgmt_pending_remove(cmd);
10765 }
10766
10767 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10768                                       u8 status)
10769 {
10770         struct mgmt_pending_cmd *cmd;
10771
10772         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
10773         if (!cmd)
10774                 return;
10775
10776         cmd->cmd_complete(cmd, mgmt_status(status));
10777         mgmt_pending_remove(cmd);
10778 }
10779
10780 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10781                               u8 link_type, u8 addr_type, u32 value,
10782                               u8 confirm_hint)
10783 {
10784         struct mgmt_ev_user_confirm_request ev;
10785
10786         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10787
10788         bacpy(&ev.addr.bdaddr, bdaddr);
10789         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10790         ev.confirm_hint = confirm_hint;
10791         ev.value = cpu_to_le32(value);
10792
10793         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
10794                           NULL);
10795 }
10796
10797 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10798                               u8 link_type, u8 addr_type)
10799 {
10800         struct mgmt_ev_user_passkey_request ev;
10801
10802         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10803
10804         bacpy(&ev.addr.bdaddr, bdaddr);
10805         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10806
10807         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
10808                           NULL);
10809 }
10810
10811 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10812                                       u8 link_type, u8 addr_type, u8 status,
10813                                       u8 opcode)
10814 {
10815         struct mgmt_pending_cmd *cmd;
10816
10817         cmd = pending_find(opcode, hdev);
10818         if (!cmd)
10819                 return -ENOENT;
10820
10821         cmd->cmd_complete(cmd, mgmt_status(status));
10822         mgmt_pending_remove(cmd);
10823
10824         return 0;
10825 }
10826
10827 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10828                                      u8 link_type, u8 addr_type, u8 status)
10829 {
10830         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10831                                           status, MGMT_OP_USER_CONFIRM_REPLY);
10832 }
10833
10834 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10835                                          u8 link_type, u8 addr_type, u8 status)
10836 {
10837         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10838                                           status,
10839                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
10840 }
10841
10842 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10843                                      u8 link_type, u8 addr_type, u8 status)
10844 {
10845         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10846                                           status, MGMT_OP_USER_PASSKEY_REPLY);
10847 }
10848
10849 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10850                                          u8 link_type, u8 addr_type, u8 status)
10851 {
10852         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10853                                           status,
10854                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
10855 }
10856
10857 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
10858                              u8 link_type, u8 addr_type, u32 passkey,
10859                              u8 entered)
10860 {
10861         struct mgmt_ev_passkey_notify ev;
10862
10863         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10864
10865         bacpy(&ev.addr.bdaddr, bdaddr);
10866         ev.addr.type = link_to_bdaddr(link_type, addr_type);
10867         ev.passkey = __cpu_to_le32(passkey);
10868         ev.entered = entered;
10869
10870         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
10871 }
10872
10873 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
10874 {
10875         struct mgmt_ev_auth_failed ev;
10876         struct mgmt_pending_cmd *cmd;
10877         u8 status = mgmt_status(hci_status);
10878
10879         bacpy(&ev.addr.bdaddr, &conn->dst);
10880         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10881         ev.status = status;
10882
10883         cmd = find_pairing(conn);
10884
10885         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
10886                     cmd ? cmd->sk : NULL);
10887
10888         if (cmd) {
10889                 cmd->cmd_complete(cmd, status);
10890                 mgmt_pending_remove(cmd);
10891         }
10892 }
10893
10894 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
10895 {
10896         struct cmd_lookup match = { NULL, hdev };
10897         bool changed;
10898
10899         if (status) {
