net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/l2cap.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #ifdef CONFIG_TIZEN_WIP
  36 #include <net/bluetooth/mgmt_tizen.h>
  37 #include <net/bluetooth/sco.h>
  38 #endif
  39 #include "hci_request.h"
  40 #include "smp.h"
  41
  42 #define MGMT_VERSION    1
  43 #define MGMT_REVISION   8
  44
  45 #ifdef CONFIG_TIZEN_WIP
  46 #ifndef U16_MAX
  47 #define U16_MAX         ((u16)~0U)
  48 #endif
  49 #endif
  50
  51 static const u16 mgmt_commands[] = {
  52         MGMT_OP_READ_INDEX_LIST,
  53         MGMT_OP_READ_INFO,
  54         MGMT_OP_SET_POWERED,
  55         MGMT_OP_SET_DISCOVERABLE,
  56         MGMT_OP_SET_CONNECTABLE,
  57         MGMT_OP_SET_FAST_CONNECTABLE,
  58         MGMT_OP_SET_BONDABLE,
  59         MGMT_OP_SET_LINK_SECURITY,
  60         MGMT_OP_SET_SSP,
  61         MGMT_OP_SET_HS,
  62         MGMT_OP_SET_LE,
  63         MGMT_OP_SET_DEV_CLASS,
  64         MGMT_OP_SET_LOCAL_NAME,
  65         MGMT_OP_ADD_UUID,
  66         MGMT_OP_REMOVE_UUID,
  67         MGMT_OP_LOAD_LINK_KEYS,
  68         MGMT_OP_LOAD_LONG_TERM_KEYS,
  69         MGMT_OP_DISCONNECT,
  70         MGMT_OP_GET_CONNECTIONS,
  71         MGMT_OP_PIN_CODE_REPLY,
  72         MGMT_OP_PIN_CODE_NEG_REPLY,
  73         MGMT_OP_SET_IO_CAPABILITY,
  74         MGMT_OP_PAIR_DEVICE,
  75         MGMT_OP_CANCEL_PAIR_DEVICE,
  76         MGMT_OP_UNPAIR_DEVICE,
  77         MGMT_OP_USER_CONFIRM_REPLY,
  78         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  79         MGMT_OP_USER_PASSKEY_REPLY,
  80         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  81         MGMT_OP_READ_LOCAL_OOB_DATA,
  82         MGMT_OP_ADD_REMOTE_OOB_DATA,
  83         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  84         MGMT_OP_START_DISCOVERY,
  85         MGMT_OP_STOP_DISCOVERY,
  86         MGMT_OP_CONFIRM_NAME,
  87         MGMT_OP_BLOCK_DEVICE,
  88         MGMT_OP_UNBLOCK_DEVICE,
  89         MGMT_OP_SET_DEVICE_ID,
  90         MGMT_OP_SET_ADVERTISING,
  91         MGMT_OP_SET_BREDR,
  92         MGMT_OP_SET_STATIC_ADDRESS,
  93         MGMT_OP_SET_SCAN_PARAMS,
  94         MGMT_OP_SET_SECURE_CONN,
  95         MGMT_OP_SET_DEBUG_KEYS,
  96         MGMT_OP_SET_PRIVACY,
  97         MGMT_OP_LOAD_IRKS,
  98         MGMT_OP_GET_CONN_INFO,
  99         MGMT_OP_GET_CLOCK_INFO,
 100         MGMT_OP_ADD_DEVICE,
 101         MGMT_OP_REMOVE_DEVICE,
 102         MGMT_OP_LOAD_CONN_PARAM,
 103         MGMT_OP_READ_UNCONF_INDEX_LIST,
 104         MGMT_OP_READ_CONFIG_INFO,
 105         MGMT_OP_SET_EXTERNAL_CONFIG,
 106         MGMT_OP_SET_PUBLIC_ADDRESS,
 107         MGMT_OP_START_SERVICE_DISCOVERY,
 108 };
 109
 110 static const u16 mgmt_events[] = {
 111         MGMT_EV_CONTROLLER_ERROR,
 112         MGMT_EV_INDEX_ADDED,
 113         MGMT_EV_INDEX_REMOVED,
 114         MGMT_EV_NEW_SETTINGS,
 115         MGMT_EV_CLASS_OF_DEV_CHANGED,
 116         MGMT_EV_LOCAL_NAME_CHANGED,
 117         MGMT_EV_NEW_LINK_KEY,
 118         MGMT_EV_NEW_LONG_TERM_KEY,
 119         MGMT_EV_DEVICE_CONNECTED,
 120         MGMT_EV_DEVICE_DISCONNECTED,
 121         MGMT_EV_CONNECT_FAILED,
 122         MGMT_EV_PIN_CODE_REQUEST,
 123         MGMT_EV_USER_CONFIRM_REQUEST,
 124         MGMT_EV_USER_PASSKEY_REQUEST,
 125         MGMT_EV_AUTH_FAILED,
 126         MGMT_EV_DEVICE_FOUND,
 127         MGMT_EV_DISCOVERING,
 128         MGMT_EV_DEVICE_BLOCKED,
 129         MGMT_EV_DEVICE_UNBLOCKED,
 130         MGMT_EV_DEVICE_UNPAIRED,
 131         MGMT_EV_PASSKEY_NOTIFY,
 132         MGMT_EV_NEW_IRK,
 133         MGMT_EV_NEW_CSRK,
 134         MGMT_EV_DEVICE_ADDED,
 135         MGMT_EV_DEVICE_REMOVED,
 136         MGMT_EV_NEW_CONN_PARAM,
 137         MGMT_EV_UNCONF_INDEX_ADDED,
 138         MGMT_EV_UNCONF_INDEX_REMOVED,
 139         MGMT_EV_NEW_CONFIG_OPTIONS,
 140 };
 141
 142 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 143
 144 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 145                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 146
 147 struct pending_cmd {
 148         struct list_head list;
 149         u16 opcode;
 150         int index;
 151         void *param;
 152         size_t param_len;
 153         struct sock *sk;
 154         void *user_data;
 155         int (*cmd_complete)(struct pending_cmd *cmd, u8 status);
 156 };
 157
 158 /* HCI to MGMT error code conversion table */
 159 static u8 mgmt_status_table[] = {
 160         MGMT_STATUS_SUCCESS,
 161         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 162         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 163         MGMT_STATUS_FAILED,             /* Hardware Failure */
 164         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 165         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 166         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 167         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 168         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 169         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 170         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 171         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 172         MGMT_STATUS_BUSY,               /* Command Disallowed */
 173         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 174         MGMT_STATUS_REJECTED,           /* Rejected Security */
 175         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 176         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 177         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 178         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 179         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 180         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 181         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 182         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 183         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 184         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 185         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 186         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 187         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 188         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 189         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 190         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 191         MGMT_STATUS_FAILED,             /* Unspecified Error */
 192         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 193         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 194         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 195         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 196         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 197         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 198         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 199         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 200         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 201         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 202         MGMT_STATUS_FAILED,             /* Transaction Collision */
 203         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 204         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 205         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 206         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 207         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 208         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 209         MGMT_STATUS_FAILED,             /* Slot Violation */
 210         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 211         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 212         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 213         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 214         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 215         MGMT_STATUS_BUSY,               /* Controller Busy */
 216         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 217         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 218         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 219         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 220         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 221 };
 222
 223 static u8 mgmt_status(u8 hci_status)
 224 {
 225         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 226                 return mgmt_status_table[hci_status];
 227
 228         return MGMT_STATUS_FAILED;
 229 }
 230
 231 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
 232                       struct sock *skip_sk)
 233 {
 234         struct sk_buff *skb;
 235         struct mgmt_hdr *hdr;
 236
 237         skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
 238         if (!skb)
 239                 return -ENOMEM;
 240
 241         hdr = (void *) skb_put(skb, sizeof(*hdr));
 242         hdr->opcode = cpu_to_le16(event);
 243         if (hdev)
 244                 hdr->index = cpu_to_le16(hdev->id);
 245         else
 246                 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
 247         hdr->len = cpu_to_le16(data_len);
 248
 249         if (data)
 250                 memcpy(skb_put(skb, data_len), data, data_len);
 251
 252         /* Time stamp */
 253         __net_timestamp(skb);
 254
 255         hci_send_to_control(skb, skip_sk);
 256         kfree_skb(skb);
 257
 258         return 0;
 259 }
 260
 261 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
 262 {
 263         struct sk_buff *skb;
 264         struct mgmt_hdr *hdr;
 265         struct mgmt_ev_cmd_status *ev;
 266         int err;
 267
 268         BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
 269
 270         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
 271         if (!skb)
 272                 return -ENOMEM;
 273
 274         hdr = (void *) skb_put(skb, sizeof(*hdr));
 275
 276         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
 277         hdr->index = cpu_to_le16(index);
 278         hdr->len = cpu_to_le16(sizeof(*ev));
 279
 280         ev = (void *) skb_put(skb, sizeof(*ev));
 281         ev->status = status;
 282         ev->opcode = cpu_to_le16(cmd);
 283
 284         err = sock_queue_rcv_skb(sk, skb);
 285         if (err < 0)
 286                 kfree_skb(skb);
 287
 288         return err;
 289 }
 290
 291 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
 292                         void *rp, size_t rp_len)
 293 {
 294         struct sk_buff *skb;
 295         struct mgmt_hdr *hdr;
 296         struct mgmt_ev_cmd_complete *ev;
 297         int err;
 298
 299         BT_DBG("sock %p", sk);
 300
 301         skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
 302         if (!skb)
 303                 return -ENOMEM;
 304
 305         hdr = (void *) skb_put(skb, sizeof(*hdr));
 306
 307         hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
 308         hdr->index = cpu_to_le16(index);
 309         hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
 310
 311         ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
 312         ev->opcode = cpu_to_le16(cmd);
 313         ev->status = status;
 314
 315         if (rp)
 316                 memcpy(ev->data, rp, rp_len);
 317
 318         err = sock_queue_rcv_skb(sk, skb);
 319         if (err < 0)
 320                 kfree_skb(skb);
 321
 322         return err;
 323 }
 324
 325 #ifdef CONFIG_TIZEN_WIP
 326 /* BEGIN TIZEN_Bluetooth :: check for le connection update params */
 327 static inline int check_le_conn_update_param(u16 min, u16 max, u16 latency,
 328                                         u16 to_multiplier)
 329 {
 330         u16 max_latency;
 331
 332         if (min > max || min < 6 || max > 3200)
 333                 return -EINVAL;
 334
 335         if (to_multiplier < 10 || to_multiplier > 3200)
 336                 return -EINVAL;
 337
 338         if (max >= to_multiplier * 8)
 339                 return -EINVAL;
 340
 341         max_latency = (to_multiplier * 8 / max) - 1;
 342
 343         if (latency > 499 || latency > max_latency)
 344                 return -EINVAL;
 345
 346         return 0;
 347 }
 348 /* END TIZEN_Bluetooth */
 349 #endif
 350
 351 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 352                         u16 data_len)
 353 {
 354         struct mgmt_rp_read_version rp;
 355
 356         BT_DBG("sock %p", sk);
 357
 358         rp.version = MGMT_VERSION;
 359         rp.revision = cpu_to_le16(MGMT_REVISION);
 360
 361         return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
 362                             sizeof(rp));
 363 }
 364
 365 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 366                          u16 data_len)
 367 {
 368         struct mgmt_rp_read_commands *rp;
 369         const u16 num_commands = ARRAY_SIZE(mgmt_commands);
 370         const u16 num_events = ARRAY_SIZE(mgmt_events);
 371         __le16 *opcode;
 372         size_t rp_size;
 373         int i, err;
 374
 375         BT_DBG("sock %p", sk);
 376
 377         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 378
 379         rp = kmalloc(rp_size, GFP_KERNEL);
 380         if (!rp)
 381                 return -ENOMEM;
 382
 383         rp->num_commands = cpu_to_le16(num_commands);
 384         rp->num_events = cpu_to_le16(num_events);
 385
 386         for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
 387                 put_unaligned_le16(mgmt_commands[i], opcode);
 388
 389         for (i = 0; i < num_events; i++, opcode++)
 390                 put_unaligned_le16(mgmt_events[i], opcode);
 391
 392         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
 393                            rp_size);
 394         kfree(rp);
 395
 396         return err;
 397 }
 398
 399 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 400                            u16 data_len)
 401 {
 402         struct mgmt_rp_read_index_list *rp;
 403         struct hci_dev *d;
 404         size_t rp_len;
 405         u16 count;
 406         int err;
 407
 408         BT_DBG("sock %p", sk);
 409
 410         read_lock(&hci_dev_list_lock);
 411
 412         count = 0;
 413         list_for_each_entry(d, &hci_dev_list, list) {
 414                 if (d->dev_type == HCI_BREDR &&
 415                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 416                         count++;
 417         }
 418
 419         rp_len = sizeof(*rp) + (2 * count);
 420         rp = kmalloc(rp_len, GFP_ATOMIC);
 421         if (!rp) {
 422                 read_unlock(&hci_dev_list_lock);
 423                 return -ENOMEM;
 424         }
 425
 426         count = 0;
 427         list_for_each_entry(d, &hci_dev_list, list) {
 428                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 429                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 430                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 431                         continue;
 432
 433                 /* Devices marked as raw-only are neither configured
 434                  * nor unconfigured controllers.
 435                  */
 436                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 437                         continue;
 438
 439                 if (d->dev_type == HCI_BREDR &&
 440                     !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 441                         rp->index[count++] = cpu_to_le16(d->id);
 442                         BT_DBG("Added hci%u", d->id);
 443                 }
 444         }
 445
 446         rp->num_controllers = cpu_to_le16(count);
 447         rp_len = sizeof(*rp) + (2 * count);
 448
 449         read_unlock(&hci_dev_list_lock);
 450
 451         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
 452                            rp_len);
 453
 454         kfree(rp);
 455
 456         return err;
 457 }
 458
 459 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 460                                   void *data, u16 data_len)
 461 {
 462         struct mgmt_rp_read_unconf_index_list *rp;
 463         struct hci_dev *d;
 464         size_t rp_len;
 465         u16 count;
 466         int err;
 467
 468         BT_DBG("sock %p", sk);
 469
 470         read_lock(&hci_dev_list_lock);
 471
 472         count = 0;
 473         list_for_each_entry(d, &hci_dev_list, list) {
 474                 if (d->dev_type == HCI_BREDR &&
 475                     test_bit(HCI_UNCONFIGURED, &d->dev_flags))
 476                         count++;
 477         }
 478
 479         rp_len = sizeof(*rp) + (2 * count);
 480         rp = kmalloc(rp_len, GFP_ATOMIC);
 481         if (!rp) {
 482                 read_unlock(&hci_dev_list_lock);
 483                 return -ENOMEM;
 484         }
 485
 486         count = 0;
 487         list_for_each_entry(d, &hci_dev_list, list) {
 488                 if (test_bit(HCI_SETUP, &d->dev_flags) ||
 489                     test_bit(HCI_CONFIG, &d->dev_flags) ||
 490                     test_bit(HCI_USER_CHANNEL, &d->dev_flags))
 491                         continue;
 492
 493                 /* Devices marked as raw-only are neither configured
 494                  * nor unconfigured controllers.
 495                  */
 496                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 497                         continue;
 498
 499                 if (d->dev_type == HCI_BREDR &&
 500                     test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
 501                         rp->index[count++] = cpu_to_le16(d->id);
 502                         BT_DBG("Added hci%u", d->id);
 503                 }
 504         }
 505
 506         rp->num_controllers = cpu_to_le16(count);
 507         rp_len = sizeof(*rp) + (2 * count);
 508
 509         read_unlock(&hci_dev_list_lock);
 510
 511         err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
 512                            0, rp, rp_len);
 513
 514         kfree(rp);
 515
 516         return err;
 517 }
 518
 519 static bool is_configured(struct hci_dev *hdev)
 520 {
 521         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 522             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 523                 return false;
 524
 525         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 526             !bacmp(&hdev->public_addr, BDADDR_ANY))
 527                 return false;
 528
 529         return true;
 530 }
 531
 532 static __le32 get_missing_options(struct hci_dev *hdev)
 533 {
 534         u32 options = 0;
 535
 536         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 537             !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
 538                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 539
 540         if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
 541             !bacmp(&hdev->public_addr, BDADDR_ANY))
 542                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 543
 544         return cpu_to_le32(options);
 545 }
 546
 547 static int new_options(struct hci_dev *hdev, struct sock *skip)
 548 {
 549         __le32 options = get_missing_options(hdev);
 550
 551         return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 552                           sizeof(options), skip);
 553 }
 554
 555 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 556 {
 557         __le32 options = get_missing_options(hdev);
 558
 559         return cmd_complete(sk, hdev->id, opcode, 0, &options,
 560                             sizeof(options));
 561 }
 562
 563 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 564                             void *data, u16 data_len)
 565 {
 566         struct mgmt_rp_read_config_info rp;
 567         u32 options = 0;
 568
 569         BT_DBG("sock %p %s", sk, hdev->name);
 570
 571         hci_dev_lock(hdev);
 572
 573         memset(&rp, 0, sizeof(rp));
 574         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 575
 576         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 577                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 578
 579         if (hdev->set_bdaddr)
 580                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 581
 582         rp.supported_options = cpu_to_le32(options);
 583         rp.missing_options = get_missing_options(hdev);
 584
 585         hci_dev_unlock(hdev);
 586
 587         return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
 588                             sizeof(rp));
 589 }
 590
 591 static u32 get_supported_settings(struct hci_dev *hdev)
 592 {
 593         u32 settings = 0;
 594
 595         settings |= MGMT_SETTING_POWERED;
 596         settings |= MGMT_SETTING_BONDABLE;
 597 /* Disable Debug keys implementation now */
 598 #ifdef CONFIG_TIZEN_WIP
 599         settings |= MGMT_SETTING_DEBUG_KEYS;
 600 #endif
 601         settings |= MGMT_SETTING_CONNECTABLE;
 602         settings |= MGMT_SETTING_DISCOVERABLE;
 603
 604         if (lmp_bredr_capable(hdev)) {
 605                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 606                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 607                 settings |= MGMT_SETTING_BREDR;
 608                 settings |= MGMT_SETTING_LINK_SECURITY;
 609
 610                 if (lmp_ssp_capable(hdev)) {
 611                         settings |= MGMT_SETTING_SSP;
 612                         settings |= MGMT_SETTING_HS;
 613                 }
 614
 615 /* Disable Secure connection implementation now */
 616 #ifdef CONFIG_TIZEN_WIP
 617                 if (lmp_sc_capable(hdev) ||
 618                     test_bit(HCI_FORCE_BREDR_SMP, &hdev->dbg_flags))
 619                         settings |= MGMT_SETTING_SECURE_CONN;
 620 #endif
 621         }
 622
 623         if (lmp_le_capable(hdev)) {
 624                 settings |= MGMT_SETTING_LE;
 625                 settings |= MGMT_SETTING_ADVERTISING;
 626                 settings |= MGMT_SETTING_SECURE_CONN;
 627                 settings |= MGMT_SETTING_PRIVACY;
 628         }
 629
 630         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 631             hdev->set_bdaddr)
 632                 settings |= MGMT_SETTING_CONFIGURATION;
 633
 634         return settings;
 635 }
 636
 637 static u32 get_current_settings(struct hci_dev *hdev)
 638 {
 639         u32 settings = 0;
 640
 641         if (hdev_is_powered(hdev))
 642                 settings |= MGMT_SETTING_POWERED;
 643
 644         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
 645                 settings |= MGMT_SETTING_CONNECTABLE;
 646
 647         if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
 648                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 649
 650         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 651                 settings |= MGMT_SETTING_DISCOVERABLE;
 652
 653         if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
 654                 settings |= MGMT_SETTING_BONDABLE;
 655
 656         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 657                 settings |= MGMT_SETTING_BREDR;
 658
 659         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 660                 settings |= MGMT_SETTING_LE;
 661
 662         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
 663                 settings |= MGMT_SETTING_LINK_SECURITY;
 664
 665         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
 666                 settings |= MGMT_SETTING_SSP;
 667
 668         if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
 669                 settings |= MGMT_SETTING_HS;
 670
 671         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
 672                 settings |= MGMT_SETTING_ADVERTISING;
 673
 674 /* Disable Secure connection and debug keys implementation now */
 675 #ifdef CONFIG_TIZEN_WIP
 676         if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
 677                 settings |= MGMT_SETTING_SECURE_CONN;
 678
 679         if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
 680                 settings |= MGMT_SETTING_DEBUG_KEYS;
 681 #endif
 682
 683         if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
 684                 settings |= MGMT_SETTING_PRIVACY;
 685
 686         return settings;
 687 }
 688
 689 #define PNP_INFO_SVCLASS_ID             0x1200
 690
 691 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 692 {
 693         u8 *ptr = data, *uuids_start = NULL;
 694         struct bt_uuid *uuid;
 695
 696         if (len < 4)
 697                 return ptr;
 698
 699         list_for_each_entry(uuid, &hdev->uuids, list) {
 700                 u16 uuid16;
 701
 702                 if (uuid->size != 16)
 703                         continue;
 704
 705                 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
 706                 if (uuid16 < 0x1100)
 707                         continue;
 708
 709                 if (uuid16 == PNP_INFO_SVCLASS_ID)
 710                         continue;
 711
 712                 if (!uuids_start) {
 713                         uuids_start = ptr;
 714                         uuids_start[0] = 1;
 715                         uuids_start[1] = EIR_UUID16_ALL;
 716                         ptr += 2;
 717                 }
 718
 719                 /* Stop if not enough space to put next UUID */
 720                 if ((ptr - data) + sizeof(u16) > len) {
 721                         uuids_start[1] = EIR_UUID16_SOME;
 722                         break;
 723                 }
 724
 725                 *ptr++ = (uuid16 & 0x00ff);
 726                 *ptr++ = (uuid16 & 0xff00) >> 8;
 727                 uuids_start[0] += sizeof(uuid16);
 728         }
 729
 730         return ptr;
 731 }
 732
 733 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 734 {
 735         u8 *ptr = data, *uuids_start = NULL;
 736         struct bt_uuid *uuid;
 737
 738         if (len < 6)
 739                 return ptr;
 740
 741         list_for_each_entry(uuid, &hdev->uuids, list) {
 742                 if (uuid->size != 32)
 743                         continue;
 744
 745                 if (!uuids_start) {
 746                         uuids_start = ptr;
 747                         uuids_start[0] = 1;
 748                         uuids_start[1] = EIR_UUID32_ALL;
 749                         ptr += 2;
 750                 }
 751
 752                 /* Stop if not enough space to put next UUID */
 753                 if ((ptr - data) + sizeof(u32) > len) {
 754                         uuids_start[1] = EIR_UUID32_SOME;
 755                         break;
 756                 }
 757
 758                 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
 759                 ptr += sizeof(u32);
 760                 uuids_start[0] += sizeof(u32);
 761         }
 762
 763         return ptr;
 764 }
 765
 766 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
 767 {
 768         u8 *ptr = data, *uuids_start = NULL;
 769         struct bt_uuid *uuid;
 770
 771         if (len < 18)
 772                 return ptr;
 773
 774         list_for_each_entry(uuid, &hdev->uuids, list) {
 775                 if (uuid->size != 128)
 776                         continue;
 777
 778                 if (!uuids_start) {
 779                         uuids_start = ptr;
 780                         uuids_start[0] = 1;
 781                         uuids_start[1] = EIR_UUID128_ALL;
 782                         ptr += 2;
 783                 }
 784
 785                 /* Stop if not enough space to put next UUID */
 786                 if ((ptr - data) + 16 > len) {
 787                         uuids_start[1] = EIR_UUID128_SOME;
 788                         break;
 789                 }
 790
 791                 memcpy(ptr, uuid->uuid, 16);
 792                 ptr += 16;
 793                 uuids_start[0] += 16;
 794         }
 795
 796         return ptr;
 797 }
 798
 799 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
 800 {
 801         struct pending_cmd *cmd;
 802
 803         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 804                 if (cmd->opcode == opcode)
 805                         return cmd;
 806         }
 807
 808         return NULL;
 809 }
 810
 811 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
 812                                                   struct hci_dev *hdev,
 813                                                   const void *data)
 814 {
 815         struct pending_cmd *cmd;
 816
 817         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
 818                 if (cmd->user_data != data)
 819                         continue;
 820                 if (cmd->opcode == opcode)
 821                         return cmd;
 822         }
 823
 824         return NULL;
 825 }
 826
 827 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 828 {
 829         u8 ad_len = 0;
 830         size_t name_len;
 831
 832         name_len = strlen(hdev->dev_name);
 833         if (name_len > 0) {
 834                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
 835
 836                 if (name_len > max_len) {
 837                         name_len = max_len;
 838                         ptr[1] = EIR_NAME_SHORT;
 839                 } else
 840                         ptr[1] = EIR_NAME_COMPLETE;
 841
 842                 ptr[0] = name_len + 1;
 843
 844                 memcpy(ptr + 2, hdev->dev_name, name_len);
 845
 846                 ad_len += (name_len + 2);
 847                 ptr += (name_len + 2);
 848         }
 849
 850         return ad_len;
 851 }
 852
 853 static void update_scan_rsp_data(struct hci_request *req)
 854 {
 855         struct hci_dev *hdev = req->hdev;
 856         struct hci_cp_le_set_scan_rsp_data cp;
 857         u8 len;
 858
 859         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 860                 return;
 861
 862         memset(&cp, 0, sizeof(cp));
 863
 864         len = create_scan_rsp_data(hdev, cp.data);
 865
 866 #ifdef  CONFIG_TIZEN_WIP
 867         /* Advertising scan response data is handled in bluez.
 868               This value will be updated only when application request the update */
 869         return;
 870 #else
 871         if (hdev->scan_rsp_data_len == len &&
 872             memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
 873                 return;
 874
 875         memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
 876         hdev->scan_rsp_data_len = len;
 877
 878         cp.length = len;
 879
 880         hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 881 #endif
 882 }
 883
 884 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 885 {
 886         struct pending_cmd *cmd;
 887
 888         /* If there's a pending mgmt command the flags will not yet have
 889          * their final values, so check for this first.
 890          */
 891         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 892         if (cmd) {
 893                 struct mgmt_mode *cp = cmd->param;
 894                 if (cp->val == 0x01)
 895                         return LE_AD_GENERAL;
 896                 else if (cp->val == 0x02)
 897                         return LE_AD_LIMITED;
 898         } else {
 899                 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
 900                         return LE_AD_LIMITED;
 901                 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 902                         return LE_AD_GENERAL;
 903         }
 904
 905         return 0;
 906 }
 907
 908 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
 909 {
 910         u8 ad_len = 0, flags = 0;
 911
 912         flags |= get_adv_discov_flags(hdev);
 913
 914         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 915                 flags |= LE_AD_NO_BREDR;
 916
 917         if (flags) {
 918                 BT_DBG("adv flags 0x%02x", flags);
 919
 920                 ptr[0] = 2;
 921                 ptr[1] = EIR_FLAGS;
 922                 ptr[2] = flags;
 923
 924                 ad_len += 3;
 925                 ptr += 3;
 926         }
 927
 928         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
 929                 ptr[0] = 2;
 930                 ptr[1] = EIR_TX_POWER;
 931                 ptr[2] = (u8) hdev->adv_tx_power;
 932
 933                 ad_len += 3;
 934                 ptr += 3;
 935         }
 936
 937         return ad_len;
 938 }
 939
 940 static void update_adv_data(struct hci_request *req)
 941 {
 942         struct hci_dev *hdev = req->hdev;
 943         struct hci_cp_le_set_adv_data cp;
 944         u8 len;
 945
 946         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 947                 return;
 948
 949         memset(&cp, 0, sizeof(cp));
 950
 951         len = create_adv_data(hdev, cp.data);
 952
 953 #ifdef  CONFIG_TIZEN_WIP
 954         /* Bluez will handle the advertising data, including the flag and tx power.
 955             This value will be updated only when application request the update */
 956                 return;
 957 #else
 958         if (hdev->adv_data_len == len &&
 959             memcmp(cp.data, hdev->adv_data, len) == 0)
 960                 return;
 961
 962         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
 963         hdev->adv_data_len = len;
 964
 965         cp.length = len;
 966
 967         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 968 #endif
 969 }
 970
 971 int mgmt_update_adv_data(struct hci_dev *hdev)
 972 {
 973         struct hci_request req;
 974
 975         hci_req_init(&req, hdev);
 976         update_adv_data(&req);
 977
 978         return hci_req_run(&req, NULL);
 979 }
 980
 981 static void create_eir(struct hci_dev *hdev, u8 *data)
 982 {
 983         u8 *ptr = data;
 984         size_t name_len;
 985
 986         name_len = strlen(hdev->dev_name);
 987
 988         if (name_len > 0) {
 989                 /* EIR Data type */
 990                 if (name_len > 48) {
 991                         name_len = 48;
 992                         ptr[1] = EIR_NAME_SHORT;
 993                 } else
 994                         ptr[1] = EIR_NAME_COMPLETE;
 995
 996                 /* EIR Data length */
 997                 ptr[0] = name_len + 1;
 998
 999                 memcpy(ptr + 2, hdev->dev_name, name_len);
1000
1001                 ptr += (name_len + 2);
1002         }
1003
1004         if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
1005                 ptr[0] = 2;
1006                 ptr[1] = EIR_TX_POWER;
1007                 ptr[2] = (u8) hdev->inq_tx_power;
1008
1009                 ptr += 3;
1010         }
1011
1012         if (hdev->devid_source > 0) {
1013                 ptr[0] = 9;
1014                 ptr[1] = EIR_DEVICE_ID;
1015
1016                 put_unaligned_le16(hdev->devid_source, ptr + 2);
1017                 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1018                 put_unaligned_le16(hdev->devid_product, ptr + 6);
1019                 put_unaligned_le16(hdev->devid_version, ptr + 8);
1020
1021                 ptr += 10;
1022         }
1023
1024         ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1025         ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1026         ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
1027 #ifdef CONFIG_TIZEN_WIP
1028         if (hdev->manufacturer_len > 0 &&
1029                         ptr - data + hdev->manufacturer_len + 2 <= HCI_MAX_EIR_LENGTH) {
1030                 ptr[0] = hdev->manufacturer_len + 1;
1031                 ptr[1] = EIR_MANUFACTURER_DATA;
1032                 memcpy(ptr + 2, hdev->manufacturer_data, hdev->manufacturer_len);
1033                 ptr += hdev->manufacturer_len + 2;
1034         }
1035 #endif
1036 }
1037
1038 static void update_eir(struct hci_request *req)
1039 {
1040         struct hci_dev *hdev = req->hdev;
1041         struct hci_cp_write_eir cp;
1042
1043         if (!hdev_is_powered(hdev))
1044                 return;
1045
1046         if (!lmp_ext_inq_capable(hdev))
1047                 return;
1048
1049         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1050                 return;
1051
1052         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1053                 return;
1054
1055         memset(&cp, 0, sizeof(cp));
1056
1057         create_eir(hdev, cp.data);
1058
1059         if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
1060                 return;
1061
1062         memcpy(hdev->eir, cp.data, sizeof(cp.data));
1063
1064         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1065 }
1066
1067 static u8 get_service_classes(struct hci_dev *hdev)
1068 {
1069         struct bt_uuid *uuid;
1070         u8 val = 0;
1071
1072         list_for_each_entry(uuid, &hdev->uuids, list)
1073                 val |= uuid->svc_hint;
1074
1075         return val;
1076 }
1077
1078 static void update_class(struct hci_request *req)
1079 {
1080         struct hci_dev *hdev = req->hdev;
1081         u8 cod[3];
1082
1083         BT_DBG("%s", hdev->name);
1084
1085         if (!hdev_is_powered(hdev))
1086                 return;
1087
1088         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1089                 return;
1090
1091         if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1092                 return;
1093
1094         cod[0] = hdev->minor_class;
1095         cod[1] = hdev->major_class;
1096         cod[2] = get_service_classes(hdev);
1097
1098         if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1099                 cod[1] |= 0x20;
1100
1101         if (memcmp(cod, hdev->dev_class, 3) == 0)
1102                 return;
1103
1104         hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1105 }
1106
1107 static bool get_connectable(struct hci_dev *hdev)
1108 {
1109         struct pending_cmd *cmd;
1110
1111         /* If there's a pending mgmt command the flag will not yet have
1112          * it's final value, so check for this first.
1113          */
1114         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1115         if (cmd) {
1116                 struct mgmt_mode *cp = cmd->param;
1117                 return cp->val;
1118         }
1119
1120         return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1121 }
1122
1123 static void disable_advertising(struct hci_request *req)
1124 {
1125         u8 enable = 0x00;
1126
1127         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1128 }
1129
1130 static void enable_advertising(struct hci_request *req)
1131 {
1132         struct hci_dev *hdev = req->hdev;
1133         struct hci_cp_le_set_adv_param cp;
1134         u8 own_addr_type, enable = 0x01;
1135         bool connectable;
1136
1137         if (hci_conn_num(hdev, LE_LINK) > 0)
1138                 return;
1139
1140         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1141                 disable_advertising(req);
1142
1143         /* Clear the HCI_LE_ADV bit temporarily so that the
1144          * hci_update_random_address knows that it's safe to go ahead
1145          * and write a new random address. The flag will be set back on
1146          * as soon as the SET_ADV_ENABLE HCI command completes.
1147          */
1148         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1149
1150         connectable = get_connectable(hdev);
1151
1152         /* Set require_privacy to true only when non-connectable
1153          * advertising is used. In that case it is fine to use a
1154          * non-resolvable private address.
1155          */
1156         if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1157                 return;
1158
1159         memset(&cp, 0, sizeof(cp));
1160         cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1161         cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1162 #ifdef CONFIG_TIZEN_WIP
1163         cp.filter_policy = hdev->adv_filter_policy;
1164         if (hdev->adv_type != LE_ADV_SCAN_IND)
1165                 cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1166         else
1167                 cp.type = hdev->adv_type;
1168 #else
1169         cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1170 #endif
1171         cp.own_address_type = own_addr_type;
1172         cp.channel_map = hdev->le_adv_channel_map;
1173
1174         hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1175
1176         hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1177 }
1178
1179 static void service_cache_off(struct work_struct *work)
1180 {
1181         struct hci_dev *hdev = container_of(work, struct hci_dev,
1182                                             service_cache.work);
1183         struct hci_request req;
1184
1185         if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1186                 return;
1187
1188         hci_req_init(&req, hdev);
1189
1190         hci_dev_lock(hdev);
1191
1192         update_eir(&req);
1193         update_class(&req);
1194
1195         hci_dev_unlock(hdev);
1196
1197         hci_req_run(&req, NULL);
1198 }
1199
1200 static void rpa_expired(struct work_struct *work)
1201 {
1202         struct hci_dev *hdev = container_of(work, struct hci_dev,
1203                                             rpa_expired.work);
1204         struct hci_request req;
1205
1206         BT_DBG("");
1207
1208         set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1209
1210         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1211                 return;
1212
1213         /* The generation of a new RPA and programming it into the
1214          * controller happens in the enable_advertising() function.
1215          */
1216         hci_req_init(&req, hdev);
1217         enable_advertising(&req);
1218         hci_req_run(&req, NULL);
1219 }
1220
1221 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1222 {
1223         if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1224                 return;
1225
1226         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1227         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1228
1229         /* Non-mgmt controlled devices get this bit set
1230          * implicitly so that pairing works for them, however
1231          * for mgmt we require user-space to explicitly enable
1232          * it
1233          */
1234         clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1235 }
1236
1237 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1238                                 void *data, u16 data_len)
1239 {
1240         struct mgmt_rp_read_info rp;
1241
1242         BT_DBG("sock %p %s", sk, hdev->name);
1243
1244         hci_dev_lock(hdev);
1245
1246         memset(&rp, 0, sizeof(rp));
1247
1248         bacpy(&rp.bdaddr, &hdev->bdaddr);
1249
1250         rp.version = hdev->hci_ver;
1251         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1252
1253         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1254         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1255
1256         memcpy(rp.dev_class, hdev->dev_class, 3);
1257
1258         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1259         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1260
1261         hci_dev_unlock(hdev);
1262
1263         return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1264                             sizeof(rp));
1265 }
1266
1267 static void mgmt_pending_free(struct pending_cmd *cmd)
1268 {
1269         sock_put(cmd->sk);
1270         kfree(cmd->param);
1271         kfree(cmd);
1272 }
1273
1274 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1275                                             struct hci_dev *hdev, void *data,
1276                                             u16 len)
1277 {
1278         struct pending_cmd *cmd;
1279
1280         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1281         if (!cmd)
1282                 return NULL;
1283
1284         cmd->opcode = opcode;
1285         cmd->index = hdev->id;
1286
1287         cmd->param = kmemdup(data, len, GFP_KERNEL);
1288         if (!cmd->param) {
1289                 kfree(cmd);
1290                 return NULL;
1291         }
1292
1293         cmd->param_len = len;
1294
1295         cmd->sk = sk;
1296         sock_hold(sk);
1297
1298         list_add(&cmd->list, &hdev->mgmt_pending);
1299
1300         return cmd;
1301 }
1302
1303 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1304                                  void (*cb)(struct pending_cmd *cmd,
1305                                             void *data),
1306                                  void *data)
1307 {
1308         struct pending_cmd *cmd, *tmp;
1309
1310         list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1311                 if (opcode > 0 && cmd->opcode != opcode)
1312                         continue;
1313
1314                 cb(cmd, data);
1315         }
1316 }
1317
1318 static void mgmt_pending_remove(struct pending_cmd *cmd)
1319 {
1320         list_del(&cmd->list);
1321         mgmt_pending_free(cmd);
1322 }
1323
1324 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1325 {
1326         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1327
1328         return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1329                             sizeof(settings));
1330 }
1331
1332 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1333 {
1334         BT_DBG("%s status 0x%02x", hdev->name, status);
1335
1336         if (hci_conn_count(hdev) == 0) {
1337                 cancel_delayed_work(&hdev->power_off);
1338                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1339         }
1340 }
1341
1342 static bool hci_stop_discovery(struct hci_request *req)
1343 {
1344         struct hci_dev *hdev = req->hdev;
1345         struct hci_cp_remote_name_req_cancel cp;
1346         struct inquiry_entry *e;
1347
1348         switch (hdev->discovery.state) {
1349         case DISCOVERY_FINDING:
1350                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1351                         hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1352                 } else {
1353                         cancel_delayed_work(&hdev->le_scan_disable);
1354                         hci_req_add_le_scan_disable(req);
1355                 }
1356
1357                 return true;
1358
1359         case DISCOVERY_RESOLVING:
1360                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1361                                                      NAME_PENDING);
1362                 if (!e)
1363                         break;
1364
1365                 bacpy(&cp.bdaddr, &e->data.bdaddr);
1366                 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1367                             &cp);
1368
1369                 return true;
1370
1371         default:
1372                 /* Passive scanning */
1373                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1374                         hci_req_add_le_scan_disable(req);
1375                         return true;
1376                 }
1377
1378                 break;
1379         }
1380
1381         return false;
1382 }
1383
1384 static int clean_up_hci_state(struct hci_dev *hdev)
1385 {
1386         struct hci_request req;
1387         struct hci_conn *conn;
1388         bool discov_stopped;
1389         int err;
1390
1391         hci_req_init(&req, hdev);
1392
1393         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1394             test_bit(HCI_PSCAN, &hdev->flags)) {
1395                 u8 scan = 0x00;
1396                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1397         }
1398
1399         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1400                 disable_advertising(&req);
1401
1402         discov_stopped = hci_stop_discovery(&req);
1403
1404         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1405                 struct hci_cp_disconnect dc;
1406                 struct hci_cp_reject_conn_req rej;
1407
1408                 switch (conn->state) {
1409                 case BT_CONNECTED:
1410                 case BT_CONFIG:
1411                         dc.handle = cpu_to_le16(conn->handle);
1412                         dc.reason = 0x15; /* Terminated due to Power Off */
1413                         hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1414                         break;
1415                 case BT_CONNECT:
1416                         if (conn->type == LE_LINK)
1417                                 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1418                                             0, NULL);
1419                         else if (conn->type == ACL_LINK)
1420                                 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1421                                             6, &conn->dst);
1422                         break;
1423                 case BT_CONNECT2:
1424                         bacpy(&rej.bdaddr, &conn->dst);
1425                         rej.reason = 0x15; /* Terminated due to Power Off */
1426                         if (conn->type == ACL_LINK)
1427                                 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1428                                             sizeof(rej), &rej);
1429                         else if (conn->type == SCO_LINK)
1430                                 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1431                                             sizeof(rej), &rej);
1432                         break;
1433                 }
1434         }
1435
1436         err = hci_req_run(&req, clean_up_hci_complete);
1437         if (!err && discov_stopped)
1438                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1439
1440         return err;
1441 }
1442
1443 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1444                        u16 len)
1445 {
1446         struct mgmt_mode *cp = data;
1447         struct pending_cmd *cmd;
1448         int err;
1449
1450         BT_DBG("request for %s", hdev->name);
1451
1452         if (cp->val != 0x00 && cp->val != 0x01)
1453                 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1454                                   MGMT_STATUS_INVALID_PARAMS);
1455
1456         hci_dev_lock(hdev);
1457
1458         if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1459                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1460                                  MGMT_STATUS_BUSY);
1461                 goto failed;
1462         }
1463
1464         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1465                 cancel_delayed_work(&hdev->power_off);
1466
1467                 if (cp->val) {
1468                         mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1469                                          data, len);
1470                         err = mgmt_powered(hdev, 1);
1471                         goto failed;
1472                 }
1473         }
1474
1475         if (!!cp->val == hdev_is_powered(hdev)) {
1476                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1477                 goto failed;
1478         }
1479
1480         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1481         if (!cmd) {
1482                 err = -ENOMEM;
1483                 goto failed;
1484         }
1485
1486         if (cp->val) {
1487                 queue_work(hdev->req_workqueue, &hdev->power_on);
1488                 err = 0;
1489         } else {
1490                 /* Disconnect connections, stop scans, etc */
1491                 err = clean_up_hci_state(hdev);
1492                 if (!err)
1493                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1494                                            HCI_POWER_OFF_TIMEOUT);
1495
1496                 /* ENODATA means there were no HCI commands queued */
1497                 if (err == -ENODATA) {
1498                         cancel_delayed_work(&hdev->power_off);
1499                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1500                         err = 0;
1501                 }
1502         }
1503
1504 failed:
1505         hci_dev_unlock(hdev);
1506         return err;
1507 }
1508
1509 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1510 {
1511         __le32 ev;
1512
1513         ev = cpu_to_le32(get_current_settings(hdev));
1514
1515         return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1516 }
1517
1518 int mgmt_new_settings(struct hci_dev *hdev)
1519 {
1520         return new_settings(hdev, NULL);
1521 }
1522
1523 struct cmd_lookup {
1524         struct sock *sk;
1525         struct hci_dev *hdev;
1526         u8 mgmt_status;
1527 };
1528
1529 static void settings_rsp(struct pending_cmd *cmd, void *data)
1530 {
1531         struct cmd_lookup *match = data;
1532
1533         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1534
1535         list_del(&cmd->list);
1536
1537         if (match->sk == NULL) {
1538                 match->sk = cmd->sk;
1539                 sock_hold(match->sk);
1540         }
1541
1542         mgmt_pending_free(cmd);
1543 }
1544
1545 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1546 {
1547         u8 *status = data;
1548
1549         cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1550         mgmt_pending_remove(cmd);
1551 }
1552
1553 static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
1554 {
1555         if (cmd->cmd_complete) {
1556                 u8 *status = data;
1557
1558                 cmd->cmd_complete(cmd, *status);
1559                 mgmt_pending_remove(cmd);
1560
1561                 return;
1562         }
1563
1564         cmd_status_rsp(cmd, data);
1565 }
1566
1567 static int generic_cmd_complete(struct pending_cmd *cmd, u8 status)
1568 {
1569         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1570                             cmd->param, cmd->param_len);
1571 }
1572
1573 static int addr_cmd_complete(struct pending_cmd *cmd, u8 status)
1574 {
1575         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1576                             sizeof(struct mgmt_addr_info));
1577 }
1578
1579 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1580 {
1581         if (!lmp_bredr_capable(hdev))
1582                 return MGMT_STATUS_NOT_SUPPORTED;
1583         else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1584                 return MGMT_STATUS_REJECTED;
1585         else
1586                 return MGMT_STATUS_SUCCESS;
1587 }
1588
1589 static u8 mgmt_le_support(struct hci_dev *hdev)
1590 {
1591         if (!lmp_le_capable(hdev))
1592                 return MGMT_STATUS_NOT_SUPPORTED;
1593         else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1594                 return MGMT_STATUS_REJECTED;
1595         else
1596                 return MGMT_STATUS_SUCCESS;
1597 }
1598
1599 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1600                                       u16 opcode)
1601 {
1602         struct pending_cmd *cmd;
1603         struct mgmt_mode *cp;
1604         struct hci_request req;
1605         bool changed;
1606
1607         BT_DBG("status 0x%02x", status);
1608
1609         hci_dev_lock(hdev);
1610
1611         cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1612         if (!cmd)
1613                 goto unlock;
1614
1615         if (status) {
1616                 u8 mgmt_err = mgmt_status(status);
1617                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1618                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1619                 goto remove_cmd;
1620         }
1621
1622         cp = cmd->param;
1623         if (cp->val) {
1624                 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1625                                             &hdev->dev_flags);
1626
1627                 if (hdev->discov_timeout > 0) {
1628                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1629                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1630                                            to);
1631                 }
1632         } else {
1633                 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1634                                              &hdev->dev_flags);
1635         }
1636
1637         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1638
1639         if (changed)
1640                 new_settings(hdev, cmd->sk);
1641
1642         /* When the discoverable mode gets changed, make sure
1643          * that class of device has the limited discoverable
1644          * bit correctly set. Also update page scan based on whitelist
1645          * entries.
1646          */
1647         hci_req_init(&req, hdev);
1648         __hci_update_page_scan(&req);
1649         update_class(&req);
1650         hci_req_run(&req, NULL);
1651
1652 remove_cmd:
1653         mgmt_pending_remove(cmd);
1654
1655 unlock:
1656         hci_dev_unlock(hdev);
1657 }
1658
1659 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1660                             u16 len)
1661 {
1662         struct mgmt_cp_set_discoverable *cp = data;
1663         struct pending_cmd *cmd;
1664         struct hci_request req;
1665         u16 timeout;
1666         u8 scan;
1667         int err;
1668
1669         BT_DBG("request for %s", hdev->name);
1670
1671         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1672             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1673                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1674                                   MGMT_STATUS_REJECTED);
1675
1676         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1677                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1678                                   MGMT_STATUS_INVALID_PARAMS);
1679
1680         timeout = __le16_to_cpu(cp->timeout);
1681
1682         /* Disabling discoverable requires that no timeout is set,
1683          * and enabling limited discoverable requires a timeout.
1684          */
1685         if ((cp->val == 0x00 && timeout > 0) ||
1686             (cp->val == 0x02 && timeout == 0))
1687                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1688                                   MGMT_STATUS_INVALID_PARAMS);
1689
1690         hci_dev_lock(hdev);
1691
1692         if (!hdev_is_powered(hdev) && timeout > 0) {
1693                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1694                                  MGMT_STATUS_NOT_POWERED);
1695                 goto failed;
1696         }
1697
1698         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1699             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1700                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1701                                  MGMT_STATUS_BUSY);
1702                 goto failed;
1703         }
1704
1705         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1706                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1707                                  MGMT_STATUS_REJECTED);
1708                 goto failed;
1709         }
1710
1711         if (!hdev_is_powered(hdev)) {
1712                 bool changed = false;
1713
1714                 /* Setting limited discoverable when powered off is
1715                  * not a valid operation since it requires a timeout
1716                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1717                  */
1718                 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1719                         change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1720                         changed = true;
1721                 }
1722
1723                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1724                 if (err < 0)
1725                         goto failed;
1726
1727                 if (changed)
1728                         err = new_settings(hdev, sk);
1729
1730                 goto failed;
1731         }
1732
1733         /* If the current mode is the same, then just update the timeout
1734          * value with the new value. And if only the timeout gets updated,
1735          * then no need for any HCI transactions.
1736          */
1737         if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1738             (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1739                                           &hdev->dev_flags)) {
1740                 cancel_delayed_work(&hdev->discov_off);
1741                 hdev->discov_timeout = timeout;
1742
1743                 if (cp->val && hdev->discov_timeout > 0) {
1744                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1745                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1746                                            to);
1747                 }
1748
1749                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1750                 goto failed;
1751         }
1752
1753         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1754         if (!cmd) {
1755                 err = -ENOMEM;
1756                 goto failed;
1757         }
1758
1759         /* Cancel any potential discoverable timeout that might be
1760          * still active and store new timeout value. The arming of
1761          * the timeout happens in the complete handler.
1762          */
1763         cancel_delayed_work(&hdev->discov_off);
1764         hdev->discov_timeout = timeout;
1765
1766         /* Limited discoverable mode */
1767         if (cp->val == 0x02)
1768                 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1769         else
1770                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1771
1772         hci_req_init(&req, hdev);
1773
1774         /* The procedure for LE-only controllers is much simpler - just
1775          * update the advertising data.
1776          */
1777         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1778                 goto update_ad;
1779
1780         scan = SCAN_PAGE;
1781
1782         if (cp->val) {
1783                 struct hci_cp_write_current_iac_lap hci_cp;
1784
1785                 if (cp->val == 0x02) {
1786                         /* Limited discoverable mode */
1787                         hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1788                         hci_cp.iac_lap[0] = 0x00;       /* LIAC */
1789                         hci_cp.iac_lap[1] = 0x8b;
1790                         hci_cp.iac_lap[2] = 0x9e;
1791                         hci_cp.iac_lap[3] = 0x33;       /* GIAC */
1792                         hci_cp.iac_lap[4] = 0x8b;
1793                         hci_cp.iac_lap[5] = 0x9e;
1794                 } else {
1795                         /* General discoverable mode */
1796                         hci_cp.num_iac = 1;
1797                         hci_cp.iac_lap[0] = 0x33;       /* GIAC */
1798                         hci_cp.iac_lap[1] = 0x8b;
1799                         hci_cp.iac_lap[2] = 0x9e;
1800                 }
1801
1802                 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1803                             (hci_cp.num_iac * 3) + 1, &hci_cp);
1804
1805                 scan |= SCAN_INQUIRY;
1806         } else {
1807                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1808         }
1809
1810         hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1811
1812 update_ad:
1813         update_adv_data(&req);
1814
1815         err = hci_req_run(&req, set_discoverable_complete);
1816         if (err < 0)
1817                 mgmt_pending_remove(cmd);
1818
1819 failed:
1820         hci_dev_unlock(hdev);
1821         return err;
1822 }
1823
1824 static void write_fast_connectable(struct hci_request *req, bool enable)
1825 {
1826         struct hci_dev *hdev = req->hdev;
1827 #ifndef CONFIG_TIZEN_WIP
1828         struct hci_cp_write_page_scan_activity acp;
1829 #endif
1830         u8 type;
1831
1832         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1833                 return;
1834
1835         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1836                 return;
1837
1838 #ifdef CONFIG_TIZEN_WIP
1839         if (enable) {
1840                 type = PAGE_SCAN_TYPE_INTERLACED;
1841         } else {
1842                 type = PAGE_SCAN_TYPE_STANDARD;
1843         }
1844 #else
1845         if (enable) {
1846                 type = PAGE_SCAN_TYPE_INTERLACED;
1847
1848                 /* 160 msec page scan interval */
1849                 acp.interval = cpu_to_le16(0x0100);
1850         } else {
1851                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1852
1853                 /* default 1.28 sec page scan */
1854                 acp.interval = cpu_to_le16(0x0800);
1855         }
1856
1857         acp.window = cpu_to_le16(0x0012);
1858
1859         if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1860             __cpu_to_le16(hdev->page_scan_window) != acp.window)
1861                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1862                             sizeof(acp), &acp);
1863 #endif
1864
1865         if (hdev->page_scan_type != type)
1866                 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1867 }
1868
1869 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1870                                      u16 opcode)
1871 {
1872         struct pending_cmd *cmd;
1873         struct mgmt_mode *cp;
1874         bool conn_changed, discov_changed;
1875
1876         BT_DBG("status 0x%02x", status);
1877
1878         hci_dev_lock(hdev);
1879
1880         cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1881         if (!cmd)
1882                 goto unlock;
1883
1884         if (status) {
1885                 u8 mgmt_err = mgmt_status(status);
1886                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1887                 goto remove_cmd;
1888         }
1889
1890         cp = cmd->param;
1891         if (cp->val) {
1892                 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1893                                                  &hdev->dev_flags);
1894                 discov_changed = false;
1895         } else {
1896                 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1897                                                   &hdev->dev_flags);
1898                 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1899                                                     &hdev->dev_flags);
1900         }
1901
1902         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1903
1904         if (conn_changed || discov_changed) {
1905                 new_settings(hdev, cmd->sk);
1906                 hci_update_page_scan(hdev);
1907                 if (discov_changed)
1908                         mgmt_update_adv_data(hdev);
1909                 hci_update_background_scan(hdev);
1910         }
1911
1912 remove_cmd:
1913         mgmt_pending_remove(cmd);
1914
1915 unlock:
1916         hci_dev_unlock(hdev);
1917 }
1918
1919 static int set_connectable_update_settings(struct hci_dev *hdev,
1920                                            struct sock *sk, u8 val)
1921 {
1922         bool changed = false;
1923         int err;
1924
1925         if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1926                 changed = true;
1927
1928         if (val) {
1929                 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1930         } else {
1931                 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1932                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1933         }
1934
1935         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1936         if (err < 0)
1937                 return err;
1938
1939         if (changed) {
1940                 hci_update_page_scan(hdev);
1941                 hci_update_background_scan(hdev);
1942                 return new_settings(hdev, sk);
1943         }
1944
1945         return 0;
1946 }
1947
1948 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1949                            u16 len)
1950 {
1951         struct mgmt_mode *cp = data;
1952         struct pending_cmd *cmd;
1953         struct hci_request req;
1954         u8 scan;
1955         int err;
1956
1957         BT_DBG("request for %s", hdev->name);
1958
1959         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1960             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1961                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1962                                   MGMT_STATUS_REJECTED);
1963
1964         if (cp->val != 0x00 && cp->val != 0x01)
1965                 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1966                                   MGMT_STATUS_INVALID_PARAMS);
1967
1968         hci_dev_lock(hdev);
1969
1970         if (!hdev_is_powered(hdev)) {
1971                 err = set_connectable_update_settings(hdev, sk, cp->val);
1972                 goto failed;
1973         }
1974
1975         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1976             mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1977                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1978                                  MGMT_STATUS_BUSY);
1979                 goto failed;
1980         }
1981
1982         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1983         if (!cmd) {
1984                 err = -ENOMEM;
1985                 goto failed;
1986         }
1987
1988         hci_req_init(&req, hdev);
1989
1990         /* If BR/EDR is not enabled and we disable advertising as a
1991          * by-product of disabling connectable, we need to update the
1992          * advertising flags.
1993          */
1994         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1995                 if (!cp->val) {
1996                         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1997                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1998                 }
1999                 update_adv_data(&req);
2000         } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
2001                 if (cp->val) {
2002                         scan = SCAN_PAGE;
2003                 } else {
2004                         /* If we don't have any whitelist entries just
2005                          * disable all scanning. If there are entries
2006                          * and we had both page and inquiry scanning
2007                          * enabled then fall back to only page scanning.
2008                          * Otherwise no changes are needed.
2009                          */
2010                         if (list_empty(&hdev->whitelist))
2011                                 scan = SCAN_DISABLED;
2012                         else if (test_bit(HCI_ISCAN, &hdev->flags))
2013                                 scan = SCAN_PAGE;
2014                         else
2015                                 goto no_scan_update;
2016
2017                         if (test_bit(HCI_ISCAN, &hdev->flags) &&
2018                             hdev->discov_timeout > 0)
2019                                 cancel_delayed_work(&hdev->discov_off);
2020                 }
2021
2022                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2023         }
2024
2025 no_scan_update:
2026 #ifdef CONFIG_TIZEN_WIP
2027         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
2028                 write_fast_connectable(&req, true);
2029 #else
2030         /* If we're going from non-connectable to connectable or
2031          * vice-versa when fast connectable is enabled ensure that fast
2032          * connectable gets disabled. write_fast_connectable won't do
2033          * anything if the page scan parameters are already what they
2034          * should be.