10900                 u8 mgmt_err = mgmt_status(status);
10901                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
10902                                      cmd_status_rsp, &mgmt_err);
10903                 return;
10904         }
10905
10906         if (test_bit(HCI_AUTH, &hdev->flags))
10907                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
10908         else
10909                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
10910
10911         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
10912                              &match);
10913
10914         if (changed)
10915                 new_settings(hdev, match.sk);
10916
10917         if (match.sk)
10918                 sock_put(match.sk);
10919 }
10920
10921 static void clear_eir(struct hci_request *req)
10922 {
10923         struct hci_dev *hdev = req->hdev;
10924         struct hci_cp_write_eir cp;
10925
10926         if (!lmp_ext_inq_capable(hdev))
10927                 return;
10928
10929         memset(hdev->eir, 0, sizeof(hdev->eir));
10930
10931         memset(&cp, 0, sizeof(cp));
10932
10933         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
10934 }
10935
10936 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
10937 {
10938         struct cmd_lookup match = { NULL, hdev };
10939         struct hci_request req;
10940         bool changed = false;
10941
10942         if (status) {
10943                 u8 mgmt_err = mgmt_status(status);
10944
10945                 if (enable && hci_dev_test_and_clear_flag(hdev,
10946                                                           HCI_SSP_ENABLED)) {
10947                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
10948                         new_settings(hdev, NULL);
10949                 }
10950
10951                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
10952                                      &mgmt_err);
10953                 return;
10954         }
10955
10956         if (enable) {
10957                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
10958         } else {
10959                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
10960                 if (!changed)
10961                         changed = hci_dev_test_and_clear_flag(hdev,
10962                                                               HCI_HS_ENABLED);
10963                 else
10964                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
10965         }
10966
10967         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
10968
10969         if (changed)
10970                 new_settings(hdev, match.sk);
10971
10972         if (match.sk)
10973                 sock_put(match.sk);
10974
10975         hci_req_init(&req, hdev);
10976
10977         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
10978                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
10979                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
10980                                     sizeof(enable), &enable);
10981                 __hci_req_update_eir(&req);
10982         } else {
10983                 clear_eir(&req);
10984         }
10985
10986         hci_req_run(&req, NULL);
10987 }
10988
10989 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
10990 {
10991         struct cmd_lookup *match = data;
10992
10993         if (match->sk == NULL) {
10994                 match->sk = cmd->sk;
10995                 sock_hold(match->sk);
10996         }
10997 }
10998
10999 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
11000                                     u8 status)
11001 {
11002         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
11003
11004         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
11005         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
11006         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
11007
11008         if (!status) {
11009                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
11010                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
11011                 ext_info_changed(hdev, NULL);
11012         }
11013
11014         if (match.sk)
11015                 sock_put(match.sk);
11016 }
11017
11018 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
11019 {
11020         struct mgmt_cp_set_local_name ev;
11021         struct mgmt_pending_cmd *cmd;
11022
11023         if (status)
11024                 return;
11025
11026         memset(&ev, 0, sizeof(ev));
11027         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
11028         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
11029
11030         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
11031         if (!cmd) {
11032                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
11033
11034                 /* If this is a HCI command related to powering on the
11035                  * HCI dev don't send any mgmt signals.