2035          */
2036         if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
2037                 write_fast_connectable(&req, false);
2038 #endif
2039
2040         /* Update the advertising parameters if necessary */
2041         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2042                 enable_advertising(&req);
2043
2044         err = hci_req_run(&req, set_connectable_complete);
2045         if (err < 0) {
2046                 mgmt_pending_remove(cmd);
2047                 if (err == -ENODATA)
2048                         err = set_connectable_update_settings(hdev, sk,
2049                                                               cp->val);
2050                 goto failed;
2051         }
2052
2053 failed:
2054         hci_dev_unlock(hdev);
2055         return err;
2056 }
2057
2058 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
2059                         u16 len)
2060 {
2061         struct mgmt_mode *cp = data;
2062         bool changed;
2063         int err;
2064
2065         BT_DBG("request for %s", hdev->name);
2066
2067         if (cp->val != 0x00 && cp->val != 0x01)
2068                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2069                                   MGMT_STATUS_INVALID_PARAMS);
2070
2071         hci_dev_lock(hdev);
2072
2073         if (cp->val)
2074                 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
2075         else
2076                 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
2077
2078         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
2079         if (err < 0)
2080                 goto unlock;
2081
2082         if (changed)
2083                 err = new_settings(hdev, sk);
2084
2085 unlock:
2086         hci_dev_unlock(hdev);
2087         return err;
2088 }
2089
2090 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2091                              u16 len)
2092 {
2093         struct mgmt_mode *cp = data;
2094         struct pending_cmd *cmd;
2095         u8 val, status;
2096         int err;
2097
2098         BT_DBG("request for %s", hdev->name);
2099
2100         status = mgmt_bredr_support(hdev);
2101         if (status)
2102                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2103                                   status);
2104
2105         if (cp->val != 0x00 && cp->val != 0x01)
2106                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2107                                   MGMT_STATUS_INVALID_PARAMS);
2108
2109         hci_dev_lock(hdev);
2110
2111         if (!hdev_is_powered(hdev)) {
2112                 bool changed = false;
2113
2114                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
2115                                           &hdev->dev_flags)) {
2116                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
2117                         changed = true;
2118                 }
2119
2120                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2121                 if (err < 0)
2122                         goto failed;
2123
2124                 if (changed)
2125                         err = new_settings(hdev, sk);
2126
2127                 goto failed;
2128         }
2129
2130         if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2131                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2132                                  MGMT_STATUS_BUSY);
2133                 goto failed;
2134         }
2135
2136         val = !!cp->val;
2137
2138         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2139                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2140                 goto failed;
2141         }
2142
2143         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2144         if (!cmd) {
2145                 err = -ENOMEM;
2146                 goto failed;
2147         }
2148
2149         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2150         if (err < 0) {
2151                 mgmt_pending_remove(cmd);
2152                 goto failed;
2153         }
2154
2155 failed:
2156         hci_dev_unlock(hdev);
2157         return err;
2158 }
2159
2160 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2161 {
2162         struct mgmt_mode *cp = data;
2163         struct pending_cmd *cmd;
2164         u8 status;
2165         int err;
2166
2167         BT_DBG("request for %s", hdev->name);
2168
2169         status = mgmt_bredr_support(hdev);
2170         if (status)
2171                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2172
2173         if (!lmp_ssp_capable(hdev))
2174                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2175                                   MGMT_STATUS_NOT_SUPPORTED);
2176
2177         if (cp->val != 0x00 && cp->val != 0x01)
2178                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2179                                   MGMT_STATUS_INVALID_PARAMS);
2180
2181         hci_dev_lock(hdev);
2182
2183         if (!hdev_is_powered(hdev)) {
2184                 bool changed;
2185
2186                 if (cp->val) {
2187                         changed = !test_and_set_bit(HCI_SSP_ENABLED,
2188                                                     &hdev->dev_flags);
2189                 } else {
2190                         changed = test_and_clear_bit(HCI_SSP_ENABLED,
2191                                                      &hdev->dev_flags);
2192                         if (!changed)
2193                                 changed = test_and_clear_bit(HCI_HS_ENABLED,
2194                                                              &hdev->dev_flags);
2195                         else
2196                                 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2197                 }
2198
2199                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2200                 if (err < 0)
2201                         goto failed;
2202
2203                 if (changed)
2204                         err = new_settings(hdev, sk);
2205
2206                 goto failed;
2207         }
2208
2209         if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2210             mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2211                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2212                                  MGMT_STATUS_BUSY);
2213                 goto failed;
2214         }
2215
2216         if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2217                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2218                 goto failed;
2219         }
2220
2221         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2222         if (!cmd) {
2223                 err = -ENOMEM;
2224                 goto failed;
2225         }
2226
2227         if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2228                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2229                              sizeof(cp->val), &cp->val);
2230
2231         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2232         if (err < 0) {
2233                 mgmt_pending_remove(cmd);
2234                 goto failed;
2235         }
2236
2237 failed:
2238         hci_dev_unlock(hdev);
2239         return err;
2240 }
2241
2242 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2243 {
2244         struct mgmt_mode *cp = data;
2245         bool changed;
2246         u8 status;
2247         int err;
2248
2249         BT_DBG("request for %s", hdev->name);
2250
2251         status = mgmt_bredr_support(hdev);
2252         if (status)
2253                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2254
2255         if (!lmp_ssp_capable(hdev))
2256                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2257                                   MGMT_STATUS_NOT_SUPPORTED);
2258
2259         if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2260                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2261                                   MGMT_STATUS_REJECTED);
2262
2263         if (cp->val != 0x00 && cp->val != 0x01)
2264                 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2265                                   MGMT_STATUS_INVALID_PARAMS);
2266
2267         hci_dev_lock(hdev);
2268
2269         if (cp->val) {
2270                 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2271         } else {
2272                 if (hdev_is_powered(hdev)) {
2273                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2274                                          MGMT_STATUS_REJECTED);
2275                         goto unlock;
2276                 }
2277
2278                 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2279         }
2280
2281         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2282         if (err < 0)
2283                 goto unlock;
2284
2285         if (changed)
2286                 err = new_settings(hdev, sk);
2287
2288 unlock:
2289         hci_dev_unlock(hdev);
2290         return err;
2291 }
2292
2293 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2294 {
2295         struct cmd_lookup match = { NULL, hdev };
2296
2297 #ifdef CONFIG_TIZEN_WIP
2298         hci_dev_lock(hdev);
2299 #endif
2300
2301         if (status) {
2302                 u8 mgmt_err = mgmt_status(status);
2303
2304                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2305                                      &mgmt_err);
2306 #ifdef CONFIG_TIZEN_WIP
2307                 goto unlock;
2308 #else
2309                 return;
2310 #endif
2311         }
2312
2313         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2314
2315         new_settings(hdev, match.sk);
2316
2317         if (match.sk)
2318                 sock_put(match.sk);
2319
2320         /* Make sure the controller has a good default for
2321          * advertising data. Restrict the update to when LE
2322          * has actually been enabled. During power on, the
2323          * update in powered_update_hci will take care of it.
2324          */
2325         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2326                 struct hci_request req;
2327
2328 #ifndef CONFIG_TIZEN_WIP
2329                 hci_dev_lock(hdev);
2330 #endif
2331
2332                 hci_req_init(&req, hdev);
2333                 update_adv_data(&req);
2334                 update_scan_rsp_data(&req);
2335                 __hci_update_background_scan(&req);
2336                 hci_req_run(&req, NULL);
2337         }
2338         hci_update_background_scan(hdev);
2339 #ifdef CONFIG_TIZEN_WIP
2340 unlock:
2341         hci_dev_unlock(hdev);
2342 #endif
2343 }
2344
2345 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2346 {
2347         struct mgmt_mode *cp = data;
2348         struct hci_cp_write_le_host_supported hci_cp;
2349         struct pending_cmd *cmd;
2350         struct hci_request req;
2351         int err;
2352         u8 val, enabled;
2353
2354         BT_DBG("request for %s", hdev->name);
2355
2356         if (!lmp_le_capable(hdev))
2357                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2358                                   MGMT_STATUS_NOT_SUPPORTED);
2359
2360         if (cp->val != 0x00 && cp->val != 0x01)
2361                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2362                                   MGMT_STATUS_INVALID_PARAMS);
2363
2364         /* LE-only devices do not allow toggling LE on/off */
2365         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2366                 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2367                                   MGMT_STATUS_REJECTED);
2368
2369         hci_dev_lock(hdev);
2370
2371         val = !!cp->val;
2372         enabled = lmp_host_le_capable(hdev);
2373
2374         if (!hdev_is_powered(hdev) || val == enabled) {
2375                 bool changed = false;
2376
2377                 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2378                         change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2379                         changed = true;
2380                 }
2381
2382                 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2383                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2384                         changed = true;
2385                 }
2386
2387                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2388                 if (err < 0)
2389                         goto unlock;
2390
2391                 if (changed)
2392                         err = new_settings(hdev, sk);
2393
2394                 goto unlock;
2395         }
2396
2397         if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2398             mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2399                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2400                                  MGMT_STATUS_BUSY);
2401                 goto unlock;
2402         }
2403
2404         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2405         if (!cmd) {
2406                 err = -ENOMEM;
2407                 goto unlock;
2408         }
2409
2410         hci_req_init(&req, hdev);
2411
2412         memset(&hci_cp, 0, sizeof(hci_cp));
2413
2414         if (val) {
2415                 hci_cp.le = val;
2416                 hci_cp.simul = 0x00;
2417         } else {
2418                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2419                         disable_advertising(&req);
2420         }
2421
2422         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2423                     &hci_cp);
2424
2425         err = hci_req_run(&req, le_enable_complete);
2426         if (err < 0)
2427                 mgmt_pending_remove(cmd);
2428
2429 unlock:
2430         hci_dev_unlock(hdev);
2431         return err;
2432 }
2433
2434 /* This is a helper function to test for pending mgmt commands that can
2435  * cause CoD or EIR HCI commands. We can only allow one such pending
2436  * mgmt command at a time since otherwise we cannot easily track what
2437  * the current values are, will be, and based on that calculate if a new
2438  * HCI command needs to be sent and if yes with what value.
2439  */
2440 static bool pending_eir_or_class(struct hci_dev *hdev)
2441 {
2442         struct pending_cmd *cmd;
2443
2444         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2445                 switch (cmd->opcode) {
2446                 case MGMT_OP_ADD_UUID:
2447                 case MGMT_OP_REMOVE_UUID:
2448                 case MGMT_OP_SET_DEV_CLASS:
2449                 case MGMT_OP_SET_POWERED:
2450                         return true;
2451                 }
2452         }
2453
2454         return false;
2455 }
2456
2457 static const u8 bluetooth_base_uuid[] = {
2458                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2459                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2460 };
2461
2462 static u8 get_uuid_size(const u8 *uuid)
2463 {
2464         u32 val;
2465
2466         if (memcmp(uuid, bluetooth_base_uuid, 12))
2467                 return 128;
2468
2469         val = get_unaligned_le32(&uuid[12]);
2470         if (val > 0xffff)
2471                 return 32;
2472
2473         return 16;
2474 }
2475
2476 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2477 {
2478         struct pending_cmd *cmd;
2479
2480         hci_dev_lock(hdev);
2481
2482         cmd = mgmt_pending_find(mgmt_op, hdev);
2483         if (!cmd)
2484                 goto unlock;
2485
2486         cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2487                      hdev->dev_class, 3);
2488
2489         mgmt_pending_remove(cmd);
2490
2491 unlock:
2492         hci_dev_unlock(hdev);
2493 }
2494
2495 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2496 {
2497         BT_DBG("status 0x%02x", status);
2498
2499         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2500 }
2501
2502 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2503 {
2504         struct mgmt_cp_add_uuid *cp = data;
2505         struct pending_cmd *cmd;
2506         struct hci_request req;
2507         struct bt_uuid *uuid;
2508         int err;
2509
2510         BT_DBG("request for %s", hdev->name);
2511
2512         hci_dev_lock(hdev);
2513
2514         if (pending_eir_or_class(hdev)) {
2515                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2516                                  MGMT_STATUS_BUSY);
2517                 goto failed;
2518         }
2519
2520         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2521         if (!uuid) {
2522                 err = -ENOMEM;
2523                 goto failed;
2524         }
2525
2526         memcpy(uuid->uuid, cp->uuid, 16);
2527         uuid->svc_hint = cp->svc_hint;
2528         uuid->size = get_uuid_size(cp->uuid);
2529
2530         list_add_tail(&uuid->list, &hdev->uuids);
2531
2532         hci_req_init(&req, hdev);
2533
2534         update_class(&req);
2535         update_eir(&req);
2536
2537         err = hci_req_run(&req, add_uuid_complete);
2538         if (err < 0) {
2539                 if (err != -ENODATA)
2540                         goto failed;
2541
2542                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2543                                    hdev->dev_class, 3);
2544                 goto failed;
2545         }
2546
2547         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2548         if (!cmd) {
2549                 err = -ENOMEM;
2550                 goto failed;
2551         }
2552
2553         err = 0;
2554
2555 failed:
2556         hci_dev_unlock(hdev);
2557         return err;
2558 }
2559
2560 static bool enable_service_cache(struct hci_dev *hdev)
2561 {
2562         if (!hdev_is_powered(hdev))
2563                 return false;
2564
2565         if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2566                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2567                                    CACHE_TIMEOUT);
2568                 return true;
2569         }
2570
2571         return false;
2572 }
2573
2574 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2575 {
2576         BT_DBG("status 0x%02x", status);
2577
2578         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2579 }
2580
2581 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2582                        u16 len)
2583 {
2584         struct mgmt_cp_remove_uuid *cp = data;
2585         struct pending_cmd *cmd;
2586         struct bt_uuid *match, *tmp;
2587         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2588         struct hci_request req;
2589         int err, found;
2590
2591         BT_DBG("request for %s", hdev->name);
2592
2593         hci_dev_lock(hdev);
2594
2595         if (pending_eir_or_class(hdev)) {
2596                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2597                                  MGMT_STATUS_BUSY);
2598                 goto unlock;
2599         }
2600
2601         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2602                 hci_uuids_clear(hdev);
2603
2604                 if (enable_service_cache(hdev)) {
2605                         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2606                                            0, hdev->dev_class, 3);
2607                         goto unlock;
2608                 }
2609
2610                 goto update_class;
2611         }
2612
2613         found = 0;
2614
2615         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2616                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2617                         continue;
2618
2619                 list_del(&match->list);
2620                 kfree(match);
2621                 found++;
2622         }
2623
2624         if (found == 0) {
2625                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2626                                  MGMT_STATUS_INVALID_PARAMS);
2627                 goto unlock;
2628         }
2629
2630 update_class:
2631         hci_req_init(&req, hdev);
2632
2633         update_class(&req);
2634         update_eir(&req);
2635
2636         err = hci_req_run(&req, remove_uuid_complete);
2637         if (err < 0) {
2638                 if (err != -ENODATA)
2639                         goto unlock;
2640
2641                 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2642                                    hdev->dev_class, 3);
2643                 goto unlock;
2644         }
2645
2646         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2647         if (!cmd) {
2648                 err = -ENOMEM;
2649                 goto unlock;
2650         }
2651
2652         err = 0;
2653
2654 unlock:
2655         hci_dev_unlock(hdev);
2656         return err;
2657 }
2658
2659 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2660 {
2661         BT_DBG("status 0x%02x", status);
2662
2663         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2664 }
2665
2666 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2667                          u16 len)
2668 {
2669         struct mgmt_cp_set_dev_class *cp = data;
2670         struct pending_cmd *cmd;
2671         struct hci_request req;
2672         int err;
2673
2674         BT_DBG("request for %s", hdev->name);
2675
2676         if (!lmp_bredr_capable(hdev))
2677                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2678                                   MGMT_STATUS_NOT_SUPPORTED);
2679
2680         hci_dev_lock(hdev);
2681
2682         if (pending_eir_or_class(hdev)) {
2683                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2684                                  MGMT_STATUS_BUSY);
2685                 goto unlock;
2686         }
2687
2688         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2689                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2690                                  MGMT_STATUS_INVALID_PARAMS);
2691                 goto unlock;
2692         }
2693
2694         hdev->major_class = cp->major;
2695         hdev->minor_class = cp->minor;
2696
2697         if (!hdev_is_powered(hdev)) {
2698                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2699                                    hdev->dev_class, 3);
2700                 goto unlock;
2701         }
2702
2703         hci_req_init(&req, hdev);
2704
2705         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2706                 hci_dev_unlock(hdev);
2707                 cancel_delayed_work_sync(&hdev->service_cache);
2708                 hci_dev_lock(hdev);
2709                 update_eir(&req);
2710         }
2711
2712         update_class(&req);
2713
2714         err = hci_req_run(&req, set_class_complete);
2715         if (err < 0) {
2716                 if (err != -ENODATA)
2717                         goto unlock;
2718
2719                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2720                                    hdev->dev_class, 3);
2721                 goto unlock;
2722         }
2723
2724         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2725         if (!cmd) {
2726                 err = -ENOMEM;
2727                 goto unlock;
2728         }
2729
2730         err = 0;
2731
2732 unlock:
2733         hci_dev_unlock(hdev);
2734         return err;
2735 }
2736
2737 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2738                           u16 len)
2739 {
2740         struct mgmt_cp_load_link_keys *cp = data;
2741         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2742                                    sizeof(struct mgmt_link_key_info));
2743         u16 key_count, expected_len;
2744         bool changed;
2745         int i;
2746
2747         BT_DBG("request for %s", hdev->name);
2748
2749         if (!lmp_bredr_capable(hdev))
2750                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2751                                   MGMT_STATUS_NOT_SUPPORTED);
2752
2753         key_count = __le16_to_cpu(cp->key_count);
2754         if (key_count > max_key_count) {
2755                 BT_ERR("load_link_keys: too big key_count value %u",
2756                        key_count);
2757                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2758                                   MGMT_STATUS_INVALID_PARAMS);
2759         }
2760
2761         expected_len = sizeof(*cp) + key_count *
2762                                         sizeof(struct mgmt_link_key_info);
2763         if (expected_len != len) {
2764                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2765                        expected_len, len);
2766                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2767                                   MGMT_STATUS_INVALID_PARAMS);
2768         }
2769
2770         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2771                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2772                                   MGMT_STATUS_INVALID_PARAMS);
2773
2774         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2775                key_count);
2776
2777         for (i = 0; i < key_count; i++) {
2778                 struct mgmt_link_key_info *key = &cp->keys[i];
2779
2780                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2781                         return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2782                                           MGMT_STATUS_INVALID_PARAMS);
2783         }
2784
2785         hci_dev_lock(hdev);
2786
2787         hci_link_keys_clear(hdev);
2788
2789         if (cp->debug_keys)
2790                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2791                                             &hdev->dev_flags);
2792         else
2793                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2794                                              &hdev->dev_flags);
2795
2796         if (changed)
2797                 new_settings(hdev, NULL);
2798
2799         for (i = 0; i < key_count; i++) {
2800                 struct mgmt_link_key_info *key = &cp->keys[i];
2801
2802                 /* Always ignore debug keys and require a new pairing if
2803                  * the user wants to use them.
2804                  */
2805                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2806                         continue;
2807
2808                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2809                                  key->type, key->pin_len, NULL);
2810         }
2811
2812         cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2813
2814         hci_dev_unlock(hdev);
2815
2816         return 0;
2817 }
2818
2819 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2820                            u8 addr_type, struct sock *skip_sk)
2821 {
2822         struct mgmt_ev_device_unpaired ev;
2823
2824         bacpy(&ev.addr.bdaddr, bdaddr);
2825         ev.addr.type = addr_type;
2826
2827         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2828                           skip_sk);
2829 }
2830
2831 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2832                          u16 len)
2833 {
2834         struct mgmt_cp_unpair_device *cp = data;
2835         struct mgmt_rp_unpair_device rp;
2836         struct hci_cp_disconnect dc;
2837         struct pending_cmd *cmd;
2838         struct hci_conn *conn;
2839         int err;
2840
2841         memset(&rp, 0, sizeof(rp));
2842         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2843         rp.addr.type = cp->addr.type;
2844
2845         if (!bdaddr_type_is_valid(cp->addr.type))
2846                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2847                                     MGMT_STATUS_INVALID_PARAMS,
2848                                     &rp, sizeof(rp));
2849
2850         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2851                 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2852                                     MGMT_STATUS_INVALID_PARAMS,
2853                                     &rp, sizeof(rp));
2854
2855         hci_dev_lock(hdev);
2856
2857         if (!hdev_is_powered(hdev)) {
2858                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2859                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2860                 goto unlock;
2861         }
2862
2863         if (cp->addr.type == BDADDR_BREDR) {
2864                 /* If disconnection is requested, then look up the
2865                  * connection. If the remote device is connected, it
2866                  * will be later used to terminate the link.
2867                  *
2868                  * Setting it to NULL explicitly will cause no
2869                  * termination of the link.
2870                  */
2871                 if (cp->disconnect)
2872                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2873                                                        &cp->addr.bdaddr);
2874                 else
2875                         conn = NULL;
2876
2877                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2878         } else {
2879                 u8 addr_type;
2880
2881                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2882                                                &cp->addr.bdaddr);
2883                 if (conn) {
2884                         /* Defer clearing up the connection parameters
2885                          * until closing to give a chance of keeping
2886                          * them if a repairing happens.
2887                          */
2888                         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2889
2890                         /* If disconnection is not requested, then
2891                          * clear the connection variable so that the
2892                          * link is not terminated.
2893                          */
2894                         if (!cp->disconnect)
2895                                 conn = NULL;
2896                 }
2897
2898                 if (cp->addr.type == BDADDR_LE_PUBLIC)
2899                         addr_type = ADDR_LE_DEV_PUBLIC;
2900                 else
2901                         addr_type = ADDR_LE_DEV_RANDOM;
2902
2903                 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2904
2905                 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2906         }
2907
2908         if (err < 0) {
2909                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2910                                    MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2911                 goto unlock;
2912         }
2913
2914         /* If the connection variable is set, then termination of the
2915          * link is requested.
2916          */
2917         if (!conn) {
2918                 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2919                                    &rp, sizeof(rp));
2920                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2921                 goto unlock;
2922         }
2923
2924         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2925                                sizeof(*cp));
2926         if (!cmd) {
2927                 err = -ENOMEM;
2928                 goto unlock;
2929         }
2930
2931         cmd->cmd_complete = addr_cmd_complete;
2932
2933         dc.handle = cpu_to_le16(conn->handle);
2934         dc.reason = 0x13; /* Remote User Terminated Connection */
2935         err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2936         if (err < 0)
2937                 mgmt_pending_remove(cmd);
2938
2939 unlock:
2940         hci_dev_unlock(hdev);
2941         return err;
2942 }
2943
2944 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2945                       u16 len)
2946 {
2947         struct mgmt_cp_disconnect *cp = data;
2948         struct mgmt_rp_disconnect rp;
2949         struct pending_cmd *cmd;
2950         struct hci_conn *conn;
2951         int err;
2952
2953         BT_DBG("");
2954
2955         memset(&rp, 0, sizeof(rp));
2956         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2957         rp.addr.type = cp->addr.type;
2958
2959         if (!bdaddr_type_is_valid(cp->addr.type))
2960                 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2961                                     MGMT_STATUS_INVALID_PARAMS,
2962                                     &rp, sizeof(rp));
2963
2964         hci_dev_lock(hdev);
2965
2966         if (!test_bit(HCI_UP, &hdev->flags)) {
2967                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2968                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2969                 goto failed;
2970         }
2971
2972         if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2973                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2974                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
2975                 goto failed;
2976         }
2977
2978         if (cp->addr.type == BDADDR_BREDR)
2979                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2980                                                &cp->addr.bdaddr);
2981         else
2982                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2983
2984         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2985                 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2986                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2987                 goto failed;
2988         }
2989
2990         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2991         if (!cmd) {
2992                 err = -ENOMEM;
2993                 goto failed;
2994         }
2995
2996         cmd->cmd_complete = generic_cmd_complete;
2997
2998         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2999         if (err < 0)
3000                 mgmt_pending_remove(cmd);
3001
3002 failed:
3003         hci_dev_unlock(hdev);
3004         return err;
3005 }
3006
3007 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3008 {
3009         switch (link_type) {
3010         case LE_LINK:
3011                 switch (addr_type) {
3012                 case ADDR_LE_DEV_PUBLIC:
3013                         return BDADDR_LE_PUBLIC;
3014
3015                 default:
3016                         /* Fallback to LE Random address type */
3017                         return BDADDR_LE_RANDOM;
3018                 }
3019
3020         default:
3021                 /* Fallback to BR/EDR type */
3022                 return BDADDR_BREDR;
3023         }
3024 }
3025
3026 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3027                            u16 data_len)
3028 {
3029         struct mgmt_rp_get_connections *rp;
3030         struct hci_conn *c;
3031         size_t rp_len;
3032         int err;
3033         u16 i;
3034
3035         BT_DBG("");
3036
3037         hci_dev_lock(hdev);
3038
3039         if (!hdev_is_powered(hdev)) {
3040                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3041                                  MGMT_STATUS_NOT_POWERED);
3042                 goto unlock;
3043         }
3044
3045         i = 0;
3046         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3047                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3048                         i++;
3049         }
3050
3051         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3052         rp = kmalloc(rp_len, GFP_KERNEL);
3053         if (!rp) {
3054                 err = -ENOMEM;
3055                 goto unlock;
3056         }
3057
3058         i = 0;
3059         list_for_each_entry(c, &hdev->conn_hash.list, list) {
3060                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3061                         continue;
3062                 bacpy(&rp->addr[i].bdaddr, &c->dst);
3063                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3064                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3065                         continue;
3066                 i++;
3067         }
3068
3069         rp->conn_count = cpu_to_le16(i);
3070
3071         /* Recalculate length in case of filtered SCO connections, etc */
3072         rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
3073
3074         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3075                            rp_len);
3076
3077         kfree(rp);
3078
3079 unlock:
3080         hci_dev_unlock(hdev);
3081         return err;
3082 }
3083
3084 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3085                                    struct mgmt_cp_pin_code_neg_reply *cp)
3086 {
3087         struct pending_cmd *cmd;
3088         int err;
3089
3090         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3091                                sizeof(*cp));
3092         if (!cmd)
3093                 return -ENOMEM;
3094
3095         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3096                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3097         if (err < 0)
3098                 mgmt_pending_remove(cmd);
3099
3100         return err;
3101 }
3102
3103 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3104                           u16 len)
3105 {
3106         struct hci_conn *conn;
3107         struct mgmt_cp_pin_code_reply *cp = data;
3108         struct hci_cp_pin_code_reply reply;
3109         struct pending_cmd *cmd;
3110         int err;
3111
3112         BT_DBG("");
3113
3114         hci_dev_lock(hdev);
3115
3116         if (!hdev_is_powered(hdev)) {
3117                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3118                                  MGMT_STATUS_NOT_POWERED);
3119                 goto failed;
3120         }
3121
3122         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3123         if (!conn) {
3124                 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3125                                  MGMT_STATUS_NOT_CONNECTED);
3126                 goto failed;
3127         }
3128
3129         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3130                 struct mgmt_cp_pin_code_neg_reply ncp;
3131
3132                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3133
3134                 BT_ERR("PIN code is not 16 bytes long");
3135
3136                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3137                 if (err >= 0)
3138                         err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3139                                          MGMT_STATUS_INVALID_PARAMS);
3140
3141                 goto failed;
3142         }
3143
3144         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3145         if (!cmd) {
3146                 err = -ENOMEM;
3147                 goto failed;
3148         }
3149
3150         cmd->cmd_complete = addr_cmd_complete;
3151
3152         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3153         reply.pin_len = cp->pin_len;
3154         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3155
3156         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3157         if (err < 0)
3158                 mgmt_pending_remove(cmd);
3159
3160 failed:
3161         hci_dev_unlock(hdev);
3162         return err;
3163 }
3164
3165 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3166                              u16 len)
3167 {
3168         struct mgmt_cp_set_io_capability *cp = data;
3169
3170         BT_DBG("");
3171
3172         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3173                 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3174                                     MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3175
3176         hci_dev_lock(hdev);
3177
3178         hdev->io_capability = cp->io_capability;
3179
3180         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3181                hdev->io_capability);
3182
3183         hci_dev_unlock(hdev);
3184
3185         return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3186                             0);
3187 }
3188
3189 static struct pending_cmd *find_pairing(struct hci_conn *conn)
3190 {
3191         struct hci_dev *hdev = conn->hdev;
3192         struct pending_cmd *cmd;
3193
3194         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3195                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3196                         continue;
3197
3198                 if (cmd->user_data != conn)
3199                         continue;
3200
3201                 return cmd;
3202         }
3203
3204         return NULL;
3205 }
3206
3207 static int pairing_complete(struct pending_cmd *cmd, u8 status)
3208 {
3209         struct mgmt_rp_pair_device rp;
3210         struct hci_conn *conn = cmd->user_data;
3211         int err;
3212
3213         bacpy(&rp.addr.bdaddr, &conn->dst);
3214         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3215
3216         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3217                            &rp, sizeof(rp));
3218
3219         /* So we don't get further callbacks for this connection */
3220         conn->connect_cfm_cb = NULL;
3221         conn->security_cfm_cb = NULL;
3222         conn->disconn_cfm_cb = NULL;
3223
3224         hci_conn_drop(conn);
3225
3226         /* The device is paired so there is no need to remove
3227          * its connection parameters anymore.
3228          */
3229         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3230
3231         hci_conn_put(conn);
3232
3233         return err;
3234 }
3235
3236 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3237 {
3238         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3239         struct pending_cmd *cmd;
3240
3241         cmd = find_pairing(conn);
3242         if (cmd) {
3243                 cmd->cmd_complete(cmd, status);
3244                 mgmt_pending_remove(cmd);
3245         }
3246 }
3247
3248 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3249 {
3250         struct pending_cmd *cmd;
3251
3252         BT_DBG("status %u", status);
3253
3254         cmd = find_pairing(conn);
3255         if (!cmd) {
3256                 BT_DBG("Unable to find a pending command");
3257                 return;
3258         }
3259
3260         cmd->cmd_complete(cmd, mgmt_status(status));
3261         mgmt_pending_remove(cmd);
3262 }
3263
3264 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3265 {
3266         struct pending_cmd *cmd;
3267
3268         BT_DBG("status %u", status);
3269
3270         if (!status)
3271                 return;
3272
3273         cmd = find_pairing(conn);
3274         if (!cmd) {
3275                 BT_DBG("Unable to find a pending command");
3276                 return;
3277         }
3278
3279         cmd->cmd_complete(cmd, mgmt_status(status));
3280         mgmt_pending_remove(cmd);
3281 }
3282
3283 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3284                        u16 len)
3285 {
3286         struct mgmt_cp_pair_device *cp = data;
3287         struct mgmt_rp_pair_device rp;
3288         struct pending_cmd *cmd;
3289         u8 sec_level, auth_type;
3290         struct hci_conn *conn;
3291         int err;
3292
3293         BT_DBG("");
3294
3295         memset(&rp, 0, sizeof(rp));
3296         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3297         rp.addr.type = cp->addr.type;
3298
3299         if (!bdaddr_type_is_valid(cp->addr.type))
3300                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3301                                     MGMT_STATUS_INVALID_PARAMS,
3302                                     &rp, sizeof(rp));
3303
3304         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3305                 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3306                                     MGMT_STATUS_INVALID_PARAMS,
3307                                     &rp, sizeof(rp));
3308
3309         hci_dev_lock(hdev);
3310
3311         if (!hdev_is_powered(hdev)) {
3312                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3313                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3314                 goto unlock;
3315         }
3316
3317         sec_level = BT_SECURITY_MEDIUM;
3318         auth_type = HCI_AT_DEDICATED_BONDING;
3319
3320         if (cp->addr.type == BDADDR_BREDR) {
3321                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3322                                        auth_type);
3323         } else {
3324                 u8 addr_type;
3325
3326                 /* Convert from L2CAP channel address type to HCI address type
3327                  */
3328                 if (cp->addr.type == BDADDR_LE_PUBLIC)
3329                         addr_type = ADDR_LE_DEV_PUBLIC;
3330                 else
3331                         addr_type = ADDR_LE_DEV_RANDOM;
3332
3333                 /* When pairing a new device, it is expected to remember
3334                  * this device for future connections. Adding the connection
3335                  * parameter information ahead of time allows tracking
3336                  * of the slave preferred values and will speed up any
3337                  * further connection establishment.
3338                  *
3339                  * If connection parameters already exist, then they
3340                  * will be kept and this function does nothing.
3341                  */
3342                 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3343
3344                 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3345                                       sec_level, HCI_LE_CONN_TIMEOUT,
3346                                       HCI_ROLE_MASTER);
3347         }
3348
3349         if (IS_ERR(conn)) {
3350                 int status;
3351
3352                 if (PTR_ERR(conn) == -EBUSY)
3353                         status = MGMT_STATUS_BUSY;
3354                 else
3355                         status = MGMT_STATUS_CONNECT_FAILED;
3356
3357                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3358                                    status, &rp,
3359                                    sizeof(rp));
3360                 goto unlock;
3361         }
3362
3363         if (conn->connect_cfm_cb) {
3364                 hci_conn_drop(conn);
3365                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3366                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
3367                 goto unlock;
3368         }
3369
3370         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3371         if (!cmd) {
3372                 err = -ENOMEM;
3373                 hci_conn_drop(conn);
3374                 goto unlock;
3375         }
3376
3377         cmd->cmd_complete = pairing_complete;
3378
3379         /* For LE, just connecting isn't a proof that the pairing finished */
3380         if (cp->addr.type == BDADDR_BREDR) {
3381                 conn->connect_cfm_cb = pairing_complete_cb;
3382                 conn->security_cfm_cb = pairing_complete_cb;
3383                 conn->disconn_cfm_cb = pairing_complete_cb;
3384         } else {
3385                 conn->connect_cfm_cb = le_pairing_complete_cb;
3386                 conn->security_cfm_cb = le_pairing_complete_cb;
3387                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3388         }
3389
3390         conn->io_capability = cp->io_cap;
3391         cmd->user_data = hci_conn_get(conn);
3392
3393         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3394             hci_conn_security(conn, sec_level, auth_type, true)) {
3395                 cmd->cmd_complete(cmd, 0);
3396                 mgmt_pending_remove(cmd);
3397         }
3398
3399         err = 0;
3400
3401 unlock:
3402         hci_dev_unlock(hdev);
3403         return err;
3404 }
3405
3406 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3407                               u16 len)
3408 {
3409         struct mgmt_addr_info *addr = data;
3410         struct pending_cmd *cmd;
3411         struct hci_conn *conn;
3412         int err;
3413
3414         BT_DBG("");
3415
3416         hci_dev_lock(hdev);
3417
3418         if (!hdev_is_powered(hdev)) {
3419                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3420                                  MGMT_STATUS_NOT_POWERED);
3421                 goto unlock;
3422         }
3423
3424         cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3425         if (!cmd) {
3426                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3427                                  MGMT_STATUS_INVALID_PARAMS);
3428                 goto unlock;
3429         }
3430
3431         conn = cmd->user_data;
3432
3433         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3434                 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3435                                  MGMT_STATUS_INVALID_PARAMS);
3436                 goto unlock;
3437         }
3438
3439         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3440         mgmt_pending_remove(cmd);
3441
3442         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3443                            addr, sizeof(*addr));
3444 unlock:
3445         hci_dev_unlock(hdev);
3446         return err;
3447 }
3448
3449 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3450                              struct mgmt_addr_info *addr, u16 mgmt_op,
3451                              u16 hci_op, __le32 passkey)
3452 {
3453         struct pending_cmd *cmd;
3454         struct hci_conn *conn;
3455         int err;
3456
3457         hci_dev_lock(hdev);
3458
3459         if (!hdev_is_powered(hdev)) {
3460                 err = cmd_complete(sk, hdev->id, mgmt_op,
3461                                    MGMT_STATUS_NOT_POWERED, addr,
3462                                    sizeof(*addr));
3463                 goto done;
3464         }
3465
3466         if (addr->type == BDADDR_BREDR)
3467                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3468         else
3469                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3470
3471         if (!conn) {
3472                 err = cmd_complete(sk, hdev->id, mgmt_op,
3473                                    MGMT_STATUS_NOT_CONNECTED, addr,
3474                                    sizeof(*addr));
3475                 goto done;
3476         }
3477
3478         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3479                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3480                 if (!err)
3481                         err = cmd_complete(sk, hdev->id, mgmt_op,
3482                                            MGMT_STATUS_SUCCESS, addr,
3483                                            sizeof(*addr));
3484                 else
3485                         err = cmd_complete(sk, hdev->id, mgmt_op,
3486                                            MGMT_STATUS_FAILED, addr,
3487                                            sizeof(*addr));
3488
3489                 goto done;
3490         }
3491
3492         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3493         if (!cmd) {
3494                 err = -ENOMEM;
3495                 goto done;
3496         }
3497
3498         cmd->cmd_complete = addr_cmd_complete;
3499
3500         /* Continue with pairing via HCI */
3501         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3502                 struct hci_cp_user_passkey_reply cp;
3503
3504                 bacpy(&cp.bdaddr, &addr->bdaddr);
3505                 cp.passkey = passkey;
3506                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3507         } else
3508                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3509                                    &addr->bdaddr);
3510
3511         if (err < 0)
3512                 mgmt_pending_remove(cmd);
3513
3514 done:
3515         hci_dev_unlock(hdev);
3516         return err;
3517 }
3518
3519 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3520                               void *data, u16 len)
3521 {
3522         struct mgmt_cp_pin_code_neg_reply *cp = data;
3523
3524         BT_DBG("");
3525
3526         return user_pairing_resp(sk, hdev, &cp->addr,
3527                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3528                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3529 }
3530
3531 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3532                               u16 len)
3533 {
3534         struct mgmt_cp_user_confirm_reply *cp = data;
3535
3536         BT_DBG("");
3537
3538         if (len != sizeof(*cp))
3539                 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3540                                   MGMT_STATUS_INVALID_PARAMS);
3541
3542         return user_pairing_resp(sk, hdev, &cp->addr,
3543                                  MGMT_OP_USER_CONFIRM_REPLY,
3544                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3545 }
3546
3547 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3548                                   void *data, u16 len)
3549 {
3550         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3551
3552         BT_DBG("");
3553
3554         return user_pairing_resp(sk, hdev, &cp->addr,
3555                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3556                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3557 }
3558
3559 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3560                               u16 len)
3561 {
3562         struct mgmt_cp_user_passkey_reply *cp = data;
3563
3564         BT_DBG("");
3565
3566         return user_pairing_resp(sk, hdev, &cp->addr,
3567                                  MGMT_OP_USER_PASSKEY_REPLY,
3568                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3569 }
3570
3571 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3572                                   void *data, u16 len)
3573 {
3574         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3575
3576         BT_DBG("");
3577
3578         return user_pairing_resp(sk, hdev, &cp->addr,
3579                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3580                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3581 }
3582
3583 static void update_name(struct hci_request *req)
3584 {
3585         struct hci_dev *hdev = req->hdev;
3586         struct hci_cp_write_local_name cp;
3587
3588         memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3589
3590         hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3591 }
3592
3593 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3594 {
3595         struct mgmt_cp_set_local_name *cp;
3596         struct pending_cmd *cmd;
3597
3598         BT_DBG("status 0x%02x", status);
3599
3600         hci_dev_lock(hdev);
3601
3602         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3603         if (!cmd)
3604                 goto unlock;
3605
3606         cp = cmd->param;
3607
3608         if (status)
3609                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3610                            mgmt_status(status));
3611         else
3612                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3613                              cp, sizeof(*cp));
3614
3615         mgmt_pending_remove(cmd);
3616
3617 unlock:
3618         hci_dev_unlock(hdev);
3619 }
3620
3621 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3622                           u16 len)
3623 {
3624         struct mgmt_cp_set_local_name *cp = data;
3625         struct pending_cmd *cmd;
3626         struct hci_request req;
3627         int err;
3628
3629         BT_DBG("");
3630
3631         hci_dev_lock(hdev);
3632
3633         /* If the old values are the same as the new ones just return a
3634          * direct command complete event.
3635          */
3636         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3637             !memcmp(hdev->short_name, cp->short_name,
3638                     sizeof(hdev->short_name))) {
3639                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3640                                    data, len);
3641                 goto failed;
3642         }
3643
3644         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3645
3646         if (!hdev_is_powered(hdev)) {
3647                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3648
3649                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3650                                    data, len);
3651                 if (err < 0)
3652                         goto failed;
3653
3654                 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3655                                  sk);
3656
3657                 goto failed;
3658         }
3659
3660         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3661         if (!cmd) {
3662                 err = -ENOMEM;
3663                 goto failed;
3664         }
3665
3666         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3667
3668         hci_req_init(&req, hdev);
3669
3670         if (lmp_bredr_capable(hdev)) {
3671                 update_name(&req);
3672                 update_eir(&req);
3673         }
3674
3675         /* The name is stored in the scan response data and so
3676          * no need to udpate the advertising data here.
3677          */
3678         if (lmp_le_capable(hdev))
3679                 update_scan_rsp_data(&req);
3680
3681         err = hci_req_run(&req, set_name_complete);
3682         if (err < 0)
3683                 mgmt_pending_remove(cmd);
3684
3685 failed:
3686         hci_dev_unlock(hdev);
3687         return err;
3688 }
3689
3690 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3691                                void *data, u16 data_len)
3692 {
3693         struct pending_cmd *cmd;
3694         int err;
3695
3696         BT_DBG("%s", hdev->name);
3697
3698         hci_dev_lock(hdev);
3699
3700         if (!hdev_is_powered(hdev)) {
3701                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3702                                  MGMT_STATUS_NOT_POWERED);
3703                 goto unlock;
3704         }
3705
3706         if (!lmp_ssp_capable(hdev)) {
3707                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3708                                  MGMT_STATUS_NOT_SUPPORTED);
3709                 goto unlock;
3710         }
3711
3712         if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3713                 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3714                                  MGMT_STATUS_BUSY);
3715                 goto unlock;
3716         }
3717
3718         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3719         if (!cmd) {
3720                 err = -ENOMEM;
3721                 goto unlock;
3722         }
3723
3724         if (bredr_sc_enabled(hdev))
3725                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3726                                    0, NULL);
3727         else
3728                 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3729
3730         if (err < 0)
3731                 mgmt_pending_remove(cmd);
3732
3733 unlock:
3734         hci_dev_unlock(hdev);
3735         return err;
3736 }
3737
3738 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3739                                void *data, u16 len)
3740 {
3741         struct mgmt_addr_info *addr = data;
3742         int err;
3743
3744         BT_DBG("%s ", hdev->name);
3745
3746         if (!bdaddr_type_is_valid(addr->type))
3747                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3748                                     MGMT_STATUS_INVALID_PARAMS, addr,
3749                                     sizeof(*addr));
3750
3751         hci_dev_lock(hdev);
3752
3753         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3754                 struct mgmt_cp_add_remote_oob_data *cp = data;
3755                 u8 status;
3756
3757                 if (cp->addr.type != BDADDR_BREDR) {
3758                         err = cmd_complete(sk, hdev->id,
3759                                            MGMT_OP_ADD_REMOTE_OOB_DATA,
3760                                            MGMT_STATUS_INVALID_PARAMS,
3761                                            &cp->addr, sizeof(cp->addr));
3762                         goto unlock;
3763                 }
3764
3765                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3766                                               cp->addr.type, cp->hash,
3767                                               cp->rand, NULL, NULL);
3768                 if (err < 0)
3769                         status = MGMT_STATUS_FAILED;
3770                 else
3771                         status = MGMT_STATUS_SUCCESS;
3772
3773                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3774                                    status, &cp->addr, sizeof(cp->addr));
3775         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3776                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3777                 u8 *rand192, *hash192;
3778                 u8 status;
3779
3780                 if (bdaddr_type_is_le(cp->addr.type)) {
3781                         /* Enforce zero-valued 192-bit parameters as
3782                          * long as legacy SMP OOB isn't implemented.
3783                          */
3784                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3785                             memcmp(cp->hash192, ZERO_KEY, 16)) {
3786                                 err = cmd_complete(sk, hdev->id,
3787                                                    MGMT_OP_ADD_REMOTE_OOB_DATA,
3788                                                    MGMT_STATUS_INVALID_PARAMS,
3789                                                    addr, sizeof(*addr));
3790                                 goto unlock;
3791                         }
3792
3793                         rand192 = NULL;
3794                         hash192 = NULL;
3795                 } else {
3796                         rand192 = cp->rand192;
3797                         hash192 = cp->hash192;
3798                 }
3799
3800                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3801                                               cp->addr.type, hash192, rand192,
3802                                               cp->hash256, cp->rand256);
3803                 if (err < 0)
3804                         status = MGMT_STATUS_FAILED;
3805                 else
3806                         status = MGMT_STATUS_SUCCESS;
3807
3808                 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3809                                    status, &cp->addr, sizeof(cp->addr));
3810         } else {
3811                 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3812                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3813                                  MGMT_STATUS_INVALID_PARAMS);
3814         }
3815
3816 unlock:
3817         hci_dev_unlock(hdev);
3818         return err;
3819 }
3820
3821 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3822                                   void *data, u16 len)
3823 {
3824         struct mgmt_cp_remove_remote_oob_data *cp = data;
3825         u8 status;
3826         int err;
3827
3828         BT_DBG("%s", hdev->name);
3829
3830         if (cp->addr.type != BDADDR_BREDR)
3831                 return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3832                                     MGMT_STATUS_INVALID_PARAMS,
3833                                     &cp->addr, sizeof(cp->addr));
3834
3835         hci_dev_lock(hdev);
3836
3837         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3838                 hci_remote_oob_data_clear(hdev);
3839                 status = MGMT_STATUS_SUCCESS;
3840                 goto done;
3841         }
3842
3843         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3844         if (err < 0)
3845                 status = MGMT_STATUS_INVALID_PARAMS;
3846         else
3847                 status = MGMT_STATUS_SUCCESS;
3848
3849 done:
3850         err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3851                            status, &cp->addr, sizeof(cp->addr));
3852
3853         hci_dev_unlock(hdev);
3854         return err;
3855 }
3856
3857 static bool trigger_discovery(struct hci_request *req, u8 *status)
3858 {
3859         struct hci_dev *hdev = req->hdev;
3860         struct hci_cp_le_set_scan_param param_cp;
3861         struct hci_cp_le_set_scan_enable enable_cp;
3862         struct hci_cp_inquiry inq_cp;
3863         /* General inquiry access code (GIAC) */
3864         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3865         u8 own_addr_type;
3866         int err;
3867
3868         switch (hdev->discovery.type) {
3869         case DISCOV_TYPE_BREDR:
3870                 *status = mgmt_bredr_support(hdev);
3871                 if (*status)
3872                         return false;
3873
3874                 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3875                         *status = MGMT_STATUS_BUSY;
3876                         return false;
3877                 }
3878
3879                 hci_inquiry_cache_flush(hdev);
3880
3881                 memset(&inq_cp, 0, sizeof(inq_cp));
3882                 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3883                 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3884                 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3885                 break;
3886
3887         case DISCOV_TYPE_LE:
3888         case DISCOV_TYPE_INTERLEAVED:
3889                 *status = mgmt_le_support(hdev);
3890                 if (*status)
3891                         return false;
3892
3893                 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3894                     !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3895                         *status = MGMT_STATUS_NOT_SUPPORTED;
3896                         return false;
3897                 }
3898
3899                 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3900                         /* Don't let discovery abort an outgoing
3901                          * connection attempt that's using directed
3902                          * advertising.
3903                          */
3904                         if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3905                                                        BT_CONNECT)) {
3906                                 *status = MGMT_STATUS_REJECTED;
3907                                 return false;
3908                         }
3909
3910                         disable_advertising(req);
3911                 }
3912
3913                 /* If controller is scanning, it means the background scanning
3914                  * is running. Thus, we should temporarily stop it in order to
3915                  * set the discovery scanning parameters.
3916                  */
3917                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3918                         hci_req_add_le_scan_disable(req);
3919
3920                 memset(&param_cp, 0, sizeof(param_cp));
3921
3922                 /* All active scans will be done with either a resolvable
3923                  * private address (when privacy feature has been enabled)
3924                  * or non-resolvable private address.
3925                  */
3926                 err = hci_update_random_address(req, true, &own_addr_type);
3927                 if (err < 0) {
3928                         *status = MGMT_STATUS_FAILED;
3929                         return false;
3930                 }
3931
3932                 param_cp.type = LE_SCAN_ACTIVE;
3933                 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3934                 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3935                 param_cp.own_address_type = own_addr_type;
3936                 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3937                             &param_cp);
3938
3939                 memset(&enable_cp, 0, sizeof(enable_cp));
3940                 enable_cp.enable = LE_SCAN_ENABLE;
3941                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3942                 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3943                             &enable_cp);
3944                 break;
3945
3946         default:
3947                 *status = MGMT_STATUS_INVALID_PARAMS;
3948                 return false;
3949         }
3950
3951         return true;
3952 }
3953
3954 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
3955                                      u16 opcode)
3956 {
3957         struct pending_cmd *cmd;
3958         unsigned long timeout;
3959
3960         BT_DBG("status %d", status);
3961
3962         hci_dev_lock(hdev);
3963
3964         cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3965         if (!cmd)
3966                 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3967
3968         if (cmd) {
3969                 cmd->cmd_complete(cmd, mgmt_status(status));
3970                 mgmt_pending_remove(cmd);
3971         }
3972
3973         if (status) {
3974                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3975                 goto unlock;
3976         }
3977
3978         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3979
3980         switch (hdev->discovery.type) {
3981         case DISCOV_TYPE_LE:
3982                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3983                 break;
3984         case DISCOV_TYPE_INTERLEAVED:
3985                 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3986                 break;
3987         case DISCOV_TYPE_BREDR:
3988                 timeout = 0;
3989                 break;
3990         default:
3991                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3992                 timeout = 0;
3993                 break;
3994         }
3995
3996         if (timeout)
3997                 queue_delayed_work(hdev->workqueue,
3998                                    &hdev->le_scan_disable, timeout);
3999
4000 unlock:
4001         hci_dev_unlock(hdev);
4002 }
4003
4004 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4005                            void *data, u16 len)
4006 {
4007         struct mgmt_cp_start_discovery *cp = data;
4008         struct pending_cmd *cmd;
4009         struct hci_request req;
4010         u8 status;
4011         int err;
4012
4013         BT_DBG("%s", hdev->name);
4014
4015         hci_dev_lock(hdev);
4016
4017         if (!hdev_is_powered(hdev)) {
4018                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4019                                    MGMT_STATUS_NOT_POWERED,
4020                                    &cp->type, sizeof(cp->type));
4021                 goto failed;
4022         }
4023
4024         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4025             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
4026                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4027                                    MGMT_STATUS_BUSY, &cp->type,
4028                                    sizeof(cp->type));
4029                 goto failed;
4030         }
4031
4032         cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
4033         if (!cmd) {
4034                 err = -ENOMEM;
4035                 goto failed;
4036         }
4037
4038         cmd->cmd_complete = generic_cmd_complete;
4039
4040         /* Clear the discovery filter first to free any previously
4041          * allocated memory for the UUID list.
4042          */
4043         hci_discovery_filter_clear(hdev);
4044
4045         hdev->discovery.type = cp->type;
4046         hdev->discovery.report_invalid_rssi = false;
4047
4048         hci_req_init(&req, hdev);
4049
4050         if (!trigger_discovery(&req, &status)) {
4051                 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4052                                    status, &cp->type, sizeof(cp->type));
4053                 mgmt_pending_remove(cmd);
4054                 goto failed;
4055         }
4056
4057         err = hci_req_run(&req, start_discovery_complete);
4058         if (err < 0) {
4059                 mgmt_pending_remove(cmd);
4060                 goto failed;
4061         }
4062
4063         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4064
4065 failed:
4066         hci_dev_unlock(hdev);
4067         return err;
4068 }
4069
4070 static int service_discovery_cmd_complete(struct pending_cmd *cmd, u8 status)
4071 {
4072         return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4073                             cmd->param, 1);
4074 }
4075
4076 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4077                                    void *data, u16 len)
4078 {
4079         struct mgmt_cp_start_service_discovery *cp = data;
4080         struct pending_cmd *cmd;
4081         struct hci_request req;
4082         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4083         u16 uuid_count, expected_len;
4084         u8 status;
4085         int err;
4086
4087         BT_DBG("%s", hdev->name);
4088
4089         hci_dev_lock(hdev);
4090
4091         if (!hdev_is_powered(hdev)) {
4092                 err = cmd_complete(sk, hdev->id,
4093                                    MGMT_OP_START_SERVICE_DISCOVERY,
4094                                    MGMT_STATUS_NOT_POWERED,
4095                                    &cp->type, sizeof(cp->type));
4096                 goto failed;
4097         }
4098
4099         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4100             test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
4101                 err = cmd_complete(sk, hdev->id,
4102                                    MGMT_OP_START_SERVICE_DISCOVERY,
4103                                    MGMT_STATUS_BUSY, &cp->type,
4104                                    sizeof(cp->type));
4105                 goto failed;
4106         }
4107
4108         uuid_count = __le16_to_cpu(cp->uuid_count);
4109         if (uuid_count > max_uuid_count) {
4110                 BT_ERR("service_discovery: too big uuid_count value %u",
4111                        uuid_count);
4112                 err = cmd_complete(sk, hdev->id,
4113                                    MGMT_OP_START_SERVICE_DISCOVERY,
4114                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
4115                                    sizeof(cp->type));
4116                 goto failed;
4117         }
4118
4119         expected_len = sizeof(*cp) + uuid_count * 16;
4120         if (expected_len != len) {
4121                 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4122                        expected_len, len);
4123                 err = cmd_complete(sk, hdev->id,
4124                                    MGMT_OP_START_SERVICE_DISCOVERY,
4125                                    MGMT_STATUS_INVALID_PARAMS, &cp->type,
4126                                    sizeof(cp->type));
4127                 goto failed;
4128         }
4129
4130         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4131                                hdev, data, len);
4132         if (!cmd) {
4133                 err = -ENOMEM;
4134                 goto failed;
4135         }
4136
4137         cmd->cmd_complete = service_discovery_cmd_complete;
4138
4139         /* Clear the discovery filter first to free any previously
4140          * allocated memory for the UUID list.
4141          */
4142         hci_discovery_filter_clear(hdev);
4143
4144         hdev->discovery.type = cp->type;
4145         hdev->discovery.rssi = cp->rssi;
4146         hdev->discovery.uuid_count = uuid_count;
4147
4148         if (uuid_count > 0) {
4149                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4150                                                 GFP_KERNEL);
4151                 if (!hdev->discovery.uuids) {
4152                         err = cmd_complete(sk, hdev->id,
4153                                            MGMT_OP_START_SERVICE_DISCOVERY,
4154                                            MGMT_STATUS_FAILED,
4155                                            &cp->type, sizeof(cp->type));
4156                         mgmt_pending_remove(cmd);
4157                         goto failed;
4158                 }
4159         }
4160
4161         hci_req_init(&req, hdev);
4162
4163         if (!trigger_discovery(&req, &status)) {
4164                 err = cmd_complete(sk, hdev->id,
4165                                    MGMT_OP_START_SERVICE_DISCOVERY,
4166                                    status, &cp->type, sizeof(cp->type));
4167                 mgmt_pending_remove(cmd);
4168                 goto failed;
4169         }
4170
4171         err = hci_req_run(&req, start_discovery_complete);
4172         if (err < 0) {
4173                 mgmt_pending_remove(cmd);
4174                 goto failed;
4175         }
4176
4177         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4178
4179 failed:
4180         hci_dev_unlock(hdev);
4181         return err;
4182 }
4183
4184 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4185 {
4186         struct pending_cmd *cmd;
4187
4188         BT_DBG("status %d", status);
4189
4190         hci_dev_lock(hdev);
4191
4192         cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4193         if (cmd) {
4194                 cmd->cmd_complete(cmd, mgmt_status(status));
4195                 mgmt_pending_remove(cmd);
4196         }
4197
4198         if (!status)
4199                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4200
4201         hci_dev_unlock(hdev);
4202 }
4203
4204 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4205                           u16 len)
4206 {
4207         struct mgmt_cp_stop_discovery *mgmt_cp = data;
4208         struct pending_cmd *cmd;
4209         struct hci_request req;
4210         int err;
4211
4212         BT_DBG("%s", hdev->name);
4213
4214         hci_dev_lock(hdev);
4215
4216         if (!hci_discovery_active(hdev)) {
4217                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4218                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
4219                                    sizeof(mgmt_cp->type));
4220                 goto unlock;
4221         }
4222
4223         if (hdev->discovery.type != mgmt_cp->type) {
4224                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4225                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
4226                                    sizeof(mgmt_cp->type));
4227                 goto unlock;
4228         }
4229
4230         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4231         if (!cmd) {
4232                 err = -ENOMEM;
4233                 goto unlock;
4234         }
4235
4236         cmd->cmd_complete = generic_cmd_complete;
4237
4238         hci_req_init(&req, hdev);
4239
4240         hci_stop_discovery(&req);
4241
4242         err = hci_req_run(&req, stop_discovery_complete);
4243         if (!err) {
4244                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4245                 goto unlock;
4246         }
4247
4248         mgmt_pending_remove(cmd);
4249
4250         /* If no HCI commands were sent we're done */
4251         if (err == -ENODATA) {
4252                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4253                                    &mgmt_cp->type, sizeof(mgmt_cp->type));
4254                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4255         }
4256
4257 unlock:
4258         hci_dev_unlock(hdev);
4259         return err;
4260 }
4261
4262 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4263                         u16 len)
4264 {
4265         struct mgmt_cp_confirm_name *cp = data;
4266         struct inquiry_entry *e;
4267         int err;
4268
4269         BT_DBG("%s", hdev->name);
4270
4271         hci_dev_lock(hdev);
4272
4273         if (!hci_discovery_active(hdev)) {
4274                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4275                                    MGMT_STATUS_FAILED, &cp->addr,
4276                                    sizeof(cp->addr));
4277                 goto failed;
4278         }
4279
4280         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4281         if (!e) {
4282                 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4283                                    MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4284                                    sizeof(cp->addr));
4285                 goto failed;
4286         }
4287
4288         if (cp->name_known) {
4289                 e->name_state = NAME_KNOWN;
4290                 list_del(&e->list);
4291         } else {
4292                 e->name_state = NAME_NEEDED;
4293                 hci_inquiry_cache_update_resolve(hdev, e);
4294         }
4295
4296         err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4297                            sizeof(cp->addr));
4298
4299 failed:
4300         hci_dev_unlock(hdev);
4301         return err;
4302 }
4303
4304 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4305                         u16 len)
4306 {
4307         struct mgmt_cp_block_device *cp = data;
4308         u8 status;
4309         int err;
4310
4311         BT_DBG("%s", hdev->name);
4312
4313         if (!bdaddr_type_is_valid(cp->addr.type))
4314                 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4315                                     MGMT_STATUS_INVALID_PARAMS,
4316                                     &cp->addr, sizeof(cp->addr));
4317
4318         hci_dev_lock(hdev);
4319
4320         err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4321                                   cp->addr.type);
4322         if (err < 0) {
4323                 status = MGMT_STATUS_FAILED;
4324                 goto done;
4325         }
4326
4327         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4328                    sk);
4329         status = MGMT_STATUS_SUCCESS;
4330
4331 done:
4332         err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4333                            &cp->addr, sizeof(cp->addr));
4334
4335         hci_dev_unlock(hdev);
4336
4337         return err;
4338 }
4339
4340 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4341                           u16 len)
4342 {
4343         struct mgmt_cp_unblock_device *cp = data;
4344         u8 status;
4345         int err;
4346
4347         BT_DBG("%s", hdev->name);
4348
4349         if (!bdaddr_type_is_valid(cp->addr.type))
4350                 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4351                                     MGMT_STATUS_INVALID_PARAMS,
4352                                     &cp->addr, sizeof(cp->addr));
4353
4354         hci_dev_lock(hdev);
4355
4356         err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4357                                   cp->addr.type);
4358         if (err < 0) {
4359                 status = MGMT_STATUS_INVALID_PARAMS;
4360                 goto done;
4361         }
4362
4363         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4364                    sk);
4365         status = MGMT_STATUS_SUCCESS;
4366
4367 done:
4368         err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4369                            &cp->addr, sizeof(cp->addr));
4370
4371         hci_dev_unlock(hdev);
4372
4373         return err;
4374 }
4375
4376 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4377                          u16 len)
4378 {
4379         struct mgmt_cp_set_device_id *cp = data;
4380         struct hci_request req;
4381         int err;
4382         __u16 source;
4383
4384         BT_DBG("%s", hdev->name);
4385
4386         source = __le16_to_cpu(cp->source);
4387
4388         if (source > 0x0002)
4389                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4390                                   MGMT_STATUS_INVALID_PARAMS);
4391
4392         hci_dev_lock(hdev);
4393
4394         hdev->devid_source = source;
4395         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4396         hdev->devid_product = __le16_to_cpu(cp->product);
4397         hdev->devid_version = __le16_to_cpu(cp->version);
4398
4399         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4400
4401         hci_req_init(&req, hdev);
4402         update_eir(&req);
4403         hci_req_run(&req, NULL);
4404
4405         hci_dev_unlock(hdev);
4406
4407         return err;
4408 }
4409
4410 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4411                                      u16 opcode)
4412 {
4413         struct cmd_lookup match = { NULL, hdev };
4414
4415         hci_dev_lock(hdev);
4416
4417         if (status) {
4418                 u8 mgmt_err = mgmt_status(status);
4419
4420                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4421                                      cmd_status_rsp, &mgmt_err);
4422                 goto unlock;
4423         }
4424
4425         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4426                 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4427         else
4428                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4429
4430         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4431                              &match);
4432
4433         new_settings(hdev, match.sk);
4434
4435         if (match.sk)
4436                 sock_put(match.sk);
4437
4438 unlock:
4439         hci_dev_unlock(hdev);
4440 }
4441
4442 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4443                            u16 len)
4444 {
4445         struct mgmt_mode *cp = data;
4446         struct pending_cmd *cmd;
4447         struct hci_request req;
4448         u8 val, enabled, status;
4449         int err;
4450
4451         BT_DBG("request for %s", hdev->name);
4452
4453         status = mgmt_le_support(hdev);
4454         if (status)
4455                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4456                                   status);
4457
4458         if (cp->val != 0x00 && cp->val != 0x01)
4459                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4460                                   MGMT_STATUS_INVALID_PARAMS);
4461
4462         hci_dev_lock(hdev);
4463
4464         val = !!cp->val;
4465         enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4466
4467         /* The following conditions are ones which mean that we should
4468          * not do any HCI communication but directly send a mgmt
4469          * response to user space (after toggling the flag if
4470          * necessary).