11036                  */
11037                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
11038                         return;
11039         }
11040
11041         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
11042                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
11043         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
11044 }
11045
11046 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
11047 {
11048         int i;
11049
11050         for (i = 0; i < uuid_count; i++) {
11051                 if (!memcmp(uuid, uuids[i], 16))
11052                         return true;
11053         }
11054
11055         return false;
11056 }
11057
11058 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
11059 {
11060         u16 parsed = 0;
11061
11062         while (parsed < eir_len) {
11063                 u8 field_len = eir[0];
11064                 u8 uuid[16];
11065                 int i;
11066
11067                 if (field_len == 0)
11068                         break;
11069
11070                 if (eir_len - parsed < field_len + 1)
11071                         break;
11072
11073                 switch (eir[1]) {
11074                 case EIR_UUID16_ALL:
11075                 case EIR_UUID16_SOME:
11076                         for (i = 0; i + 3 <= field_len; i += 2) {
11077                                 memcpy(uuid, bluetooth_base_uuid, 16);
11078                                 uuid[13] = eir[i + 3];
11079                                 uuid[12] = eir[i + 2];
11080                                 if (has_uuid(uuid, uuid_count, uuids))
11081                                         return true;
11082                         }
11083                         break;
11084                 case EIR_UUID32_ALL:
11085                 case EIR_UUID32_SOME:
11086                         for (i = 0; i + 5 <= field_len; i += 4) {
11087                                 memcpy(uuid, bluetooth_base_uuid, 16);
11088                                 uuid[15] = eir[i + 5];
11089                                 uuid[14] = eir[i + 4];
11090                                 uuid[13] = eir[i + 3];
11091                                 uuid[12] = eir[i + 2];
11092                                 if (has_uuid(uuid, uuid_count, uuids))
11093                                         return true;
11094                         }
11095                         break;
11096                 case EIR_UUID128_ALL:
11097                 case EIR_UUID128_SOME:
11098                         for (i = 0; i + 17 <= field_len; i += 16) {
11099                                 memcpy(uuid, eir + i + 2, 16);
11100                                 if (has_uuid(uuid, uuid_count, uuids))
11101                                         return true;
11102                         }
11103                         break;
11104                 }
11105
11106                 parsed += field_len + 1;
11107                 eir += field_len + 1;
11108         }
11109
11110         return false;
11111 }
11112
11113 static void restart_le_scan(struct hci_dev *hdev)
11114 {
11115         /* If controller is not scanning we are done. */
11116         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
11117                 return;
11118
11119         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
11120                        hdev->discovery.scan_start +
11121                        hdev->discovery.scan_duration))
11122                 return;
11123
11124         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
11125                            DISCOV_LE_RESTART_DELAY);
11126 }
11127
11128 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
11129                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11130 {
11131         /* If a RSSI threshold has been specified, and
11132          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
11133          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
11134          * is set, let it through for further processing, as we might need to
11135          * restart the scan.
11136          *
11137          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
11138          * the results are also dropped.
11139          */
11140         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11141             (rssi == HCI_RSSI_INVALID ||
11142             (rssi < hdev->discovery.rssi &&
11143              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
11144                 return  false;
11145
11146         if (hdev->discovery.uuid_count != 0) {
11147                 /* If a list of UUIDs is provided in filter, results with no
11148                  * matching UUID should be dropped.
11149                  */
11150                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
11151                                    hdev->discovery.uuids) &&
11152                     !eir_has_uuids(scan_rsp, scan_rsp_len,
11153                                    hdev->discovery.uuid_count,
11154                                    hdev->discovery.uuids))
11155                         return false;
11156         }
11157
11158         /* If duplicate filtering does not report RSSI changes, then restart
11159          * scanning to ensure updated result with updated RSSI values.
11160          */
11161         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
11162                 restart_le_scan(hdev);
11163
11164                 /* Validate RSSI value against the RSSI threshold once more. */
11165                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
11166                     rssi < hdev->discovery.rssi)
11167                         return false;
11168         }
11169
11170         return true;
11171 }
11172
11173 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11174                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
11175                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
11176 {
11177         char buf[512];
11178         struct mgmt_ev_device_found *ev = (void *)buf;
11179         size_t ev_size;
11180
11181         /* Don't send events for a non-kernel initiated discovery. With
11182          * LE one exception is if we have pend_le_reports > 0 in which
11183          * case we're doing passive scanning and want these events.
11184          */
11185         if (!hci_discovery_active(hdev)) {
11186                 if (link_type == ACL_LINK)
11187                         return;
11188                 if (link_type == LE_LINK &&
11189                     list_empty(&hdev->pend_le_reports) &&
11190                     !hci_is_adv_monitoring(hdev)) {
11191                         return;
11192                 }
11193         }
11194
11195         if (hdev->discovery.result_filtering) {
11196                 /* We are using service discovery */
11197                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
11198                                      scan_rsp_len))
11199                         return;
11200         }
11201
11202         if (hdev->discovery.limited) {
11203                 /* Check for limited discoverable bit */
11204                 if (dev_class) {
11205                         if (!(dev_class[1] & 0x20))
11206                                 return;
11207                 } else {
11208                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
11209                         if (!flags || !(flags[0] & LE_AD_LIMITED))
11210                                 return;
11211                 }
11212         }
11213
11214         /* Make sure that the buffer is big enough. The 5 extra bytes
11215          * are for the potential CoD field.