4471          */
4472         if (!hdev_is_powered(hdev) || val == enabled ||
4473             hci_conn_num(hdev, LE_LINK) > 0 ||
4474             (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4475              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4476                 bool changed = false;
4477
4478                 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4479                         change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4480                         changed = true;
4481                 }
4482
4483                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4484                 if (err < 0)
4485                         goto unlock;
4486
4487                 if (changed)
4488                         err = new_settings(hdev, sk);
4489
4490                 goto unlock;
4491         }
4492
4493         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4494             mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4495                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4496                                  MGMT_STATUS_BUSY);
4497                 goto unlock;
4498         }
4499
4500         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4501         if (!cmd) {
4502                 err = -ENOMEM;
4503                 goto unlock;
4504         }
4505
4506         hci_req_init(&req, hdev);
4507
4508         if (val)
4509                 enable_advertising(&req);
4510         else
4511                 disable_advertising(&req);
4512
4513         err = hci_req_run(&req, set_advertising_complete);
4514         if (err < 0)
4515                 mgmt_pending_remove(cmd);
4516
4517 unlock:
4518         hci_dev_unlock(hdev);
4519         return err;
4520 }
4521
4522 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4523                               void *data, u16 len)
4524 {
4525         struct mgmt_cp_set_static_address *cp = data;
4526         int err;
4527
4528         BT_DBG("%s", hdev->name);
4529
4530         if (!lmp_le_capable(hdev))
4531                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4532                                   MGMT_STATUS_NOT_SUPPORTED);
4533
4534         if (hdev_is_powered(hdev))
4535                 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4536                                   MGMT_STATUS_REJECTED);
4537
4538         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4539                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4540                         return cmd_status(sk, hdev->id,
4541                                           MGMT_OP_SET_STATIC_ADDRESS,
4542                                           MGMT_STATUS_INVALID_PARAMS);
4543
4544                 /* Two most significant bits shall be set */
4545                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4546                         return cmd_status(sk, hdev->id,
4547                                           MGMT_OP_SET_STATIC_ADDRESS,
4548                                           MGMT_STATUS_INVALID_PARAMS);
4549         }
4550
4551         hci_dev_lock(hdev);
4552
4553         bacpy(&hdev->static_addr, &cp->bdaddr);
4554
4555         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4556
4557         hci_dev_unlock(hdev);
4558
4559         return err;
4560 }
4561
4562 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4563                            void *data, u16 len)
4564 {
4565         struct mgmt_cp_set_scan_params *cp = data;
4566         __u16 interval, window;
4567         int err;
4568
4569         BT_DBG("%s", hdev->name);
4570
4571         if (!lmp_le_capable(hdev))
4572                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4573                                   MGMT_STATUS_NOT_SUPPORTED);
4574
4575         interval = __le16_to_cpu(cp->interval);
4576
4577         if (interval < 0x0004 || interval > 0x4000)
4578                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4579                                   MGMT_STATUS_INVALID_PARAMS);
4580
4581         window = __le16_to_cpu(cp->window);
4582
4583         if (window < 0x0004 || window > 0x4000)
4584                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4585                                   MGMT_STATUS_INVALID_PARAMS);
4586
4587         if (window > interval)
4588                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4589                                   MGMT_STATUS_INVALID_PARAMS);
4590
4591         hci_dev_lock(hdev);
4592
4593         hdev->le_scan_interval = interval;
4594         hdev->le_scan_window = window;
4595
4596         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4597
4598         /* If background scan is running, restart it so new parameters are
4599          * loaded.
4600          */
4601         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4602             hdev->discovery.state == DISCOVERY_STOPPED) {
4603                 struct hci_request req;
4604
4605                 hci_req_init(&req, hdev);
4606
4607                 hci_req_add_le_scan_disable(&req);
4608                 hci_req_add_le_passive_scan(&req);
4609
4610                 hci_req_run(&req, NULL);
4611         }
4612
4613         hci_dev_unlock(hdev);
4614
4615         return err;
4616 }
4617
4618 #ifdef CONFIG_TIZEN_WIP
4619 static int le_set_scan_params(struct sock *sk, struct hci_dev *hdev,
4620                            void *data, u16 len)
4621 {
4622         struct mgmt_cp_le_set_scan_params *cp = data;
4623         __u16 interval, window;
4624         int err;
4625
4626         BT_DBG("%s", hdev->name);
4627
4628         if (!lmp_le_capable(hdev))
4629                 return cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
4630                                   MGMT_STATUS_NOT_SUPPORTED);
4631
4632         interval = __le16_to_cpu(cp->interval);
4633
4634         if (interval < 0x0004 || interval > 0x4000)
4635                 return cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
4636                                   MGMT_STATUS_INVALID_PARAMS);
4637
4638         window = __le16_to_cpu(cp->window);
4639
4640         if (window < 0x0004 || window > 0x4000)
4641                 return cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
4642                                   MGMT_STATUS_INVALID_PARAMS);
4643
4644         if (window > interval)
4645                 return cmd_status(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS,
4646                                   MGMT_STATUS_INVALID_PARAMS);
4647
4648         hci_dev_lock(hdev);
4649
4650         hdev->le_scan_type = cp->type;
4651         hdev->le_scan_interval = interval;
4652         hdev->le_scan_window = window;
4653
4654         err = cmd_complete(sk, hdev->id, MGMT_OP_LE_SET_SCAN_PARAMS, 0, NULL, 0);
4655
4656         /* If background scan is running, restart it so new parameters are
4657          * loaded.
4658          */
4659         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4660             hdev->discovery.state == DISCOVERY_STOPPED) {
4661                 struct hci_request req;
4662
4663                 hci_req_init(&req, hdev);
4664
4665                 hci_req_add_le_scan_disable(&req);
4666                 hci_req_add_le_passive_scan(&req);
4667
4668                 hci_req_run(&req, NULL);
4669         }
4670
4671         hci_dev_unlock(hdev);
4672
4673         return err;
4674 }
4675 #endif
4676
4677 #ifdef CONFIG_TIZEN_WIP /* Adv White List feature */
4678 static void add_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4679 {
4680         struct mgmt_cp_add_dev_white_list *cp;
4681         struct pending_cmd *cmd;
4682
4683         BT_DBG("status 0x%02x", status);
4684
4685         hci_dev_lock(hdev);
4686
4687         cmd = mgmt_pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev);
4688         if (!cmd)
4689                 goto unlock;
4690
4691         cp = cmd->param;
4692
4693         if (status)
4694                 cmd_status(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
4695                            mgmt_status(status));
4696         else
4697                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST, 0,
4698                              cp, sizeof(*cp));
4699
4700         mgmt_pending_remove(cmd);
4701
4702 unlock:
4703         hci_dev_unlock(hdev);
4704 }
4705
4706 static int add_white_list(struct sock *sk, struct hci_dev *hdev,
4707                            void *data, u16 len)
4708 {
4709         struct pending_cmd *cmd;
4710         struct mgmt_cp_add_dev_white_list *cp = data;
4711         struct hci_request req;
4712         int err;
4713
4714         BT_DBG("%s", hdev->name);
4715
4716         if (!lmp_le_capable(hdev))
4717                 return cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
4718                                   MGMT_STATUS_NOT_SUPPORTED);
4719
4720         if (!hdev_is_powered(hdev))
4721                 return cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
4722                                   MGMT_STATUS_REJECTED);
4723
4724         hci_dev_lock(hdev);
4725
4726         if (mgmt_pending_find(MGMT_OP_ADD_DEV_WHITE_LIST, hdev)) {
4727                 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_DEV_WHITE_LIST,
4728                                 MGMT_STATUS_BUSY);
4729                 goto unlocked;
4730         }
4731
4732         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEV_WHITE_LIST, hdev, data, len);
4733         if (!cmd) {
4734                 err = -ENOMEM;
4735                 goto unlocked;
4736         }
4737
4738         hci_req_init(&req, hdev);
4739
4740         hci_req_add(&req, HCI_OP_LE_ADD_DEV_WHITE_LIST, sizeof(*cp), cp);
4741
4742         err = hci_req_run(&req, add_white_list_complete);
4743         if (err < 0) {
4744                 mgmt_pending_remove(cmd);
4745                 goto unlocked;
4746         }
4747
4748 unlocked:
4749         hci_dev_unlock(hdev);
4750
4751         return err;
4752 }
4753
4754 static void remove_from_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4755 {
4756         struct mgmt_cp_remove_dev_from_white_list *cp;
4757         struct pending_cmd *cmd;
4758
4759         BT_DBG("status 0x%02x", status);
4760
4761         hci_dev_lock(hdev);
4762
4763         cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev);
4764         if (!cmd)
4765                 goto unlock;
4766
4767         cp = cmd->param;
4768
4769         if (status)
4770                 cmd_status(cmd->sk, hdev->id, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
4771                            mgmt_status(status));
4772         else
4773                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, 0,
4774                              cp, sizeof(*cp));
4775
4776         mgmt_pending_remove(cmd);
4777
4778 unlock:
4779         hci_dev_unlock(hdev);
4780 }
4781
4782 static int remove_from_white_list(struct sock *sk, struct hci_dev *hdev,
4783                            void *data, u16 len)
4784 {
4785         struct pending_cmd *cmd;
4786         struct mgmt_cp_remove_dev_from_white_list *cp = data;
4787         struct hci_request req;
4788         int err;
4789
4790         BT_DBG("%s", hdev->name);
4791
4792         if (!lmp_le_capable(hdev))
4793                 return cmd_status(sk, hdev->id, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
4794                                   MGMT_STATUS_NOT_SUPPORTED);
4795
4796         if (!hdev_is_powered(hdev))
4797                 return cmd_status(sk, hdev->id, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
4798                                   MGMT_STATUS_REJECTED);
4799
4800         hci_dev_lock(hdev);
4801
4802         if (mgmt_pending_find(MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev)) {
4803                 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST,
4804                                 MGMT_STATUS_BUSY);
4805                 goto unlocked;
4806         }
4807
4808         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEV_FROM_WHITE_LIST, hdev, data, len);
4809         if (!cmd) {
4810                 err = -ENOMEM;
4811                 goto unlocked;
4812         }
4813
4814         hci_req_init(&req, hdev);
4815
4816         hci_req_add(&req, HCI_OP_LE_REMOVE_FROM_DEV_WHITE_LIST, sizeof(*cp), cp);
4817
4818         err = hci_req_run(&req, remove_from_white_list_complete);
4819         if (err < 0) {
4820                 mgmt_pending_remove(cmd);
4821                 goto unlocked;
4822         }
4823
4824 unlocked:
4825         hci_dev_unlock(hdev);
4826
4827         return err;
4828 }
4829
4830 static void clear_white_list_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4831 {
4832         struct pending_cmd *cmd;
4833
4834         BT_DBG("status 0x%02x", status);
4835
4836         hci_dev_lock(hdev);
4837
4838         cmd = mgmt_pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev);
4839         if (!cmd)
4840                 goto unlock;
4841
4842         if (status)
4843                 cmd_status(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
4844                            mgmt_status(status));
4845         else
4846                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST, 0,
4847                              NULL, 0);
4848
4849         mgmt_pending_remove(cmd);
4850
4851 unlock:
4852         hci_dev_unlock(hdev);
4853 }
4854
4855 static int clear_white_list(struct sock *sk, struct hci_dev *hdev,
4856                            void *data, u16 len)
4857 {
4858         struct pending_cmd *cmd;
4859         struct hci_request req;
4860         int err;
4861
4862         BT_DBG("%s", hdev->name);
4863
4864         if (!lmp_le_capable(hdev))
4865                 return cmd_status(sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
4866                                   MGMT_STATUS_NOT_SUPPORTED);
4867
4868         if (!hdev_is_powered(hdev))
4869                 return cmd_status(sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
4870                                   MGMT_STATUS_REJECTED);
4871
4872         hci_dev_lock(hdev);
4873
4874         if (mgmt_pending_find(MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev)) {
4875                 err = cmd_status(sk, hdev->id, MGMT_OP_CLEAR_DEV_WHITE_LIST,
4876                                 MGMT_STATUS_BUSY);
4877                 goto unlocked;
4878         }
4879
4880         cmd = mgmt_pending_add(sk, MGMT_OP_CLEAR_DEV_WHITE_LIST, hdev, NULL, 0);
4881         if (!cmd) {
4882                 err = -ENOMEM;
4883                 goto unlocked;
4884         }
4885
4886         hci_req_init(&req, hdev);
4887
4888         hci_req_add(&req, HCI_OP_LE_CLEAR_DEV_WHITE_LIST, 0, NULL);
4889
4890         err = hci_req_run(&req, clear_white_list_complete);
4891         if (err < 0) {
4892                 mgmt_pending_remove(cmd);
4893                 goto unlocked;
4894         }
4895
4896 unlocked:
4897         hci_dev_unlock(hdev);
4898
4899         return err;
4900 }
4901
4902 static int mgmt_start_le_discovery_failed(struct hci_dev *hdev, u8 status)
4903 {
4904         struct pending_cmd *cmd;
4905         u8 type;
4906         int err;
4907
4908         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
4909
4910         cmd = mgmt_pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
4911         if (!cmd)
4912                 return -ENOENT;
4913
4914         type = hdev->le_discovery.type;
4915
4916         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4917                            &type, sizeof(type));
4918         mgmt_pending_remove(cmd);
4919
4920         return err;
4921 }
4922
4923 static void start_le_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4924 {
4925         unsigned long timeout = 0;
4926
4927         BT_DBG("status %d", status);
4928
4929         if (status) {
4930                 hci_dev_lock(hdev);
4931                 mgmt_start_le_discovery_failed(hdev, status);
4932                 hci_dev_unlock(hdev);
4933                 return;
4934         }
4935
4936         hci_dev_lock(hdev);
4937         hci_le_discovery_set_state(hdev, DISCOVERY_FINDING);
4938         hci_dev_unlock(hdev);
4939
4940         switch (hdev->le_discovery.type) {
4941         case DISCOV_TYPE_LE:
4942 /* BEGIN TIZEN_Bluetooth :: Keep going on LE Scan  */
4943 #if 0
4944                 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4945 #endif
4946 /* END TIZEN_Bluetooth */
4947                 break;
4948
4949         default:
4950                 BT_ERR("Invalid discovery type %d", hdev->le_discovery.type);
4951         }
4952
4953         if (!timeout)
4954                 return;
4955
4956         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
4957 }
4958
4959 static int start_le_discovery(struct sock *sk, struct hci_dev *hdev,
4960                            void *data, u16 len)
4961 {
4962         struct mgmt_cp_start_le_discovery *cp = data;
4963         struct pending_cmd *cmd;
4964         struct hci_cp_le_set_scan_param param_cp;
4965         struct hci_cp_le_set_scan_enable enable_cp;
4966         struct hci_request req;
4967         u8 status, own_addr_type;
4968         int err;
4969
4970         BT_DBG("%s", hdev->name);
4971
4972         hci_dev_lock(hdev);
4973
4974         if (!hdev_is_powered(hdev)) {
4975                 err = cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
4976                                  MGMT_STATUS_NOT_POWERED);
4977                 goto failed;
4978         }
4979
4980         if (hdev->le_discovery.state != DISCOVERY_STOPPED) {
4981                 err = cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
4982                                  MGMT_STATUS_BUSY);
4983                 goto failed;
4984         }
4985
4986         cmd = mgmt_pending_add(sk, MGMT_OP_START_LE_DISCOVERY, hdev, NULL, 0);
4987         if (!cmd) {
4988                 err = -ENOMEM;
4989                 goto failed;
4990         }
4991
4992         hdev->le_discovery.type = cp->type;
4993
4994         hci_req_init(&req, hdev);
4995
4996         switch (hdev->le_discovery.type) {
4997         case DISCOV_TYPE_LE:
4998                 status = mgmt_le_support(hdev);
4999                 if (status) {
5000                         err = cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
5001                                          status);
5002                         mgmt_pending_remove(cmd);
5003                         goto failed;
5004                 }
5005
5006                 /* If controller is scanning, it means the background scanning
5007                  * is running. Thus, we should temporarily stop it in order to
5008                  * set the discovery scanning parameters.
5009                  */
5010                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
5011                         hci_req_add_le_scan_disable(&req);
5012
5013                 memset(&param_cp, 0, sizeof(param_cp));
5014
5015                 /* All active scans will be done with either a resolvable
5016                  * private address (when privacy feature has been enabled)
5017                  * or unresolvable private address.
5018                  */
5019                 err = hci_update_random_address(&req, true, &own_addr_type);
5020                 if (err < 0) {
5021                         err = cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
5022                                          MGMT_STATUS_FAILED);
5023                         mgmt_pending_remove(cmd);
5024                         goto failed;
5025                 }
5026
5027                 param_cp.type = hdev->le_scan_type;
5028                 param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
5029                 param_cp.window = cpu_to_le16(hdev->le_scan_window);
5030                 param_cp.own_address_type = own_addr_type;
5031                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
5032                             &param_cp);
5033
5034                 memset(&enable_cp, 0, sizeof(enable_cp));
5035                 enable_cp.enable = LE_SCAN_ENABLE;
5036                 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
5037
5038                 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
5039                             &enable_cp);
5040                 break;
5041
5042         default:
5043                 err = cmd_status(sk, hdev->id, MGMT_OP_START_LE_DISCOVERY,
5044                                  MGMT_STATUS_INVALID_PARAMS);
5045                 mgmt_pending_remove(cmd);
5046                 goto failed;
5047         }
5048
5049         err = hci_req_run(&req, start_le_discovery_complete);
5050         if (err < 0)
5051                 mgmt_pending_remove(cmd);
5052         else
5053                 hci_le_discovery_set_state(hdev, DISCOVERY_STARTING);
5054
5055 failed:
5056         hci_dev_unlock(hdev);
5057         return err;
5058 }
5059
5060 static int mgmt_stop_le_discovery_failed(struct hci_dev *hdev, u8 status)
5061 {
5062         struct pending_cmd *cmd;
5063         int err;
5064
5065         cmd = mgmt_pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
5066         if (!cmd)
5067                 return -ENOENT;
5068
5069         err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
5070                            &hdev->le_discovery.type, sizeof(hdev->le_discovery.type));
5071         mgmt_pending_remove(cmd);
5072
5073         return err;
5074 }
5075
5076 static void stop_le_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5077 {
5078         BT_DBG("status %d", status);
5079
5080         hci_dev_lock(hdev);
5081
5082         if (status) {
5083                 mgmt_stop_le_discovery_failed(hdev, status);
5084                 goto unlock;
5085         }
5086
5087         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
5088
5089 unlock:
5090         hci_dev_unlock(hdev);
5091 }
5092
5093 static int stop_le_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5094                           u16 len)
5095 {
5096         struct mgmt_cp_stop_le_discovery *mgmt_cp = data;
5097         struct pending_cmd *cmd;
5098         struct hci_request req;
5099         int err;
5100
5101         BT_DBG("%s", hdev->name);
5102
5103         hci_dev_lock(hdev);
5104
5105         if (!hci_le_discovery_active(hdev)) {
5106                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
5107                                    MGMT_STATUS_REJECTED, &mgmt_cp->type,
5108                                    sizeof(mgmt_cp->type));
5109                 goto unlock;
5110         }
5111
5112         if (hdev->le_discovery.type != mgmt_cp->type) {
5113                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
5114                                    MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
5115                                    sizeof(mgmt_cp->type));
5116                 goto unlock;
5117         }
5118
5119         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_LE_DISCOVERY, hdev, NULL, 0);
5120         if (!cmd) {
5121                 err = -ENOMEM;
5122                 goto unlock;
5123         }
5124
5125         hci_req_init(&req, hdev);
5126
5127         switch (hdev->le_discovery.state) {
5128         case DISCOVERY_FINDING:
5129                 cancel_delayed_work(&hdev->le_scan_disable);
5130                 hci_req_add_le_scan_disable(&req);
5131                 break;
5132
5133         default:
5134                 BT_DBG("unknown le discovery state %u", hdev->le_discovery.state);
5135
5136                 mgmt_pending_remove(cmd);
5137                 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_LE_DISCOVERY,
5138                                    MGMT_STATUS_FAILED, &mgmt_cp->type,
5139                                    sizeof(mgmt_cp->type));
5140                 goto unlock;
5141         }
5142
5143         err = hci_req_run(&req, stop_le_discovery_complete);
5144         if (err < 0)
5145                 mgmt_pending_remove(cmd);
5146         else
5147                 hci_le_discovery_set_state(hdev, DISCOVERY_STOPPING);
5148
5149 unlock:
5150         hci_dev_unlock(hdev);
5151         return err;
5152 }
5153
5154 /* BEGIN TIZEN_Bluetooth :: LE auto connect */
5155 static int disable_le_auto_connect(struct sock *sk, struct hci_dev *hdev,
5156                         void *data, u16 len)
5157 {
5158         int err;
5159
5160         BT_DBG("%s", hdev->name);
5161
5162         hci_dev_lock(hdev);
5163
5164         err = hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
5165         if (err < 0) {
5166                 BT_ERR("HCI_OP_LE_CREATE_CONN_CANCEL is failed");
5167         }
5168
5169         hci_dev_unlock(hdev);
5170
5171         return err;
5172 }
5173 /* END TIZEN_Bluetooth */
5174
5175 /* BEGIN TIZEN_Bluetooth :: LE connection Update */
5176 static int le_conn_update(struct sock *sk, struct hci_dev *hdev, void *data,
5177                         u16 len)
5178 {
5179         struct mgmt_cp_le_conn_update *cp = data;
5180
5181         struct hci_conn *conn;
5182         u16 min, max, latency, supervision_timeout;
5183         int err = -1;
5184
5185         if (!hdev_is_powered(hdev))
5186                 return cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
5187                                 MGMT_STATUS_NOT_POWERED);
5188
5189         min     = __le16_to_cpu(cp->conn_interval_min);
5190         max     = __le16_to_cpu(cp->conn_interval_max);
5191         latency     = __le16_to_cpu(cp->conn_latency);
5192         supervision_timeout = __le16_to_cpu(cp->supervision_timeout);
5193
5194         BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x supervision_timeout: 0x%4.4x",
5195                         min, max, latency, supervision_timeout);
5196
5197         err = check_le_conn_update_param(min, max, latency, supervision_timeout);
5198
5199         if (err < 0) {
5200                 err = cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
5201                                 MGMT_STATUS_INVALID_PARAMS);
5202
5203                 goto done;
5204         }
5205
5206         hci_dev_lock(hdev);
5207         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
5208
5209         if (!conn) {
5210                 cmd_status(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE,
5211                                 MGMT_STATUS_NOT_CONNECTED);
5212                 goto done;
5213         }
5214
5215         hci_le_conn_update(conn, min, max, latency, supervision_timeout);
5216
5217         err = cmd_complete(sk, hdev->id, MGMT_OP_LE_CONN_UPDATE, 0,
5218                                 NULL, 0);
5219 done:
5220         hci_dev_unlock(hdev);
5221         return err;
5222 }
5223 /* END TIZEN_Bluetooth */
5224 #endif
5225
5226 static void fast_connectable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5227 {
5228         struct pending_cmd *cmd;
5229
5230         BT_DBG("status 0x%02x", status);
5231
5232         hci_dev_lock(hdev);
5233
5234         cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5235         if (!cmd)
5236                 goto unlock;
5237
5238         if (status) {
5239                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5240                            mgmt_status(status));
5241         } else {
5242                 struct mgmt_mode *cp = cmd->param;
5243
5244                 if (cp->val)
5245                         set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
5246                 else
5247                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
5248
5249                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5250                 new_settings(hdev, cmd->sk);
5251         }
5252
5253         mgmt_pending_remove(cmd);
5254
5255 unlock:
5256         hci_dev_unlock(hdev);
5257 }
5258
5259 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5260                                 void *data, u16 len)
5261 {
5262         struct mgmt_mode *cp = data;
5263         struct pending_cmd *cmd;
5264         struct hci_request req;
5265         int err;
5266
5267         BT_DBG("%s", hdev->name);
5268
5269         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
5270             hdev->hci_ver < BLUETOOTH_VER_1_2)
5271                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5272                                   MGMT_STATUS_NOT_SUPPORTED);
5273
5274         if (cp->val != 0x00 && cp->val != 0x01)
5275                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5276                                   MGMT_STATUS_INVALID_PARAMS);
5277
5278         if (!hdev_is_powered(hdev))
5279                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5280                                   MGMT_STATUS_NOT_POWERED);
5281
5282         if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
5283                 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5284                                   MGMT_STATUS_REJECTED);
5285
5286         hci_dev_lock(hdev);
5287
5288         if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5289                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5290                                  MGMT_STATUS_BUSY);
5291                 goto unlock;
5292         }
5293
5294         if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
5295                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5296                                         hdev);
5297                 goto unlock;
5298         }
5299
5300         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5301                                data, len);
5302         if (!cmd) {
5303                 err = -ENOMEM;
5304                 goto unlock;
5305         }
5306
5307         hci_req_init(&req, hdev);
5308
5309         write_fast_connectable(&req, cp->val);
5310
5311         err = hci_req_run(&req, fast_connectable_complete);
5312         if (err < 0) {
5313                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5314                                  MGMT_STATUS_FAILED);
5315                 mgmt_pending_remove(cmd);
5316         }
5317
5318 unlock:
5319         hci_dev_unlock(hdev);
5320
5321         return err;
5322 }
5323
5324 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5325 {
5326         struct pending_cmd *cmd;
5327
5328         BT_DBG("status 0x%02x", status);
5329
5330         hci_dev_lock(hdev);
5331
5332         cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
5333         if (!cmd)
5334                 goto unlock;
5335
5336         if (status) {
5337                 u8 mgmt_err = mgmt_status(status);
5338
5339                 /* We need to restore the flag if related HCI commands
5340                  * failed.
5341                  */
5342                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
5343
5344                 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5345         } else {
5346                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5347                 new_settings(hdev, cmd->sk);
5348         }
5349
5350         mgmt_pending_remove(cmd);
5351
5352 unlock:
5353         hci_dev_unlock(hdev);
5354 }
5355
5356 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5357 {
5358         struct mgmt_mode *cp = data;
5359         struct pending_cmd *cmd;
5360         struct hci_request req;
5361         int err;
5362
5363         BT_DBG("request for %s", hdev->name);
5364
5365         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5366                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5367                                   MGMT_STATUS_NOT_SUPPORTED);
5368
5369         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
5370                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5371                                   MGMT_STATUS_REJECTED);
5372
5373         if (cp->val != 0x00 && cp->val != 0x01)
5374                 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5375                                   MGMT_STATUS_INVALID_PARAMS);
5376
5377         hci_dev_lock(hdev);
5378
5379         if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5380                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5381                 goto unlock;
5382         }
5383
5384         if (!hdev_is_powered(hdev)) {
5385                 if (!cp->val) {
5386                         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5387                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5388                         clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5389                         clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
5390                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5391                 }
5392
5393                 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
5394
5395                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5396                 if (err < 0)
5397                         goto unlock;
5398
5399                 err = new_settings(hdev, sk);
5400                 goto unlock;
5401         }
5402
5403         /* Reject disabling when powered on */
5404         if (!cp->val) {
5405                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5406                                  MGMT_STATUS_REJECTED);
5407                 goto unlock;
5408         } else {
5409                 /* When configuring a dual-mode controller to operate
5410                  * with LE only and using a static address, then switching
5411                  * BR/EDR back on is not allowed.
5412                  *
5413                  * Dual-mode controllers shall operate with the public
5414                  * address as its identity address for BR/EDR and LE. So
5415                  * reject the attempt to create an invalid configuration.
5416                  *
5417                  * The same restrictions applies when secure connections
5418                  * has been enabled. For BR/EDR this is a controller feature
5419                  * while for LE it is a host stack feature. This means that
5420                  * switching BR/EDR back on when secure connections has been
5421                  * enabled is not a supported transaction.
5422                  */
5423                 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
5424                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5425                      test_bit(HCI_SC_ENABLED, &hdev->dev_flags))) {
5426                         err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5427                                          MGMT_STATUS_REJECTED);
5428                         goto unlock;
5429                 }
5430         }
5431
5432         if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
5433                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5434                                  MGMT_STATUS_BUSY);
5435                 goto unlock;
5436         }
5437
5438         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5439         if (!cmd) {
5440                 err = -ENOMEM;
5441                 goto unlock;
5442         }
5443
5444         /* We need to flip the bit already here so that update_adv_data
5445          * generates the correct flags.
5446          */
5447         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
5448
5449         hci_req_init(&req, hdev);
5450
5451         write_fast_connectable(&req, false);
5452         __hci_update_page_scan(&req);
5453
5454         /* Since only the advertising data flags will change, there
5455          * is no need to update the scan response data.
5456          */
5457         update_adv_data(&req);
5458
5459         err = hci_req_run(&req, set_bredr_complete);
5460         if (err < 0)
5461                 mgmt_pending_remove(cmd);
5462
5463 unlock:
5464         hci_dev_unlock(hdev);
5465         return err;
5466 }
5467
5468 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5469 {
5470         struct pending_cmd *cmd;
5471         struct mgmt_mode *cp;
5472
5473         BT_DBG("%s status %u", hdev->name, status);
5474
5475         hci_dev_lock(hdev);
5476
5477         cmd = mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5478         if (!cmd)
5479                 goto unlock;
5480
5481         if (status) {
5482                 cmd_status(cmd->sk, cmd->index, cmd->opcode,
5483                            mgmt_status(status));
5484                 goto remove;
5485         }
5486
5487         cp = cmd->param;
5488
5489         switch (cp->val) {
5490         case 0x00:
5491                 clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5492                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5493                 break;
5494         case 0x01:
5495                 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5496                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5497                 break;
5498         case 0x02:
5499                 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5500                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
5501                 break;
5502         }
5503
5504         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5505         new_settings(hdev, cmd->sk);
5506
5507 remove:
5508         mgmt_pending_remove(cmd);
5509 unlock:
5510         hci_dev_unlock(hdev);
5511 }
5512
5513 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5514                            void *data, u16 len)
5515 {
5516         struct mgmt_mode *cp = data;
5517         struct pending_cmd *cmd;
5518         struct hci_request req;
5519         u8 val;
5520         int err;
5521
5522         BT_DBG("request for %s", hdev->name);
5523
5524         if (!lmp_sc_capable(hdev) &&
5525             !test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
5526                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5527                                   MGMT_STATUS_NOT_SUPPORTED);
5528
5529         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
5530             !test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
5531                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5532                                   MGMT_STATUS_REJECTED);
5533
5534         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5535                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5536                                   MGMT_STATUS_INVALID_PARAMS);
5537
5538         hci_dev_lock(hdev);
5539
5540         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5541             !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5542                 bool changed;
5543
5544                 if (cp->val) {
5545                         changed = !test_and_set_bit(HCI_SC_ENABLED,
5546                                                     &hdev->dev_flags);
5547                         if (cp->val == 0x02)
5548                                 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
5549                         else
5550                                 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5551                 } else {
5552                         changed = test_and_clear_bit(HCI_SC_ENABLED,
5553                                                      &hdev->dev_flags);
5554                         clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5555                 }
5556
5557                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5558                 if (err < 0)
5559                         goto failed;
5560
5561                 if (changed)
5562                         err = new_settings(hdev, sk);
5563
5564                 goto failed;
5565         }
5566
5567         if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5568                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5569                                  MGMT_STATUS_BUSY);
5570                 goto failed;
5571         }
5572
5573         val = !!cp->val;
5574
5575         if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
5576             (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
5577                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5578                 goto failed;
5579         }
5580
5581         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5582         if (!cmd) {
5583                 err = -ENOMEM;
5584                 goto failed;
5585         }
5586
5587         hci_req_init(&req, hdev);
5588         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5589         err = hci_req_run(&req, sc_enable_complete);
5590         if (err < 0) {
5591                 mgmt_pending_remove(cmd);
5592                 goto failed;
5593         }
5594
5595 failed:
5596         hci_dev_unlock(hdev);
5597         return err;
5598 }
5599
5600 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5601                           void *data, u16 len)
5602 {
5603         struct mgmt_mode *cp = data;
5604         bool changed, use_changed;
5605         int err;
5606
5607         BT_DBG("request for %s", hdev->name);
5608
5609         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5610                 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5611                                   MGMT_STATUS_INVALID_PARAMS);
5612
5613         hci_dev_lock(hdev);
5614
5615         if (cp->val)
5616                 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
5617                                             &hdev->dev_flags);
5618         else
5619                 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
5620                                              &hdev->dev_flags);
5621
5622         if (cp->val == 0x02)
5623                 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
5624                                                 &hdev->dev_flags);
5625         else
5626                 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
5627                                                  &hdev->dev_flags);
5628
5629         if (hdev_is_powered(hdev) && use_changed &&
5630             test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
5631                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5632                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5633                              sizeof(mode), &mode);
5634         }
5635
5636         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5637         if (err < 0)
5638                 goto unlock;
5639
5640         if (changed)
5641                 err = new_settings(hdev, sk);
5642
5643 unlock:
5644         hci_dev_unlock(hdev);
5645         return err;
5646 }
5647
5648 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5649                        u16 len)
5650 {
5651         struct mgmt_cp_set_privacy *cp = cp_data;
5652         bool changed;
5653         int err;
5654
5655         BT_DBG("request for %s", hdev->name);
5656
5657         if (!lmp_le_capable(hdev))
5658                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5659                                   MGMT_STATUS_NOT_SUPPORTED);
5660
5661         if (cp->privacy != 0x00 && cp->privacy != 0x01)
5662                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5663                                   MGMT_STATUS_INVALID_PARAMS);
5664
5665 /* Not sure why below condition is required; commenting for now,
5666         * since set privacy command is always rejected if this condition is enabled.
5667         */
5668 #ifndef CONFIG_TIZEN_WIP
5669         if (hdev_is_powered(hdev))
5670                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5671                                   MGMT_STATUS_REJECTED);
5672 #endif
5673
5674         hci_dev_lock(hdev);
5675
5676         /* If user space supports this command it is also expected to
5677          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5678          */
5679         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5680
5681         if (cp->privacy) {
5682                 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
5683                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5684                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
5685         } else {
5686                 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
5687                 memset(hdev->irk, 0, sizeof(hdev->irk));
5688                 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
5689         }
5690
5691         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5692         if (err < 0)
5693                 goto unlock;
5694
5695         if (changed)
5696                 err = new_settings(hdev, sk);
5697
5698 unlock:
5699         hci_dev_unlock(hdev);
5700         return err;
5701 }
5702
5703 static bool irk_is_valid(struct mgmt_irk_info *irk)
5704 {
5705         switch (irk->addr.type) {
5706         case BDADDR_LE_PUBLIC:
5707                 return true;
5708
5709         case BDADDR_LE_RANDOM:
5710                 /* Two most significant bits shall be set */
5711                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5712                         return false;
5713                 return true;
5714         }
5715
5716         return false;
5717 }
5718
5719 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5720                      u16 len)
5721 {
5722         struct mgmt_cp_load_irks *cp = cp_data;
5723         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5724                                    sizeof(struct mgmt_irk_info));
5725         u16 irk_count, expected_len;
5726         int i, err;
5727
5728         BT_DBG("request for %s", hdev->name);
5729
5730         if (!lmp_le_capable(hdev))
5731                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5732                                   MGMT_STATUS_NOT_SUPPORTED);
5733
5734         irk_count = __le16_to_cpu(cp->irk_count);
5735         if (irk_count > max_irk_count) {
5736                 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5737                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5738                                   MGMT_STATUS_INVALID_PARAMS);
5739         }
5740
5741         expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5742         if (expected_len != len) {
5743                 BT_ERR("load_irks: expected %u bytes, got %u bytes",
5744                        expected_len, len);
5745                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5746                                   MGMT_STATUS_INVALID_PARAMS);
5747         }
5748
5749         BT_DBG("%s irk_count %u", hdev->name, irk_count);
5750
5751         for (i = 0; i < irk_count; i++) {
5752                 struct mgmt_irk_info *key = &cp->irks[i];
5753
5754                 if (!irk_is_valid(key))
5755                         return cmd_status(sk, hdev->id,
5756                                           MGMT_OP_LOAD_IRKS,
5757                                           MGMT_STATUS_INVALID_PARAMS);
5758         }
5759
5760         hci_dev_lock(hdev);
5761
5762         hci_smp_irks_clear(hdev);
5763
5764         for (i = 0; i < irk_count; i++) {
5765                 struct mgmt_irk_info *irk = &cp->irks[i];
5766                 u8 addr_type;
5767
5768                 if (irk->addr.type == BDADDR_LE_PUBLIC)
5769                         addr_type = ADDR_LE_DEV_PUBLIC;
5770                 else
5771                         addr_type = ADDR_LE_DEV_RANDOM;
5772
5773                 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5774                             BDADDR_ANY);
5775         }
5776
5777         set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5778
5779         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5780
5781         hci_dev_unlock(hdev);
5782
5783         return err;
5784 }
5785
5786 #ifdef CONFIG_TIZEN_WIP
5787 static int set_advertising_params(struct sock *sk, struct hci_dev *hdev,
5788                                   void *data, u16 len)
5789 {
5790         struct mgmt_cp_set_advertising_params *cp = data;
5791         __u16 min_interval;
5792         __u16 max_interval;
5793         int err;
5794
5795         BT_DBG("%s", hdev->name);
5796
5797         if (!lmp_le_capable(hdev))
5798                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_PARAMS,
5799                                 MGMT_STATUS_NOT_SUPPORTED);
5800
5801         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5802                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_PARAMS,
5803                                 MGMT_STATUS_BUSY);
5804
5805         min_interval = __le16_to_cpu(cp->interval_min);
5806         max_interval = __le16_to_cpu(cp->interval_max);
5807
5808         if (min_interval > max_interval ||
5809             min_interval < 0x0020 || max_interval > 0x4000)
5810                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_PARAMS,
5811                                 MGMT_STATUS_INVALID_PARAMS);
5812
5813         hci_dev_lock(hdev);
5814
5815         hdev->le_adv_min_interval = min_interval;
5816         hdev->le_adv_max_interval = max_interval;
5817         hdev->adv_filter_policy = cp->filter_policy;
5818         hdev->adv_type = cp->type;
5819
5820         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_ADVERTISING_PARAMS, 0, NULL, 0);
5821
5822         hci_dev_unlock(hdev);
5823
5824         return err;
5825 }
5826
5827 static void set_advertising_data_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5828 {
5829         struct mgmt_cp_set_advertising_data *cp;
5830         struct pending_cmd *cmd;
5831
5832         BT_DBG("status 0x%02x", status);
5833
5834         hci_dev_lock(hdev);
5835
5836         cmd = mgmt_pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev);
5837         if (!cmd)
5838                 goto unlock;
5839
5840         cp = cmd->param;
5841
5842         if (status)
5843                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_ADVERTISING_DATA,
5844                            mgmt_status(status));
5845         else
5846                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_ADVERTISING_DATA, 0,
5847                              cp, sizeof(*cp));
5848
5849         mgmt_pending_remove(cmd);
5850
5851 unlock:
5852         hci_dev_unlock(hdev);
5853 }
5854
5855 static int set_advertising_data(struct sock *sk, struct hci_dev *hdev,
5856                                 void *data, u16 len)
5857 {
5858         struct pending_cmd *cmd;
5859         struct hci_request req;
5860         struct mgmt_cp_set_advertising_data *cp = data;
5861         struct hci_cp_le_set_adv_data adv;
5862         int err;
5863
5864         BT_DBG("%s", hdev->name);
5865
5866         if (!lmp_le_capable(hdev)) {
5867                 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_DATA,
5868                                 MGMT_STATUS_NOT_SUPPORTED);
5869         }
5870
5871         hci_dev_lock(hdev);
5872
5873         if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING_DATA, hdev)) {
5874                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_DATA,
5875                                 MGMT_STATUS_BUSY);
5876                 goto unlocked;
5877         }
5878
5879         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING_DATA,
5880                                hdev, data, len);
5881         if (!cmd) {
5882                 err = -ENOMEM;
5883                 goto unlocked;
5884         }
5885
5886         if (len > HCI_MAX_AD_LENGTH) {
5887                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING_DATA,
5888                                  MGMT_STATUS_INVALID_PARAMS);
5889                 goto unlocked;
5890         }
5891
5892         hci_req_init(&req, hdev);
5893
5894         memset(&adv, 0, sizeof(adv));
5895         memcpy(adv.data, cp->data, len);
5896         adv.length = len;
5897
5898         hci_req_add(&req, HCI_OP_LE_SET_ADV_DATA, sizeof(adv), &adv);
5899
5900         err = hci_req_run(&req, set_advertising_data_complete);
5901         if (err < 0) {
5902                 mgmt_pending_remove(cmd);
5903         }
5904
5905 unlocked:
5906         hci_dev_unlock(hdev);
5907
5908         return err;
5909 }
5910
5911 static void set_scan_rsp_data_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5912 {
5913         struct mgmt_cp_set_scan_rsp_data *cp;
5914         struct pending_cmd *cmd;
5915
5916         BT_DBG("status 0x%02x", status);
5917
5918         hci_dev_lock(hdev);
5919
5920         cmd = mgmt_pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev);
5921         if (!cmd)
5922                 goto unlock;
5923
5924         cp = cmd->param;
5925
5926         if (status)
5927                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
5928                            mgmt_status(status));
5929         else
5930                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA, 0,
5931                              cp, sizeof(*cp));
5932
5933         mgmt_pending_remove(cmd);
5934
5935 unlock:
5936         hci_dev_unlock(hdev);
5937 }
5938
5939 static int set_scan_rsp_data(struct sock *sk, struct hci_dev *hdev, void *data,
5940                              u16 len)
5941 {
5942         struct pending_cmd *cmd;
5943         struct hci_request req;
5944         struct mgmt_cp_set_scan_rsp_data *cp = data;
5945         struct hci_cp_le_set_scan_rsp_data rsp;
5946         int err;
5947
5948         BT_DBG("%s", hdev->name);
5949
5950         if (!lmp_le_capable(hdev))
5951                 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
5952                                 MGMT_STATUS_NOT_SUPPORTED);
5953
5954         hci_dev_lock(hdev);
5955
5956         if (mgmt_pending_find(MGMT_OP_SET_SCAN_RSP_DATA, hdev)) {
5957                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
5958                                 MGMT_STATUS_BUSY);
5959                 goto unlocked;
5960         }
5961
5962         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SCAN_RSP_DATA, hdev, data, len);
5963         if (!cmd) {
5964                 err = -ENOMEM;
5965                 goto unlocked;
5966         }
5967         if (len > HCI_MAX_AD_LENGTH) {
5968                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_RSP_DATA,
5969                                  MGMT_STATUS_INVALID_PARAMS);
5970                 goto unlocked;
5971         }
5972
5973         hci_req_init(&req, hdev);
5974
5975         memset(&rsp, 0, sizeof(rsp));
5976         memcpy(rsp.data, cp->data, len);
5977         rsp.length = len;
5978
5979         hci_req_add(&req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(rsp), &rsp);
5980
5981         err = hci_req_run(&req, set_scan_rsp_data_complete);
5982         if (err < 0) {
5983                 mgmt_pending_remove(cmd);
5984         }
5985
5986 unlocked:
5987         hci_dev_unlock(hdev);
5988
5989         return err;
5990 }
5991
5992 static void set_manufacturer_data_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5993 {
5994         struct mgmt_cp_set_manufacturer_data *cp;
5995         struct pending_cmd *cmd;
5996
5997         BT_DBG("status 0x%02x", status);
5998
5999         hci_dev_lock(hdev);
6000
6001         cmd = mgmt_pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev);
6002         if (!cmd)
6003                 goto unlock;
6004
6005         cp = cmd->param;
6006
6007         if (status)
6008                 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
6009                            mgmt_status(status));
6010         else
6011                 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA, 0,
6012                              cp, sizeof(*cp));
6013
6014         mgmt_pending_remove(cmd);
6015
6016 unlock:
6017         hci_dev_unlock(hdev);
6018 }
6019
6020 static int set_manufacturer_data(struct sock *sk, struct hci_dev *hdev,
6021                                         void *data, u16 len)
6022 {
6023         struct pending_cmd *cmd;
6024         struct hci_request req;
6025         struct mgmt_cp_set_manufacturer_data *cp = data;
6026         u8 old_data[HCI_MAX_EIR_LENGTH] = {0, };
6027         u8 old_len;
6028
6029         int err;
6030
6031         BT_DBG("%s", hdev->name);
6032
6033         if (!lmp_bredr_capable(hdev)) {
6034                 return cmd_status(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
6035                                 MGMT_STATUS_NOT_SUPPORTED);
6036         }
6037
6038         if (cp->data[0] == 0 ||
6039                         cp->data[0] - 1 > sizeof(hdev->manufacturer_data)) {
6040                 return cmd_status(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
6041                                 MGMT_STATUS_INVALID_PARAMS);
6042         }
6043
6044         if (cp->data[1] != 0xFF) {
6045                 return cmd_status(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
6046                                 MGMT_STATUS_NOT_SUPPORTED);
6047         }
6048
6049         hci_dev_lock(hdev);
6050
6051         if (mgmt_pending_find(MGMT_OP_SET_MANUFACTURER_DATA, hdev)) {
6052                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA,
6053                                 MGMT_STATUS_BUSY);
6054                 goto unlocked;
6055         }
6056
6057         cmd = mgmt_pending_add(sk, MGMT_OP_SET_MANUFACTURER_DATA, hdev, data, len);
6058         if (!cmd) {
6059                 err = -ENOMEM;
6060                 goto unlocked;
6061         }
6062
6063         hci_req_init(&req, hdev);
6064
6065         /* if new data is same as previous data then return command complete event*/
6066         if (hdev->manufacturer_len == cp->data[0] - 1 &&
6067             !memcmp(hdev->manufacturer_data, cp->data + 2, cp->data[0] - 1)) {
6068                 mgmt_pending_remove(cmd);
6069                 cmd_complete(sk, hdev->id, MGMT_OP_SET_MANUFACTURER_DATA, 0,
6070                                 cp, sizeof(*cp));
6071                 hci_dev_unlock(hdev);
6072                 return 0;
6073         }
6074
6075         old_len = hdev->manufacturer_len;
6076         if (old_len > 0) {
6077                 memcpy(old_data, hdev->manufacturer_data, old_len);
6078         }
6079
6080         hdev->manufacturer_len = cp->data[0] - 1;
6081         if (hdev->manufacturer_len > 0) {
6082                 memcpy(hdev->manufacturer_data, cp->data + 2, hdev->manufacturer_len);
6083         }
6084
6085         update_eir(&req);
6086
6087         err = hci_req_run(&req, set_manufacturer_data_complete);
6088         if (err < 0) {
6089                 mgmt_pending_remove(cmd);
6090                 goto failed;
6091         }
6092
6093 unlocked:
6094         hci_dev_unlock(hdev);
6095
6096         return err;
6097
6098 failed:
6099         memset(hdev->manufacturer_data, 0x00, sizeof(hdev->manufacturer_data));
6100         hdev->manufacturer_len = old_len;
6101         if (hdev->manufacturer_len > 0) {
6102                 memcpy(hdev->manufacturer_data, old_data,
6103                        hdev->manufacturer_len);
6104         }
6105         hci_dev_unlock(hdev);
6106         return err;
6107 }
6108
6109 #ifdef CONFIG_TIZEN_WIP
6110 static int set_voice_setting(struct sock *sk, struct hci_dev *hdev,
6111                                         void *data, u16 len)
6112 {
6113         struct mgmt_cp_set_voice_setting *cp = data;
6114         struct hci_conn *conn;
6115         struct hci_conn *sco_conn;
6116
6117         int err;
6118
6119         BT_DBG("%s", hdev->name);
6120
6121         if (!lmp_bredr_capable(hdev)) {
6122                 return cmd_status(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING,
6123                                 MGMT_STATUS_NOT_SUPPORTED);
6124         }
6125
6126         hci_dev_lock(hdev);
6127
6128         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
6129         if (!conn) {
6130                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
6131                                 NULL, 0);
6132                 goto unlock;
6133         }
6134
6135         conn->voice_setting = cp->voice_setting;
6136         conn->sco_role = cp->sco_role;
6137
6138         sco_conn = hci_conn_hash_lookup_sco(hdev);
6139         if (sco_conn && bacmp(&sco_conn->dst, &cp->bdaddr) != 0) {
6140                 BT_ERR("There is other SCO connection.");
6141                 goto done;
6142         }
6143
6144         if (conn->sco_role == MGMT_SCO_ROLE_HANDSFREE) {
6145                 if (conn->voice_setting == 0x0063)
6146                         sco_connect_set_wbc(hdev);
6147                 else
6148                         sco_connect_set_nbc(hdev);
6149         } else {
6150                 if (conn->voice_setting == 0x0063)
6151                         sco_connect_set_gw_wbc(hdev);
6152                 else
6153                         sco_connect_set_gw_nbc(hdev);
6154         }
6155
6156 done:
6157         err = cmd_complete(sk, hdev->id, MGMT_OP_SET_VOICE_SETTING, 0,
6158                         cp, sizeof(cp));
6159
6160 unlock:
6161         hci_dev_unlock(hdev);
6162         return err;
6163 }
6164 #endif
6165
6166 static int get_adv_tx_power(struct sock *sk, struct hci_dev *hdev,
6167                            void *data, u16 len)
6168 {
6169         struct mgmt_rp_get_adv_tx_power *rp;
6170         size_t rp_len;
6171         int err;
6172
6173         BT_DBG("%s", hdev->name);
6174
6175         hci_dev_lock(hdev);
6176
6177         rp_len = sizeof(*rp);
6178         rp = kmalloc(rp_len, GFP_KERNEL);
6179         if (!rp) {
6180                 err = -ENOMEM;
6181                 goto unlock;
6182         }
6183
6184         rp->adv_tx_power= hdev->adv_tx_power;
6185
6186         err = cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_TX_POWER, 0, rp,
6187                            rp_len);
6188
6189         kfree(rp);
6190
6191 unlock:
6192         hci_dev_unlock(hdev);
6193
6194         return err;
6195 }
6196
6197 /* BEGIN TIZEN_Bluetooth :: Apply RSSI changes   */
6198 static void set_rssi_threshold_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6199 {
6200         BT_DBG("status 0x%02x", status);
6201 }
6202
6203 static void set_rssi_disable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6204 {
6205         BT_DBG("status 0x%02x", status);
6206 }
6207
6208 int mgmt_set_rssi_threshold(struct sock *sk, struct hci_dev *hdev,
6209                 void *data, u16 len)
6210 {
6211         int err = 0;
6212         struct hci_cp_set_rssi_threshold th = { 0, };
6213         struct mgmt_cp_set_enable_rssi *cp = data;
6214         struct hci_conn *conn;
6215         struct pending_cmd *cmd;
6216         struct hci_request req;
6217         __u8 dest_type;
6218
6219         hci_dev_lock(hdev);
6220
6221         cmd = mgmt_pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6222         if (!cmd) {
6223                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6224                                 MGMT_STATUS_FAILED);
6225                 goto unlocked;
6226         }
6227
6228         if (!lmp_le_capable(hdev)) {
6229                 mgmt_pending_remove(cmd);
6230                 return cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6231                                 MGMT_STATUS_NOT_SUPPORTED);
6232         }
6233
6234         if (!hdev_is_powered(hdev)) {
6235                 BT_DBG("%s", hdev->name);
6236                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6237                                 MGMT_STATUS_NOT_POWERED, data, len);
6238                 mgmt_pending_remove(cmd);
6239                 goto unlocked;
6240         }
6241
6242         if (cp->link_type == 0x01)
6243                 dest_type = LE_LINK;
6244         else
6245                 dest_type = ACL_LINK;
6246
6247         /* Get LE/ACL link handle info*/
6248         conn = hci_conn_hash_lookup_ba(hdev,
6249                         dest_type, &cp->bdaddr);
6250
6251         if (conn == NULL) {
6252                 err = cmd_complete(sk, hdev->id,
6253                                 MGMT_OP_SET_RSSI_ENABLE, 1, NULL, 0);
6254                 mgmt_pending_remove(cmd);
6255                 goto unlocked;
6256         }
6257
6258         hci_req_init(&req, hdev);
6259
6260         th.hci_le_ext_opcode = 0x0B;
6261         th.mode = 0x01;
6262         th.conn_handle = conn->handle;
6263         th.alert_mask = 0x07;
6264         th.low_th = cp->low_th;
6265         th.in_range_th = cp->in_range_th;
6266         th.high_th = cp->high_th;
6267
6268         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6269         err = hci_req_run(&req, set_rssi_threshold_complete);
6270
6271         if (err < 0) {
6272                 mgmt_pending_remove(cmd);
6273                 BT_ERR("Error in requesting hci_req_run");
6274                 goto unlocked;
6275         }
6276
6277 unlocked:
6278         hci_dev_unlock(hdev);
6279         return err;
6280 }
6281
6282 void mgmt_rssi_enable_success(struct sock *sk, struct hci_dev *hdev,
6283                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6284 {
6285         struct mgmt_cc_rsp_enable_rssi mgmt_rp = { 0, };
6286         struct mgmt_cp_set_enable_rssi *cp = data;
6287         struct pending_cmd *cmd;
6288
6289         if (cp == NULL || rp == NULL)
6290                 goto remove_cmd;
6291
6292         mgmt_rp.status = rp->status;
6293         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6294         mgmt_rp.bt_address = cp->bdaddr;
6295         mgmt_rp.link_type = cp->link_type;
6296
6297         cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, MGMT_STATUS_SUCCESS,
6298                         &mgmt_rp, sizeof(struct mgmt_cc_rsp_enable_rssi));
6299
6300         mgmt_event(MGMT_EV_RSSI_ENABLED, hdev, &mgmt_rp,
6301                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6302
6303         hci_conn_rssi_unset_all(hdev, mgmt_rp.link_type);
6304         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6305                         &mgmt_rp.bt_address, true);
6306
6307 remove_cmd:
6308         hci_dev_lock(hdev);
6309         cmd = mgmt_pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6310         if (cmd)
6311                 mgmt_pending_remove(cmd);
6312
6313         hci_dev_unlock(hdev);
6314 }
6315
6316 void mgmt_rssi_disable_success(struct sock *sk, struct hci_dev *hdev,
6317                 void *data, struct hci_cc_rsp_enable_rssi *rp, int success)
6318 {
6319         struct mgmt_cc_rp_disable_rssi mgmt_rp = { 0, };
6320         struct mgmt_cp_disable_rssi *cp = data;
6321         struct pending_cmd *cmd;
6322
6323         if (cp == NULL || rp == NULL)
6324                 goto remove_cmd;
6325
6326         mgmt_rp.status = rp->status;
6327         mgmt_rp.le_ext_opcode = rp->le_ext_opcode;
6328         mgmt_rp.bt_address = cp->bdaddr;
6329         mgmt_rp.link_type = cp->link_type;
6330
6331         cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE, MGMT_STATUS_SUCCESS,
6332                         &mgmt_rp, sizeof(struct mgmt_cc_rsp_enable_rssi));
6333
6334         mgmt_event(MGMT_EV_RSSI_DISABLED, hdev, &mgmt_rp,
6335                         sizeof(struct mgmt_cc_rsp_enable_rssi), NULL);
6336
6337         hci_conn_rssi_state_set(hdev, mgmt_rp.link_type,
6338                         &mgmt_rp.bt_address, false);
6339
6340
6341 remove_cmd:
6342         hci_dev_lock(hdev);
6343         cmd = mgmt_pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6344         if (cmd)
6345                 mgmt_pending_remove(cmd);
6346
6347         hci_dev_unlock(hdev);
6348 }
6349
6350 static int mgmt_set_disable_rssi(struct sock *sk, struct hci_dev *hdev,
6351                 void *data, u16 len)
6352 {
6353         struct pending_cmd *cmd;
6354         struct hci_request req;
6355         struct hci_cp_set_enable_rssi cp_en = { 0, };
6356         int err;
6357
6358         BT_DBG("Set Disable RSSI.");
6359
6360         cp_en.hci_le_ext_opcode = 0x01;
6361         cp_en.le_enable_cs_Features = 0x00;
6362         cp_en.data[0] = 0x00;
6363         cp_en.data[1] = 0x00;
6364         cp_en.data[2] = 0x00;
6365
6366         hci_dev_lock(hdev);
6367
6368         cmd = mgmt_pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6369         if (!cmd) {
6370                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6371                                 MGMT_STATUS_FAILED);
6372                 goto unlocked;
6373         }
6374
6375         if (!lmp_le_capable(hdev)) {
6376                 mgmt_pending_remove(cmd);
6377                 return cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6378                                 MGMT_STATUS_NOT_SUPPORTED);
6379         }
6380
6381         if (!hdev_is_powered(hdev)) {
6382                 BT_DBG("%s", hdev->name);
6383                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6384                                 MGMT_STATUS_NOT_POWERED, data, len);
6385                 mgmt_pending_remove(cmd);
6386                 goto unlocked;
6387         }
6388
6389         hci_req_init(&req, hdev);
6390
6391         BT_DBG("Enable Len: %d [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6392                         sizeof(struct hci_cp_set_enable_rssi),
6393                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6394                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6395
6396         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6397         err = hci_req_run(&req, set_rssi_disable_complete);
6398
6399         if (err < 0) {
6400                 mgmt_pending_remove(cmd);
6401                 BT_ERR("Error in requesting hci_req_run");
6402                 goto unlocked;
6403         }
6404
6405 unlocked:
6406         hci_dev_unlock(hdev);
6407
6408         return err;
6409
6410 }
6411
6412 void mgmt_enable_rssi_cc(struct hci_dev *hdev, void *response, u8 status)
6413 {
6414         struct hci_cc_rsp_enable_rssi *rp = response;
6415         struct pending_cmd *cmd_enable = NULL;
6416         struct pending_cmd *cmd_disable = NULL;
6417         struct mgmt_cp_set_enable_rssi *cp_en;
6418         struct mgmt_cp_disable_rssi *cp_dis;
6419
6420         hci_dev_lock(hdev);
6421         cmd_enable = mgmt_pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev);
6422         cmd_disable = mgmt_pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev);
6423         hci_dev_unlock(hdev);
6424
6425         if(cmd_enable)
6426                 BT_DBG("Enable Request");
6427
6428         if(cmd_disable)
6429                 BT_DBG("Disable Request");
6430
6431         if (cmd_enable) {
6432                 cp_en = cmd_enable->param;
6433
6434                 if (status != 0x00)
6435                         return;
6436
6437                 switch (rp->le_ext_opcode) {
6438                 case 0x01:
6439                         BT_DBG("RSSI enabled.. Setting Threshold...");
6440                         mgmt_set_rssi_threshold(cmd_enable->sk, hdev,
6441                                         cp_en, sizeof(*cp_en));
6442                         break;
6443
6444                 case 0x0B:
6445                         BT_DBG("Sending RSSI enable success");
6446                         mgmt_rssi_enable_success(cmd_enable->sk, hdev,
6447                                         cp_en, rp, rp->status);
6448                         break;
6449                 }
6450
6451         } else if (cmd_disable) {
6452                 cp_dis = cmd_disable->param;
6453
6454                 if (status != 0x00)
6455                         return;
6456
6457                 switch (rp->le_ext_opcode) {
6458                 case 0x01:
6459                         BT_DBG("Sending RSSI disable success");
6460                         mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6461                                         cp_dis, rp, rp->status);
6462                         break;
6463
6464                 case 0x0B:
6465                         /* Only unset RSSI Threshold values for the Link if
6466                            RSSI is monitored for other BREDR or LE Links*/
6467                         if (hci_conn_hash_lookup_rssi_count(hdev) > 1) {