11216          */
11217         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
11218                 return;
11219
11220         memset(buf, 0, sizeof(buf));
11221
11222         /* In case of device discovery with BR/EDR devices (pre 1.2), the
11223          * RSSI value was reported as 0 when not available. This behavior
11224          * is kept when using device discovery. This is required for full
11225          * backwards compatibility with the API.
11226          *
11227          * However when using service discovery, the value 127 will be
11228          * returned when the RSSI is not available.
11229          */
11230         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
11231             link_type == ACL_LINK)
11232                 rssi = 0;
11233
11234         bacpy(&ev->addr.bdaddr, bdaddr);
11235         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11236         ev->rssi = rssi;
11237         ev->flags = cpu_to_le32(flags);
11238
11239         if (eir_len > 0)
11240                 /* Copy EIR or advertising data into event */
11241                 memcpy(ev->eir, eir, eir_len);
11242
11243         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11244                                        NULL))
11245                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
11246                                           dev_class, 3);
11247
11248         if (scan_rsp_len > 0)
11249                 /* Append scan response data to event */
11250                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
11251
11252         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
11253         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
11254
11255         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
11256 }
11257
11258 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
11259                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
11260 {
11261         struct mgmt_ev_device_found *ev;
11262         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
11263         u16 eir_len;
11264
11265         ev = (struct mgmt_ev_device_found *) buf;
11266
11267         memset(buf, 0, sizeof(buf));
11268
11269         bacpy(&ev->addr.bdaddr, bdaddr);
11270         ev->addr.type = link_to_bdaddr(link_type, addr_type);
11271         ev->rssi = rssi;
11272
11273         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
11274                                   name_len);
11275
11276         ev->eir_len = cpu_to_le16(eir_len);
11277
11278         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
11279 }
11280
11281 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
11282 {
11283         struct mgmt_ev_discovering ev;
11284
11285         bt_dev_dbg(hdev, "discovering %u", discovering);
11286
11287         memset(&ev, 0, sizeof(ev));
11288         ev.type = hdev->discovery.type;
11289         ev.discovering = discovering;
11290
11291         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
11292 }
11293
11294 void mgmt_suspending(struct hci_dev *hdev, u8 state)
11295 {
11296         struct mgmt_ev_controller_suspend ev;
11297
11298         ev.suspend_state = state;
11299         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
11300 }
11301
11302 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
11303                    u8 addr_type)
11304 {
11305         struct mgmt_ev_controller_resume ev;
11306
11307         ev.wake_reason = reason;
11308         if (bdaddr) {
11309                 bacpy(&ev.addr.bdaddr, bdaddr);
11310                 ev.addr.type = addr_type;
11311         } else {
11312                 memset(&ev.addr, 0, sizeof(ev.addr));
11313         }
11314
11315         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
11316 }
11317
11318 static struct hci_mgmt_chan chan = {
11319         .channel        = HCI_CHANNEL_CONTROL,
11320         .handler_count  = ARRAY_SIZE(mgmt_handlers),
11321         .handlers       = mgmt_handlers,
11322 #ifdef TIZEN_BT
11323         .tizen_handler_count    = ARRAY_SIZE(tizen_mgmt_handlers),
11324         .tizen_handlers = tizen_mgmt_handlers,
11325 #endif
11326         .hdev_init      = mgmt_init_hdev,
11327 };
11328
11329 int mgmt_init(void)
11330 {
11331         return hci_mgmt_chan_register(&chan);
11332 }
11333
11334 void mgmt_exit(void)
11335 {
11336         hci_mgmt_chan_unregister(&chan);
11337 }