6468                                 BT_DBG("Unset Threshold. Other links being monitored");
6469                                 mgmt_rssi_disable_success(cmd_disable->sk, hdev,
6470                                                 cp_dis, rp, rp->status);
6471                         } else {
6472                                 BT_DBG("Unset Threshold. Disabling...");
6473                                 mgmt_set_disable_rssi(cmd_disable->sk, hdev,
6474                                                 cp_dis, sizeof(*cp_dis));
6475                         }
6476                         break;
6477                 }
6478         }
6479 }
6480
6481 static void set_rssi_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6482 {
6483         BT_DBG("status 0x%02x", status);
6484 }
6485
6486 static int set_enable_rssi(struct sock *sk, struct hci_dev *hdev,
6487                 void *data, u16 len)
6488 {
6489         struct pending_cmd *cmd;
6490         struct hci_request req;
6491         struct mgmt_cp_set_enable_rssi *cp = data;
6492         struct hci_cp_set_enable_rssi cp_en = { 0, };
6493         int err;
6494         BT_DBG("Set Enable RSSI.");
6495
6496         cp_en.hci_le_ext_opcode = 0x01;
6497         cp_en.le_enable_cs_Features = 0x04;
6498         cp_en.data[0] = 0x00;
6499         cp_en.data[1] = 0x00;
6500         cp_en.data[2] = 0x00;
6501
6502         if (!lmp_le_capable(hdev))
6503                 return cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6504                                 MGMT_STATUS_NOT_SUPPORTED);
6505
6506         hci_dev_lock(hdev);
6507         if (!hdev_is_powered(hdev)) {
6508                 BT_DBG("%s", hdev->name);
6509                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE, 0,
6510                                    data, len);
6511
6512                 goto unlocked;
6513         }
6514
6515         if (mgmt_pending_find(MGMT_OP_SET_RSSI_ENABLE, hdev)) {
6516                 BT_DBG("%s", hdev->name);
6517                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_ENABLE,
6518                                 MGMT_STATUS_BUSY);
6519                 goto unlocked;
6520         }
6521
6522         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_ENABLE, hdev, cp, sizeof(*cp));
6523         if (!cmd) {
6524                 BT_DBG("%s", hdev->name);
6525                 err = -ENOMEM;
6526                 goto unlocked;
6527         }
6528
6529         /* If RSSI is already enabled directly set Threshold values*/
6530         if (hci_conn_hash_lookup_rssi_count(hdev) > 0) {
6531                 hci_dev_unlock(hdev);
6532                 BT_DBG("RSSI Enabled. Directly set Threshold");
6533                 err = mgmt_set_rssi_threshold(sk, hdev, cp, sizeof(*cp));
6534                 return err;
6535         }
6536
6537         hci_req_init(&req, hdev);
6538
6539         BT_DBG("Enable Len: %d [%2.2X %2.2X %2.2X %2.2X %2.2X]",
6540                         sizeof(struct hci_cp_set_enable_rssi),
6541                         cp_en.hci_le_ext_opcode, cp_en.le_enable_cs_Features,
6542                         cp_en.data[0], cp_en.data[1], cp_en.data[2]);
6543
6544         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(cp_en), &cp_en);
6545         err = hci_req_run(&req, set_rssi_enable_complete);
6546
6547         if (err < 0) {
6548                 mgmt_pending_remove(cmd);
6549                 BT_ERR("Error in requesting hci_req_run");
6550                 goto unlocked;
6551         }
6552
6553 unlocked:
6554         hci_dev_unlock(hdev);
6555
6556         return err;
6557 }
6558
6559 static void get_raw_rssi_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6560 {
6561         struct pending_cmd *cmd;
6562
6563         BT_DBG("status 0x%02x", status);
6564
6565         hci_dev_lock(hdev);
6566
6567         cmd = mgmt_pending_find(MGMT_OP_GET_RAW_RSSI, hdev);
6568         if (!cmd)
6569                 goto unlock;
6570
6571         cmd_complete(cmd->sk, hdev->id, MGMT_OP_GET_RAW_RSSI, MGMT_STATUS_SUCCESS,
6572                         &status, 1);
6573
6574         mgmt_pending_remove(cmd);
6575
6576 unlock:
6577         hci_dev_unlock(hdev);
6578 }
6579
6580 static int get_raw_rssi(struct sock *sk, struct hci_dev *hdev, void *data,
6581                         u16 len)
6582 {
6583         struct pending_cmd *cmd;
6584         struct hci_request req;
6585         struct mgmt_cp_get_raw_rssi *cp = data;
6586         struct hci_cp_get_raw_rssi hci_cp;
6587
6588         struct hci_conn *conn;
6589         int err;
6590         __u8 dest_type;
6591
6592         BT_DBG("Get Raw RSSI.");
6593         if (!lmp_le_capable(hdev))
6594                 return cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6595                                 MGMT_STATUS_NOT_SUPPORTED);
6596
6597         hci_dev_lock(hdev);
6598
6599         if (cp->link_type == 0x01) {
6600                 dest_type = LE_LINK;
6601         } else {
6602                 dest_type = ACL_LINK;
6603         }
6604
6605         /* Get LE/BREDR link handle info*/
6606         conn = hci_conn_hash_lookup_ba(hdev,
6607                         dest_type, &cp->bt_address);
6608         if (conn == NULL) {
6609                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_RAW_RSSI, 1,
6610                                                    data, len);
6611                 goto unlocked;
6612         }
6613         hci_cp.conn_handle = conn->handle;
6614
6615         if (!hdev_is_powered(hdev)) {
6616                 BT_DBG("%s", hdev->name);
6617                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_RAW_RSSI, 0,
6618                                    data, len);
6619
6620                 goto unlocked;
6621         }
6622
6623         if (mgmt_pending_find(MGMT_OP_GET_RAW_RSSI, hdev)) {
6624                 BT_DBG("%s", hdev->name);
6625                 err = cmd_status(sk, hdev->id, MGMT_OP_GET_RAW_RSSI,
6626                                 MGMT_STATUS_BUSY);
6627                 goto unlocked;
6628         }
6629
6630         cmd = mgmt_pending_add(sk, MGMT_OP_GET_RAW_RSSI, hdev, data, len);
6631         if (!cmd) {
6632                 BT_DBG("%s", hdev->name);
6633                 err = -ENOMEM;
6634                 goto unlocked;
6635         }
6636
6637         hci_req_init(&req, hdev);
6638
6639         BT_DBG("Connection Handle [%d]", hci_cp.conn_handle);
6640         hci_req_add(&req, HCI_OP_GET_RAW_RSSI, sizeof(hci_cp), &hci_cp);
6641         err = hci_req_run(&req, get_raw_rssi_complete);
6642
6643         if (err < 0) {
6644                 mgmt_pending_remove(cmd);
6645                 BT_ERR("Error in requesting hci_req_run");
6646         }
6647
6648 unlocked:
6649         hci_dev_unlock(hdev);
6650
6651         return err;
6652 }
6653
6654 void mgmt_raw_rssi_response(struct hci_dev *hdev,
6655                 struct hci_cc_rp_get_raw_rssi *rp, int success)
6656 {
6657         struct mgmt_cc_rp_get_raw_rssi mgmt_rp = { 0, };
6658         struct hci_conn *conn;
6659
6660         mgmt_rp.status = rp->status;
6661         mgmt_rp.rssi_dbm = rp->rssi_dbm;
6662
6663         conn = hci_conn_hash_lookup_handle(hdev, rp->conn_handle);
6664         if (conn == NULL)
6665                 return;
6666
6667         bacpy(&mgmt_rp.bt_address, &conn->dst);
6668         if (conn->type == LE_LINK) {
6669                 mgmt_rp.link_type = 0x01;
6670         } else {
6671                 mgmt_rp.link_type = 0x00;
6672         }
6673
6674         mgmt_event(MGMT_EV_RAW_RSSI, hdev, &mgmt_rp,
6675                         sizeof(struct mgmt_cc_rp_get_raw_rssi), NULL);
6676 }
6677
6678 static void set_disable_threshold_complete(struct hci_dev *hdev,
6679                         u8 status, u16 opcode)
6680 {
6681         BT_DBG("status 0x%02x", status);
6682 }
6683
6684 /** Removes monitoring for a link*/
6685 static int set_disable_threshold(struct sock *sk, struct hci_dev *hdev,
6686                 void *data, u16 len)
6687 {
6688         int err = 0;
6689         struct hci_cp_set_rssi_threshold th = { 0, };
6690         struct mgmt_cp_disable_rssi *cp = data;
6691         struct hci_conn *conn;
6692         struct pending_cmd *cmd;
6693         struct hci_request req;
6694         __u8 dest_type;
6695         BT_DBG("Set Disable RSSI.");
6696
6697         if (!lmp_le_capable(hdev)) {
6698                 return cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6699                                 MGMT_STATUS_NOT_SUPPORTED);
6700         }
6701
6702         hci_dev_lock(hdev);
6703
6704         /* Get LE/ACL link handle info*/
6705         if (cp->link_type == 0x01)
6706                 dest_type = LE_LINK;
6707         else
6708                 dest_type = ACL_LINK;
6709
6710         conn = hci_conn_hash_lookup_ba(hdev,
6711                         dest_type, &cp->bdaddr);
6712         if (conn == NULL) {
6713                 err = cmd_complete(sk, hdev->id,
6714                                 MGMT_OP_SET_RSSI_DISABLE, 1, NULL, 0);
6715                 goto unlocked;
6716         }
6717
6718         th.hci_le_ext_opcode = 0x0B;
6719         th.mode = 0x01;
6720         th.conn_handle = conn->handle;
6721         th.alert_mask = 0x00;
6722         th.low_th = 0x00;
6723         th.in_range_th = 0x00;
6724         th.high_th = 0x00;
6725
6726         if (!hdev_is_powered(hdev)) {
6727                 BT_DBG("%s", hdev->name);
6728                 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE, 0,
6729                                    data, len);
6730                 goto unlocked;
6731         }
6732
6733         if (mgmt_pending_find(MGMT_OP_SET_RSSI_DISABLE, hdev)) {
6734                 BT_DBG("%s", hdev->name);
6735                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_RSSI_DISABLE,
6736                                 MGMT_STATUS_BUSY);
6737                 goto unlocked;
6738         }
6739
6740         cmd = mgmt_pending_add(sk, MGMT_OP_SET_RSSI_DISABLE, hdev, cp, sizeof(*cp));
6741         if (!cmd) {
6742                 BT_DBG("%s", hdev->name);
6743                 err = -ENOMEM;
6744                 goto unlocked;
6745         }
6746
6747         hci_req_init(&req, hdev);
6748
6749         hci_req_add(&req, HCI_OP_ENABLE_RSSI, sizeof(th), &th);
6750         err = hci_req_run(&req, set_disable_threshold_complete);
6751         if (err < 0) {
6752                 mgmt_pending_remove(cmd);
6753                 BT_ERR("Error in requesting hci_req_run");
6754                 goto unlocked;
6755         }
6756
6757 unlocked:
6758         hci_dev_unlock(hdev);
6759
6760         return err;
6761 }
6762
6763 void mgmt_rssi_alert_evt(struct hci_dev *hdev, struct sk_buff *skb)
6764 {
6765         struct hci_ev_vendor_specific_rssi_alert *ev = (void *) skb->data;
6766         struct mgmt_ev_vendor_specific_rssi_alert mgmt_ev;
6767         struct hci_conn *conn;
6768
6769         BT_DBG("RSSI alert [%2.2X %2.2X %2.2X]",
6770                         ev->conn_handle, ev->alert_type, ev->rssi_dbm);
6771
6772         conn = hci_conn_hash_lookup_handle(hdev, ev->conn_handle);
6773
6774         if (conn == NULL) {
6775                 BT_ERR("RSSI alert Error: Device not found for handle");
6776                 return;
6777         }
6778         bacpy(&mgmt_ev.bdaddr, &conn->dst);
6779
6780         if (conn->type == LE_LINK)
6781                 mgmt_ev.link_type = 0x01;
6782         else
6783                 mgmt_ev.link_type = 0x00;
6784
6785         mgmt_ev.alert_type = ev->alert_type;
6786         mgmt_ev.rssi_dbm = ev->rssi_dbm;
6787
6788         mgmt_event(MGMT_EV_RSSI_ALERT, hdev, &mgmt_ev,
6789                         sizeof(struct mgmt_ev_vendor_specific_rssi_alert), NULL);
6790 }
6791
6792 void mgmt_multi_adv_state_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
6793 {
6794         struct hci_ev_vendor_specific_multi_adv_state *ev = (void *) skb->data;
6795         struct mgmt_ev_vendor_specific_multi_adv_state_changed mgmt_ev;
6796
6797         BT_DBG("Multi adv state changed [%2.2X %2.2X %2.2X]",
6798                         ev->adv_instance, ev->state_change_reason, ev->connection_handle);
6799
6800         mgmt_ev.adv_instance = ev->adv_instance;
6801         mgmt_ev.state_change_reason = ev->state_change_reason;
6802         mgmt_ev.connection_handle = ev->connection_handle;
6803
6804         mgmt_event(MGMT_EV_MULTI_ADV_STATE_CHANGED, hdev, &mgmt_ev,
6805                         sizeof(struct mgmt_ev_vendor_specific_multi_adv_state_changed), NULL);
6806 }
6807 /* END TIZEN_Bluetooth */
6808 #endif
6809
6810 static bool ltk_is_valid(struct mgmt_ltk_info *key)
6811 {
6812         if (key->master != 0x00 && key->master != 0x01)
6813                 return false;
6814
6815         switch (key->addr.type) {
6816         case BDADDR_LE_PUBLIC:
6817                 return true;
6818
6819         case BDADDR_LE_RANDOM:
6820                 /* Two most significant bits shall be set */
6821                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6822                         return false;
6823                 return true;
6824         }
6825
6826         return false;
6827 }
6828
6829 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
6830                                void *cp_data, u16 len)
6831 {
6832         struct mgmt_cp_load_long_term_keys *cp = cp_data;
6833         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
6834                                    sizeof(struct mgmt_ltk_info));
6835         u16 key_count, expected_len;
6836         int i, err;
6837
6838         BT_DBG("request for %s", hdev->name);
6839
6840         if (!lmp_le_capable(hdev))
6841                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6842                                   MGMT_STATUS_NOT_SUPPORTED);
6843
6844         key_count = __le16_to_cpu(cp->key_count);
6845         if (key_count > max_key_count) {
6846                 BT_ERR("load_ltks: too big key_count value %u", key_count);
6847                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6848                                   MGMT_STATUS_INVALID_PARAMS);
6849         }
6850
6851         expected_len = sizeof(*cp) + key_count *
6852                                         sizeof(struct mgmt_ltk_info);
6853         if (expected_len != len) {
6854                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
6855                        expected_len, len);
6856                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6857                                   MGMT_STATUS_INVALID_PARAMS);
6858         }
6859
6860         BT_DBG("%s key_count %u", hdev->name, key_count);
6861
6862         for (i = 0; i < key_count; i++) {
6863                 struct mgmt_ltk_info *key = &cp->keys[i];
6864
6865                 if (!ltk_is_valid(key))
6866                         return cmd_status(sk, hdev->id,
6867                                           MGMT_OP_LOAD_LONG_TERM_KEYS,
6868                                           MGMT_STATUS_INVALID_PARAMS);
6869         }
6870
6871         hci_dev_lock(hdev);
6872
6873         hci_smp_ltks_clear(hdev);
6874
6875         for (i = 0; i < key_count; i++) {
6876                 struct mgmt_ltk_info *key = &cp->keys[i];
6877                 u8 type, addr_type, authenticated;
6878
6879                 if (key->addr.type == BDADDR_LE_PUBLIC)
6880                         addr_type = ADDR_LE_DEV_PUBLIC;
6881                 else
6882                         addr_type = ADDR_LE_DEV_RANDOM;
6883
6884                 switch (key->type) {
6885                 case MGMT_LTK_UNAUTHENTICATED:
6886                         authenticated = 0x00;
6887                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6888                         break;
6889                 case MGMT_LTK_AUTHENTICATED:
6890                         authenticated = 0x01;
6891                         type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6892                         break;
6893                 case MGMT_LTK_P256_UNAUTH:
6894                         authenticated = 0x00;
6895                         type = SMP_LTK_P256;
6896                         break;
6897                 case MGMT_LTK_P256_AUTH:
6898                         authenticated = 0x01;
6899                         type = SMP_LTK_P256;
6900                         break;
6901                 case MGMT_LTK_P256_DEBUG:
6902                         authenticated = 0x00;
6903                         type = SMP_LTK_P256_DEBUG;
6904                 default:
6905                         continue;
6906                 }
6907
6908                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
6909                             authenticated, key->val, key->enc_size, key->ediv,
6910                             key->rand);
6911         }
6912
6913         err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
6914                            NULL, 0);
6915
6916         hci_dev_unlock(hdev);
6917
6918         return err;
6919 }
6920
6921 static int conn_info_cmd_complete(struct pending_cmd *cmd, u8 status)
6922 {
6923         struct hci_conn *conn = cmd->user_data;
6924         struct mgmt_rp_get_conn_info rp;
6925         int err;
6926
6927         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6928
6929         if (status == MGMT_STATUS_SUCCESS) {
6930                 rp.rssi = conn->rssi;
6931                 rp.tx_power = conn->tx_power;
6932                 rp.max_tx_power = conn->max_tx_power;
6933         } else {
6934                 rp.rssi = HCI_RSSI_INVALID;
6935                 rp.tx_power = HCI_TX_POWER_INVALID;
6936                 rp.max_tx_power = HCI_TX_POWER_INVALID;
6937         }
6938
6939         err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
6940                            &rp, sizeof(rp));
6941
6942         hci_conn_drop(conn);
6943         hci_conn_put(conn);
6944
6945         return err;
6946 }
6947
6948 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
6949                                        u16 opcode)
6950 {
6951         struct hci_cp_read_rssi *cp;
6952         struct pending_cmd *cmd;
6953         struct hci_conn *conn;
6954         u16 handle;
6955         u8 status;
6956
6957         BT_DBG("status 0x%02x", hci_status);
6958
6959         hci_dev_lock(hdev);
6960
6961         /* Commands sent in request are either Read RSSI or Read Transmit Power
6962          * Level so we check which one was last sent to retrieve connection
6963          * handle.  Both commands have handle as first parameter so it's safe to
6964          * cast data on the same command struct.
6965          *
6966          * First command sent is always Read RSSI and we fail only if it fails.
6967          * In other case we simply override error to indicate success as we
6968          * already remembered if TX power value is actually valid.
6969          */
6970         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
6971         if (!cp) {
6972                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
6973                 status = MGMT_STATUS_SUCCESS;
6974         } else {
6975                 status = mgmt_status(hci_status);
6976         }
6977
6978         if (!cp) {
6979                 BT_ERR("invalid sent_cmd in conn_info response");
6980                 goto unlock;
6981         }
6982
6983         handle = __le16_to_cpu(cp->handle);
6984         conn = hci_conn_hash_lookup_handle(hdev, handle);
6985         if (!conn) {
6986                 BT_ERR("unknown handle (%d) in conn_info response", handle);
6987                 goto unlock;
6988         }
6989
6990         cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
6991         if (!cmd)
6992                 goto unlock;
6993
6994         cmd->cmd_complete(cmd, status);
6995         mgmt_pending_remove(cmd);
6996
6997 unlock:
6998         hci_dev_unlock(hdev);
6999 }
7000
7001
7002 #ifdef CONFIG_TIZEN_WIP
7003 /* defination of "prandom_u32_max" is imported from latest kernel,
7004  * so if the kernel is migrated to latest, below defination should be removed
7005  */
7006
7007 /**
7008  * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro)
7009  * @ep_ro: right open interval endpoint
7010  *
7011  * Returns a pseudo-random number that is in interval [0, ep_ro). Note
7012  * that the result depends on PRNG being well distributed in [0, ~0U]
7013  * u32 space. Here we use maximally equidistributed combined Tausworthe
7014  * generator, that is, prandom_u32(). This is useful when requesting a
7015  * random index of an array containing ep_ro elements, for example.
7016  *
7017  * Returns: pseudo-random number in interval [0, ep_ro)
7018  */
7019 static inline u32 prandom_u32_max(u32 ep_ro)
7020 {
7021 #ifdef CONFIG_TIZEN_WIP
7022         return (u32)(((u64) random32() * ep_ro) >> 32);
7023 #else
7024         return (u32)(((u64) prandom_u32() * ep_ro) >> 32);
7025 #endif
7026 }
7027 #endif
7028
7029 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7030                          u16 len)
7031 {
7032         struct mgmt_cp_get_conn_info *cp = data;
7033         struct mgmt_rp_get_conn_info rp;
7034         struct hci_conn *conn;
7035         unsigned long conn_info_age;
7036         int err = 0;
7037
7038         BT_DBG("%s", hdev->name);
7039
7040         memset(&rp, 0, sizeof(rp));
7041         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7042         rp.addr.type = cp->addr.type;
7043
7044         if (!bdaddr_type_is_valid(cp->addr.type))
7045                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7046                                     MGMT_STATUS_INVALID_PARAMS,
7047                                     &rp, sizeof(rp));
7048
7049         hci_dev_lock(hdev);
7050
7051         if (!hdev_is_powered(hdev)) {
7052                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7053                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
7054                 goto unlock;
7055         }
7056
7057         if (cp->addr.type == BDADDR_BREDR)
7058                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7059                                                &cp->addr.bdaddr);
7060         else
7061                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7062
7063         if (!conn || conn->state != BT_CONNECTED) {
7064                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7065                                    MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
7066                 goto unlock;
7067         }
7068
7069         if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
7070                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7071                                    MGMT_STATUS_BUSY, &rp, sizeof(rp));
7072                 goto unlock;
7073         }
7074
7075         /* To avoid client trying to guess when to poll again for information we
7076          * calculate conn info age as random value between min/max set in hdev.
7077          */
7078         conn_info_age = hdev->conn_info_min_age +
7079                         prandom_u32_max(hdev->conn_info_max_age -
7080                                         hdev->conn_info_min_age);
7081
7082         /* Query controller to refresh cached values if they are too old or were
7083          * never read.
7084          */
7085         if (time_after(jiffies, conn->conn_info_timestamp +
7086                        msecs_to_jiffies(conn_info_age)) ||
7087             !conn->conn_info_timestamp) {
7088                 struct hci_request req;
7089                 struct hci_cp_read_tx_power req_txp_cp;
7090                 struct hci_cp_read_rssi req_rssi_cp;
7091                 struct pending_cmd *cmd;
7092
7093                 hci_req_init(&req, hdev);
7094                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
7095                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
7096                             &req_rssi_cp);
7097
7098                 /* For LE links TX power does not change thus we don't need to
7099                  * query for it once value is known.
7100                  */
7101                 if (!bdaddr_type_is_le(cp->addr.type) ||
7102                     conn->tx_power == HCI_TX_POWER_INVALID) {
7103                         req_txp_cp.handle = cpu_to_le16(conn->handle);
7104                         req_txp_cp.type = 0x00;
7105                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
7106                                     sizeof(req_txp_cp), &req_txp_cp);
7107                 }
7108
7109                 /* Max TX power needs to be read only once per connection */
7110                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
7111                         req_txp_cp.handle = cpu_to_le16(conn->handle);
7112                         req_txp_cp.type = 0x01;
7113                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
7114                                     sizeof(req_txp_cp), &req_txp_cp);
7115                 }
7116
7117                 err = hci_req_run(&req, conn_info_refresh_complete);
7118                 if (err < 0)
7119                         goto unlock;
7120
7121                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
7122                                        data, len);
7123                 if (!cmd) {
7124                         err = -ENOMEM;
7125                         goto unlock;
7126                 }
7127
7128                 hci_conn_hold(conn);
7129                 cmd->user_data = hci_conn_get(conn);
7130                 cmd->cmd_complete = conn_info_cmd_complete;
7131
7132                 conn->conn_info_timestamp = jiffies;
7133         } else {
7134                 /* Cache is valid, just reply with values cached in hci_conn */
7135                 rp.rssi = conn->rssi;
7136                 rp.tx_power = conn->tx_power;
7137                 rp.max_tx_power = conn->max_tx_power;
7138
7139                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7140                                    MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7141         }
7142
7143 unlock:
7144         hci_dev_unlock(hdev);
7145         return err;
7146 }
7147
7148 static int clock_info_cmd_complete(struct pending_cmd *cmd, u8 status)
7149 {
7150         struct hci_conn *conn = cmd->user_data;
7151         struct mgmt_rp_get_clock_info rp;
7152         struct hci_dev *hdev;
7153         int err;
7154
7155         memset(&rp, 0, sizeof(rp));
7156         memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
7157
7158         if (status)
7159                 goto complete;
7160
7161         hdev = hci_dev_get(cmd->index);
7162         if (hdev) {
7163                 rp.local_clock = cpu_to_le32(hdev->clock);
7164                 hci_dev_put(hdev);
7165         }
7166
7167         if (conn) {
7168                 rp.piconet_clock = cpu_to_le32(conn->clock);
7169                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7170         }
7171
7172 complete:
7173         err = cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
7174                            sizeof(rp));
7175
7176         if (conn) {
7177                 hci_conn_drop(conn);
7178                 hci_conn_put(conn);
7179         }
7180
7181         return err;
7182 }
7183
7184 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7185 {
7186         struct hci_cp_read_clock *hci_cp;
7187         struct pending_cmd *cmd;
7188         struct hci_conn *conn;
7189
7190         BT_DBG("%s status %u", hdev->name, status);
7191
7192         hci_dev_lock(hdev);
7193
7194         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
7195         if (!hci_cp)
7196                 goto unlock;
7197
7198         if (hci_cp->which) {
7199                 u16 handle = __le16_to_cpu(hci_cp->handle);
7200                 conn = hci_conn_hash_lookup_handle(hdev, handle);
7201         } else {
7202                 conn = NULL;
7203         }
7204
7205         cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
7206         if (!cmd)
7207                 goto unlock;
7208
7209         cmd->cmd_complete(cmd, mgmt_status(status));
7210         mgmt_pending_remove(cmd);
7211
7212 unlock:
7213         hci_dev_unlock(hdev);
7214 }
7215
7216 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
7217                          u16 len)
7218 {
7219         struct mgmt_cp_get_clock_info *cp = data;
7220         struct mgmt_rp_get_clock_info rp;
7221         struct hci_cp_read_clock hci_cp;
7222         struct pending_cmd *cmd;
7223         struct hci_request req;
7224         struct hci_conn *conn;
7225         int err;
7226
7227         BT_DBG("%s", hdev->name);
7228
7229         memset(&rp, 0, sizeof(rp));
7230         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7231         rp.addr.type = cp->addr.type;
7232
7233         if (cp->addr.type != BDADDR_BREDR)
7234                 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7235                                     MGMT_STATUS_INVALID_PARAMS,
7236                                     &rp, sizeof(rp));
7237
7238         hci_dev_lock(hdev);
7239
7240         if (!hdev_is_powered(hdev)) {
7241                 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7242                                    MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
7243                 goto unlock;
7244         }
7245
7246         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7247                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7248                                                &cp->addr.bdaddr);
7249                 if (!conn || conn->state != BT_CONNECTED) {
7250                         err = cmd_complete(sk, hdev->id,
7251                                            MGMT_OP_GET_CLOCK_INFO,
7252                                            MGMT_STATUS_NOT_CONNECTED,
7253                                            &rp, sizeof(rp));
7254                         goto unlock;
7255                 }
7256         } else {
7257                 conn = NULL;
7258         }
7259
7260         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7261         if (!cmd) {
7262                 err = -ENOMEM;
7263                 goto unlock;
7264         }
7265
7266         cmd->cmd_complete = clock_info_cmd_complete;
7267
7268         hci_req_init(&req, hdev);
7269
7270         memset(&hci_cp, 0, sizeof(hci_cp));
7271         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
7272
7273         if (conn) {
7274                 hci_conn_hold(conn);
7275                 cmd->user_data = hci_conn_get(conn);
7276
7277                 hci_cp.handle = cpu_to_le16(conn->handle);
7278                 hci_cp.which = 0x01; /* Piconet clock */
7279                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
7280         }
7281
7282         err = hci_req_run(&req, get_clock_info_complete);
7283         if (err < 0)
7284                 mgmt_pending_remove(cmd);
7285
7286 unlock:
7287         hci_dev_unlock(hdev);
7288         return err;
7289 }
7290
7291 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
7292 {
7293         struct hci_conn *conn;
7294
7295         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
7296         if (!conn)
7297                 return false;
7298
7299         if (conn->dst_type != type)
7300                 return false;
7301
7302         if (conn->state != BT_CONNECTED)
7303                 return false;
7304
7305         return true;
7306 }
7307
7308 /* This function requires the caller holds hdev->lock */
7309 static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
7310                                u8 addr_type, u8 auto_connect)
7311 {
7312         struct hci_dev *hdev = req->hdev;
7313         struct hci_conn_params *params;
7314
7315         params = hci_conn_params_add(hdev, addr, addr_type);
7316         if (!params)
7317                 return -EIO;
7318
7319         if (params->auto_connect == auto_connect)
7320                 return 0;
7321
7322         list_del_init(&params->action);
7323
7324         switch (auto_connect) {
7325         case HCI_AUTO_CONN_DISABLED:
7326         case HCI_AUTO_CONN_LINK_LOSS:
7327                 __hci_update_background_scan(req);
7328                 break;
7329         case HCI_AUTO_CONN_REPORT:
7330                 list_add(&params->action, &hdev->pend_le_reports);
7331                 __hci_update_background_scan(req);
7332                 break;
7333         case HCI_AUTO_CONN_DIRECT:
7334         case HCI_AUTO_CONN_ALWAYS:
7335                 if (!is_connected(hdev, addr, addr_type)) {
7336                         list_add(&params->action, &hdev->pend_le_conns);
7337                         __hci_update_background_scan(req);
7338                 }
7339                 break;
7340         }
7341
7342         params->auto_connect = auto_connect;
7343
7344         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
7345                auto_connect);
7346
7347         return 0;
7348 }
7349
7350 static void device_added(struct sock *sk, struct hci_dev *hdev,
7351                          bdaddr_t *bdaddr, u8 type, u8 action)
7352 {
7353         struct mgmt_ev_device_added ev;
7354
7355         bacpy(&ev.addr.bdaddr, bdaddr);
7356         ev.addr.type = type;
7357         ev.action = action;
7358
7359         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7360 }
7361
7362 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7363 {
7364         struct pending_cmd *cmd;
7365
7366         BT_DBG("status 0x%02x", status);
7367
7368         hci_dev_lock(hdev);
7369
7370         cmd = mgmt_pending_find(MGMT_OP_ADD_DEVICE, hdev);
7371         if (!cmd)
7372                 goto unlock;
7373
7374         cmd->cmd_complete(cmd, mgmt_status(status));
7375         mgmt_pending_remove(cmd);
7376
7377 unlock:
7378         hci_dev_unlock(hdev);
7379 }
7380
7381 static int add_device(struct sock *sk, struct hci_dev *hdev,
7382                       void *data, u16 len)
7383 {
7384         struct mgmt_cp_add_device *cp = data;
7385         struct pending_cmd *cmd;
7386         struct hci_request req;
7387         u8 auto_conn, addr_type;
7388         int err;
7389
7390         BT_DBG("%s", hdev->name);
7391
7392         if (!bdaddr_type_is_valid(cp->addr.type) ||
7393             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7394                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7395                                     MGMT_STATUS_INVALID_PARAMS,
7396                                     &cp->addr, sizeof(cp->addr));
7397
7398         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7399                 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7400                                     MGMT_STATUS_INVALID_PARAMS,
7401                                     &cp->addr, sizeof(cp->addr));
7402
7403         hci_req_init(&req, hdev);
7404
7405         hci_dev_lock(hdev);
7406
7407         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
7408         if (!cmd) {
7409                 err = -ENOMEM;
7410                 goto unlock;
7411         }
7412
7413         cmd->cmd_complete = addr_cmd_complete;
7414
7415         if (cp->addr.type == BDADDR_BREDR) {
7416                 /* Only incoming connections action is supported for now */
7417                 if (cp->action != 0x01) {
7418                         err = cmd->cmd_complete(cmd,
7419                                                 MGMT_STATUS_INVALID_PARAMS);
7420                         mgmt_pending_remove(cmd);
7421                         goto unlock;
7422                 }
7423
7424                 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
7425                                           cp->addr.type);
7426                 if (err)
7427                         goto unlock;
7428
7429                 __hci_update_page_scan(&req);
7430
7431                 goto added;
7432         }
7433
7434         if (cp->addr.type == BDADDR_LE_PUBLIC)
7435                 addr_type = ADDR_LE_DEV_PUBLIC;
7436         else
7437                 addr_type = ADDR_LE_DEV_RANDOM;
7438
7439         if (cp->action == 0x02)
7440                 auto_conn = HCI_AUTO_CONN_ALWAYS;
7441         else if (cp->action == 0x01)
7442                 auto_conn = HCI_AUTO_CONN_DIRECT;
7443         else
7444                 auto_conn = HCI_AUTO_CONN_REPORT;
7445
7446         /* If the connection parameters don't exist for this device,
7447          * they will be created and configured with defaults.
7448          */
7449         if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
7450                                 auto_conn) < 0) {
7451                 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
7452                 mgmt_pending_remove(cmd);
7453                 goto unlock;
7454         }
7455
7456 added:
7457         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7458
7459         err = hci_req_run(&req, add_device_complete);
7460         if (err < 0) {
7461                 /* ENODATA means no HCI commands were needed (e.g. if
7462                  * the adapter is powered off).
7463                  */
7464                 if (err == -ENODATA)
7465                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
7466                 mgmt_pending_remove(cmd);
7467         }
7468
7469 unlock:
7470         hci_dev_unlock(hdev);
7471         return err;
7472 }
7473
7474 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7475                            bdaddr_t *bdaddr, u8 type)
7476 {
7477         struct mgmt_ev_device_removed ev;
7478
7479         bacpy(&ev.addr.bdaddr, bdaddr);
7480         ev.addr.type = type;
7481
7482         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7483 }
7484
7485 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
7486 {
7487         struct pending_cmd *cmd;
7488
7489         BT_DBG("status 0x%02x", status);
7490
7491         hci_dev_lock(hdev);
7492
7493         cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
7494         if (!cmd)
7495                 goto unlock;
7496
7497         cmd->cmd_complete(cmd, mgmt_status(status));
7498         mgmt_pending_remove(cmd);
7499
7500 unlock:
7501         hci_dev_unlock(hdev);
7502 }
7503
7504 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7505                          void *data, u16 len)
7506 {
7507         struct mgmt_cp_remove_device *cp = data;
7508         struct pending_cmd *cmd;
7509         struct hci_request req;
7510         int err;
7511
7512         BT_DBG("%s", hdev->name);
7513
7514         hci_req_init(&req, hdev);
7515
7516         hci_dev_lock(hdev);
7517
7518         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
7519         if (!cmd) {
7520                 err = -ENOMEM;
7521                 goto unlock;
7522         }
7523
7524         cmd->cmd_complete = addr_cmd_complete;
7525
7526         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7527                 struct hci_conn_params *params;
7528                 u8 addr_type;
7529
7530                 if (!bdaddr_type_is_valid(cp->addr.type)) {
7531                         err = cmd->cmd_complete(cmd,
7532                                                 MGMT_STATUS_INVALID_PARAMS);
7533                         mgmt_pending_remove(cmd);
7534                         goto unlock;
7535                 }
7536
7537                 if (cp->addr.type == BDADDR_BREDR) {
7538                         err = hci_bdaddr_list_del(&hdev->whitelist,
7539                                                   &cp->addr.bdaddr,
7540                                                   cp->addr.type);
7541                         if (err) {
7542                                 err = cmd->cmd_complete(cmd,
7543                                                         MGMT_STATUS_INVALID_PARAMS);
7544                                 mgmt_pending_remove(cmd);
7545                                 goto unlock;
7546                         }
7547
7548                         __hci_update_page_scan(&req);
7549
7550                         device_removed(sk, hdev, &cp->addr.bdaddr,
7551                                        cp->addr.type);
7552                         goto complete;
7553                 }
7554
7555                 if (cp->addr.type == BDADDR_LE_PUBLIC)
7556                         addr_type = ADDR_LE_DEV_PUBLIC;
7557                 else
7558                         addr_type = ADDR_LE_DEV_RANDOM;
7559
7560                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7561                                                 addr_type);
7562                 if (!params) {
7563                         err = cmd->cmd_complete(cmd,
7564                                                 MGMT_STATUS_INVALID_PARAMS);
7565                         mgmt_pending_remove(cmd);
7566                         goto unlock;
7567                 }
7568
7569                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
7570                         err = cmd->cmd_complete(cmd,
7571                                                 MGMT_STATUS_INVALID_PARAMS);
7572                         mgmt_pending_remove(cmd);
7573                         goto unlock;
7574                 }
7575
7576                 list_del(&params->action);
7577                 list_del(&params->list);
7578                 kfree(params);
7579                 __hci_update_background_scan(&req);
7580
7581                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
7582         } else {
7583                 struct hci_conn_params *p, *tmp;
7584                 struct bdaddr_list *b, *btmp;
7585
7586                 if (cp->addr.type) {
7587                         err = cmd->cmd_complete(cmd,
7588                                                 MGMT_STATUS_INVALID_PARAMS);
7589                         mgmt_pending_remove(cmd);
7590                         goto unlock;
7591                 }
7592
7593                 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
7594                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
7595                         list_del(&b->list);
7596                         kfree(b);
7597                 }
7598
7599                 __hci_update_page_scan(&req);
7600
7601                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
7602                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
7603                                 continue;
7604                         device_removed(sk, hdev, &p->addr, p->addr_type);
7605                         list_del(&p->action);
7606                         list_del(&p->list);
7607                         kfree(p);
7608                 }
7609
7610                 BT_DBG("All LE connection parameters were removed");
7611
7612                 __hci_update_background_scan(&req);
7613         }
7614
7615 complete:
7616         err = hci_req_run(&req, remove_device_complete);
7617         if (err < 0) {
7618                 /* ENODATA means no HCI commands were needed (e.g. if
7619                  * the adapter is powered off).
7620                  */
7621                 if (err == -ENODATA)
7622                         err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
7623                 mgmt_pending_remove(cmd);
7624         }
7625
7626 unlock:
7627         hci_dev_unlock(hdev);
7628         return err;
7629 }
7630
7631 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
7632                            u16 len)
7633 {
7634         struct mgmt_cp_load_conn_param *cp = data;
7635         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
7636                                      sizeof(struct mgmt_conn_param));
7637         u16 param_count, expected_len;
7638         int i;
7639
7640         if (!lmp_le_capable(hdev))
7641                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7642                                   MGMT_STATUS_NOT_SUPPORTED);
7643
7644         param_count = __le16_to_cpu(cp->param_count);
7645         if (param_count > max_param_count) {
7646                 BT_ERR("load_conn_param: too big param_count value %u",
7647                        param_count);
7648                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7649                                   MGMT_STATUS_INVALID_PARAMS);
7650         }
7651
7652         expected_len = sizeof(*cp) + param_count *
7653                                         sizeof(struct mgmt_conn_param);
7654         if (expected_len != len) {
7655                 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
7656                        expected_len, len);
7657                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7658                                   MGMT_STATUS_INVALID_PARAMS);
7659         }
7660
7661         BT_DBG("%s param_count %u", hdev->name, param_count);
7662
7663         hci_dev_lock(hdev);
7664
7665         hci_conn_params_clear_disabled(hdev);
7666
7667         for (i = 0; i < param_count; i++) {
7668                 struct mgmt_conn_param *param = &cp->params[i];
7669                 struct hci_conn_params *hci_param;
7670                 u16 min, max, latency, timeout;
7671                 u8 addr_type;
7672
7673                 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
7674                        param->addr.type);
7675
7676                 if (param->addr.type == BDADDR_LE_PUBLIC) {
7677                         addr_type = ADDR_LE_DEV_PUBLIC;
7678                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
7679                         addr_type = ADDR_LE_DEV_RANDOM;
7680                 } else {
7681                         BT_ERR("Ignoring invalid connection parameters");
7682                         continue;
7683                 }
7684
7685                 min = le16_to_cpu(param->min_interval);
7686                 max = le16_to_cpu(param->max_interval);
7687                 latency = le16_to_cpu(param->latency);
7688                 timeout = le16_to_cpu(param->timeout);
7689
7690                 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
7691                        min, max, latency, timeout);
7692
7693                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
7694                         BT_ERR("Ignoring invalid connection parameters");
7695                         continue;
7696                 }
7697
7698                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7699                                                 addr_type);
7700                 if (!hci_param) {
7701                         BT_ERR("Failed to add connection parameters");
7702                         continue;
7703                 }
7704
7705                 hci_param->conn_min_interval = min;
7706                 hci_param->conn_max_interval = max;
7707                 hci_param->conn_latency = latency;
7708                 hci_param->supervision_timeout = timeout;
7709         }
7710
7711         hci_dev_unlock(hdev);
7712
7713         return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
7714 }
7715
7716 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7717                                void *data, u16 len)
7718 {
7719         struct mgmt_cp_set_external_config *cp = data;
7720         bool changed;
7721         int err;
7722
7723         BT_DBG("%s", hdev->name);
7724
7725         if (hdev_is_powered(hdev))
7726                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7727                                   MGMT_STATUS_REJECTED);
7728
7729         if (cp->config != 0x00 && cp->config != 0x01)
7730                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7731                                     MGMT_STATUS_INVALID_PARAMS);
7732
7733         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7734                 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7735                                   MGMT_STATUS_NOT_SUPPORTED);
7736
7737         hci_dev_lock(hdev);
7738
7739         if (cp->config)
7740                 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
7741                                             &hdev->dev_flags);
7742         else
7743                 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
7744                                              &hdev->dev_flags);
7745
7746         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7747         if (err < 0)
7748                 goto unlock;
7749
7750         if (!changed)
7751                 goto unlock;
7752
7753         err = new_options(hdev, sk);
7754
7755         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
7756                 mgmt_index_removed(hdev);
7757
7758                 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
7759                         set_bit(HCI_CONFIG, &hdev->dev_flags);
7760                         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
7761
7762                         queue_work(hdev->req_workqueue, &hdev->power_on);
7763                 } else {
7764                         set_bit(HCI_RAW, &hdev->flags);
7765                         mgmt_index_added(hdev);
7766                 }
7767         }
7768
7769 unlock:
7770         hci_dev_unlock(hdev);
7771         return err;
7772 }
7773
7774 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
7775                               void *data, u16 len)
7776 {
7777         struct mgmt_cp_set_public_address *cp = data;
7778         bool changed;
7779         int err;
7780
7781         BT_DBG("%s", hdev->name);
7782
7783         if (hdev_is_powered(hdev))
7784                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7785                                   MGMT_STATUS_REJECTED);
7786
7787         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
7788                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7789                                   MGMT_STATUS_INVALID_PARAMS);
7790
7791         if (!hdev->set_bdaddr)
7792                 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7793                                   MGMT_STATUS_NOT_SUPPORTED);
7794
7795         hci_dev_lock(hdev);
7796
7797         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
7798         bacpy(&hdev->public_addr, &cp->bdaddr);
7799
7800         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
7801         if (err < 0)
7802                 goto unlock;
7803
7804         if (!changed)
7805                 goto unlock;
7806
7807         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
7808                 err = new_options(hdev, sk);
7809
7810         if (is_configured(hdev)) {
7811                 mgmt_index_removed(hdev);
7812
7813                 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
7814
7815                 set_bit(HCI_CONFIG, &hdev->dev_flags);
7816                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
7817
7818                 queue_work(hdev->req_workqueue, &hdev->power_on);
7819         }
7820
7821 unlock:
7822         hci_dev_unlock(hdev);
7823         return err;
7824 }
7825
7826 static const struct mgmt_handler {
7827         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
7828                      u16 data_len);
7829         bool var_len;
7830         size_t data_len;
7831 } mgmt_handlers[] = {
7832         { NULL }, /* 0x0000 (no command) */
7833         { read_version,           false, MGMT_READ_VERSION_SIZE },
7834         { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
7835         { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
7836         { read_controller_info,   false, MGMT_READ_INFO_SIZE },
7837         { set_powered,            false, MGMT_SETTING_SIZE },
7838         { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
7839         { set_connectable,        false, MGMT_SETTING_SIZE },
7840         { set_fast_connectable,   false, MGMT_SETTING_SIZE },
7841         { set_bondable,           false, MGMT_SETTING_SIZE },
7842         { set_link_security,      false, MGMT_SETTING_SIZE },
7843         { set_ssp,                false, MGMT_SETTING_SIZE },
7844         { set_hs,                 false, MGMT_SETTING_SIZE },
7845         { set_le,                 false, MGMT_SETTING_SIZE },
7846         { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
7847         { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
7848         { add_uuid,               false, MGMT_ADD_UUID_SIZE },
7849         { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
7850         { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
7851         { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
7852         { disconnect,             false, MGMT_DISCONNECT_SIZE },
7853         { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
7854         { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
7855         { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
7856         { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
7857         { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
7858         { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
7859         { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
7860         { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
7861         { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
7862         { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
7863         { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
7864         { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
7865         { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
7866         { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
7867         { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
7868         { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
7869         { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
7870         { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
7871         { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
7872         { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
7873         { set_advertising,        false, MGMT_SETTING_SIZE },
7874         { set_bredr,              false, MGMT_SETTING_SIZE },
7875         { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
7876         { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
7877         { set_secure_conn,        false, MGMT_SETTING_SIZE },
7878         { set_debug_keys,         false, MGMT_SETTING_SIZE },
7879         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
7880         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
7881         { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
7882         { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
7883         { add_device,             false, MGMT_ADD_DEVICE_SIZE },
7884         { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
7885         { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
7886         { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
7887         { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
7888         { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
7889         { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
7890         { start_service_discovery,true,  MGMT_START_SERVICE_DISCOVERY_SIZE },
7891 };
7892
7893 #ifdef CONFIG_TIZEN_WIP
7894 static const struct mgmt_handler tizen_mgmt_handlers[] = {
7895         { NULL }, /* 0x0000 (no command) */
7896         { set_advertising_params,  false, MGMT_SET_ADVERTISING_PARAMS_SIZE },
7897         { set_advertising_data,    true, MGMT_SET_ADV_MIN_APP_DATA_SIZE },
7898         { set_scan_rsp_data,       true, MGMT_SET_SCAN_RSP_MIN_APP_DATA_SIZE },
7899         { add_white_list,          false, MGMT_ADD_DEV_WHITE_LIST_SIZE },
7900         { remove_from_white_list,  false, MGMT_REMOVE_DEV_FROM_WHITE_LIST_SIZE },
7901         { clear_white_list,        false, MGMT_OP_CLEAR_DEV_WHITE_LIST_SIZE },
7902         { set_enable_rssi,         false, MGMT_SET_RSSI_ENABLE_SIZE },
7903         { get_raw_rssi,            false, MGMT_GET_RAW_RSSI_SIZE },
7904         { set_disable_threshold,   false, MGMT_SET_RSSI_DISABLE_SIZE },
7905         { start_le_discovery,      false, MGMT_START_LE_DISCOVERY_SIZE },
7906         { stop_le_discovery,       false, MGMT_STOP_LE_DISCOVERY_SIZE },
7907         { disable_le_auto_connect, false, MGMT_DISABLE_LE_AUTO_CONNECT_SIZE },
7908         { le_conn_update,          false, MGMT_LE_CONN_UPDATE_SIZE},
7909         { set_manufacturer_data,   false, MGMT_SET_MANUFACTURER_DATA_SIZE},
7910         { le_set_scan_params,      false, MGMT_LE_SET_SCAN_PARAMS_SIZE },
7911         { set_voice_setting,       false, MGMT_SET_VOICE_SETTING_SIZE},
7912         { get_adv_tx_power,       false, MGMT_GET_ADV_TX_POWER_SIZE}
7913 };
7914 #endif
7915
7916 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
7917 {
7918         void *buf;
7919         u8 *cp;
7920         struct mgmt_hdr *hdr;
7921         u16 opcode, index, len;
7922         struct hci_dev *hdev = NULL;
7923         const struct mgmt_handler *handler;
7924         int err;
7925
7926         BT_DBG("got %zu bytes", msglen);
7927
7928         if (msglen < sizeof(*hdr))
7929                 return -EINVAL;
7930
7931         buf = kmalloc(msglen, GFP_KERNEL);
7932         if (!buf)
7933                 return -ENOMEM;
7934
7935 #ifdef CONFIG_TIZEN_WIP
7936         if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
7937 #else
7938         if (memcpy_from_msg(buf, msg, msglen)) {
7939 #endif
7940                 err = -EFAULT;
7941                 goto done;
7942         }
7943
7944         hdr = buf;
7945         opcode = __le16_to_cpu(hdr->opcode);
7946         index = __le16_to_cpu(hdr->index);
7947         len = __le16_to_cpu(hdr->len);
7948
7949         if (len != msglen - sizeof(*hdr)) {
7950                 err = -EINVAL;
7951                 goto done;
7952         }
7953
7954         if (index != MGMT_INDEX_NONE) {
7955                 hdev = hci_dev_get(index);
7956                 if (!hdev) {
7957                         err = cmd_status(sk, index, opcode,
7958                                          MGMT_STATUS_INVALID_INDEX);
7959                         goto done;
7960                 }
7961
7962                 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
7963                     test_bit(HCI_CONFIG, &hdev->dev_flags) ||
7964                     test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
7965                         err = cmd_status(sk, index, opcode,
7966                                          MGMT_STATUS_INVALID_INDEX);
7967                         goto done;
7968                 }
7969
7970                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
7971                     opcode != MGMT_OP_READ_CONFIG_INFO &&
7972                     opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
7973                     opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
7974                         err = cmd_status(sk, index, opcode,
7975                                          MGMT_STATUS_INVALID_INDEX);
7976                         goto done;
7977                 }
7978         }
7979
7980         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
7981             mgmt_handlers[opcode].func == NULL) {
7982 #ifdef CONFIG_TIZEN_WIP
7983                 u16 tizen_opcode = opcode - TIZEN_OP_CODE_BASE;
7984
7985                 if (tizen_opcode > 0 &&
7986                     tizen_opcode < ARRAY_SIZE(tizen_mgmt_handlers) &&
7987                     tizen_mgmt_handlers[tizen_opcode].func) {
7988
7989                     handler = &tizen_mgmt_handlers[tizen_opcode];
7990                     goto handle_mgmt;
7991                 }
7992 #endif
7993                 BT_DBG("Unknown op %u", opcode);
7994                 err = cmd_status(sk, index, opcode,
7995                                  MGMT_STATUS_UNKNOWN_COMMAND);
7996                 goto done;
7997         }
7998
7999         if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
8000                      opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
8001                 err = cmd_status(sk, index, opcode,
8002                                  MGMT_STATUS_INVALID_INDEX);
8003                 goto done;
8004         }
8005
8006         if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
8007                       opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
8008                 err = cmd_status(sk, index, opcode,
8009                                  MGMT_STATUS_INVALID_INDEX);
8010                 goto done;
8011         }
8012
8013         handler = &mgmt_handlers[opcode];
8014
8015 #ifdef CONFIG_TIZEN_WIP
8016 handle_mgmt:
8017 #endif
8018         if ((handler->var_len && len < handler->data_len) ||
8019             (!handler->var_len && len != handler->data_len)) {
8020                 err = cmd_status(sk, index, opcode,
8021                                  MGMT_STATUS_INVALID_PARAMS);
8022                 goto done;
8023         }
8024
8025         if (hdev)
8026                 mgmt_init_hdev(sk, hdev);
8027
8028         cp = buf + sizeof(*hdr);
8029
8030         err = handler->func(sk, hdev, cp, len);
8031         if (err < 0)
8032                 goto done;
8033
8034         err = msglen;
8035
8036 done:
8037         if (hdev)
8038                 hci_dev_put(hdev);
8039
8040         kfree(buf);
8041         return err;
8042 }
8043
8044 void mgmt_index_added(struct hci_dev *hdev)
8045 {
8046         if (hdev->dev_type != HCI_BREDR)
8047                 return;
8048
8049         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8050                 return;
8051
8052         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
8053                 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
8054         else
8055                 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
8056 }
8057
8058 void mgmt_index_removed(struct hci_dev *hdev)
8059 {
8060         u8 status = MGMT_STATUS_INVALID_INDEX;
8061
8062         if (hdev->dev_type != HCI_BREDR)
8063                 return;
8064
8065         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8066                 return;
8067
8068         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8069
8070         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
8071                 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
8072         else
8073                 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
8074 }
8075
8076 /* This function requires the caller holds hdev->lock */
8077 static void restart_le_actions(struct hci_request *req)
8078 {
8079         struct hci_dev *hdev = req->hdev;
8080         struct hci_conn_params *p;
8081
8082         list_for_each_entry(p, &hdev->le_conn_params, list) {
8083                 /* Needed for AUTO_OFF case where might not "really"
8084                  * have been powered off.
8085                  */
8086                 list_del_init(&p->action);
8087
8088                 switch (p->auto_connect) {
8089                 case HCI_AUTO_CONN_DIRECT:
8090                 case HCI_AUTO_CONN_ALWAYS:
8091                         list_add(&p->action, &hdev->pend_le_conns);
8092                         break;
8093                 case HCI_AUTO_CONN_REPORT:
8094                         list_add(&p->action, &hdev->pend_le_reports);
8095                         break;
8096                 default:
8097                         break;
8098                 }
8099         }
8100
8101         __hci_update_background_scan(req);
8102 }
8103
8104 static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8105 {
8106         struct cmd_lookup match = { NULL, hdev };
8107
8108         BT_DBG("status 0x%02x", status);
8109
8110         if (!status) {
8111                 /* Register the available SMP channels (BR/EDR and LE) only
8112                  * when successfully powering on the controller. This late
8113                  * registration is required so that LE SMP can clearly
8114                  * decide if the public address or static address is used.
8115                  */
8116                 smp_register(hdev);
8117         }
8118
8119         hci_dev_lock(hdev);
8120
8121         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8122
8123         new_settings(hdev, match.sk);
8124
8125         hci_dev_unlock(hdev);
8126
8127         if (match.sk)
8128                 sock_put(match.sk);
8129 }
8130
8131 static int powered_update_hci(struct hci_dev *hdev)
8132 {
8133         struct hci_request req;
8134         u8 link_sec;
8135
8136         hci_req_init(&req, hdev);
8137
8138         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
8139             !lmp_host_ssp_capable(hdev)) {
8140                 u8 mode = 0x01;
8141
8142                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
8143
8144                 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
8145                         u8 support = 0x01;
8146
8147                         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
8148                                     sizeof(support), &support);
8149                 }
8150         }
8151
8152         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
8153             lmp_bredr_capable(hdev)) {
8154                 struct hci_cp_write_le_host_supported cp;
8155
8156                 cp.le = 0x01;
8157                 cp.simul = 0x00;
8158
8159                 /* Check first if we already have the right
8160                  * host state (host features set)
8161                  */
8162                 if (cp.le != lmp_host_le_capable(hdev) ||
8163                     cp.simul != lmp_host_le_br_capable(hdev))
8164                         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
8165                                     sizeof(cp), &cp);
8166         }
8167
8168         if (lmp_le_capable(hdev)) {
8169                 /* Make sure the controller has a good default for
8170                  * advertising data. This also applies to the case
8171                  * where BR/EDR was toggled during the AUTO_OFF phase.
8172                  */
8173                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
8174                         update_adv_data(&req);
8175                         update_scan_rsp_data(&req);
8176                 }
8177
8178                 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
8179                         enable_advertising(&req);
8180
8181                 restart_le_actions(&req);
8182         }
8183
8184         link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
8185         if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
8186                 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
8187                             sizeof(link_sec), &link_sec);
8188
8189         if (lmp_bredr_capable(hdev)) {
8190                 write_fast_connectable(&req, false);
8191                 __hci_update_page_scan(&req);
8192                 update_class(&req);
8193                 update_name(&req);
8194                 update_eir(&req);
8195         }
8196
8197         return hci_req_run(&req, powered_complete);
8198 }
8199
8200 int mgmt_powered(struct hci_dev *hdev, u8 powered)
8201 {
8202         struct cmd_lookup match = { NULL, hdev };
8203         u8 status, zero_cod[] = { 0, 0, 0 };
8204         int err;
8205
8206         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
8207                 return 0;
8208
8209         if (powered) {
8210                 if (powered_update_hci(hdev) == 0)
8211                         return 0;
8212
8213                 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
8214                                      &match);
8215                 goto new_settings;
8216         }
8217
8218         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8219
8220         /* If the power off is because of hdev unregistration let
8221          * use the appropriate INVALID_INDEX status. Otherwise use
8222          * NOT_POWERED. We cover both scenarios here since later in
8223          * mgmt_index_removed() any hci_conn callbacks will have already
8224          * been triggered, potentially causing misleading DISCONNECTED
8225          * status responses.
8226          */
8227         if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
8228                 status = MGMT_STATUS_INVALID_INDEX;
8229         else
8230                 status = MGMT_STATUS_NOT_POWERED;
8231
8232         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8233
8234         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
8235                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8236                            zero_cod, sizeof(zero_cod), NULL);
8237
8238 new_settings:
8239         err = new_settings(hdev, match.sk);
8240
8241         if (match.sk)
8242                 sock_put(match.sk);
8243
8244         return err;
8245 }
8246
8247 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
8248 {
8249         struct pending_cmd *cmd;
8250         u8 status;
8251
8252         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
8253         if (!cmd)
8254                 return;
8255
8256         if (err == -ERFKILL)
8257                 status = MGMT_STATUS_RFKILLED;
8258         else
8259                 status = MGMT_STATUS_FAILED;
8260
8261         cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
8262
8263         mgmt_pending_remove(cmd);
8264 }
8265
8266 void mgmt_discoverable_timeout(struct hci_dev *hdev)
8267 {
8268         struct hci_request req;
8269
8270         hci_dev_lock(hdev);
8271
8272         /* When discoverable timeout triggers, then just make sure
8273          * the limited discoverable flag is cleared. Even in the case
8274          * of a timeout triggered from general discoverable, it is
8275          * safe to unconditionally clear the flag.
8276          */
8277         clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
8278         clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
8279
8280         hci_req_init(&req, hdev);
8281         if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
8282                 u8 scan = SCAN_PAGE;
8283                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
8284                             sizeof(scan), &scan);
8285         }
8286         update_class(&req);
8287         update_adv_data(&req);
8288         hci_req_run(&req, NULL);
8289
8290         hdev->discov_timeout = 0;
8291
8292         new_settings(hdev, NULL);
8293
8294         hci_dev_unlock(hdev);
8295 }
8296
8297 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
8298                        bool persistent)
8299 {
8300         struct mgmt_ev_new_link_key ev;
8301
8302         memset(&ev, 0, sizeof(ev));
8303
8304         ev.store_hint = persistent;
8305         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8306         ev.key.addr.type = BDADDR_BREDR;
8307         ev.key.type = key->type;
8308         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
8309         ev.key.pin_len = key->pin_len;
8310
8311         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
8312 }
8313
8314 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
8315 {
8316         switch (ltk->type) {
8317         case SMP_LTK:
8318         case SMP_LTK_SLAVE:
8319                 if (ltk->authenticated)
8320                         return MGMT_LTK_AUTHENTICATED;
8321                 return MGMT_LTK_UNAUTHENTICATED;
8322         case SMP_LTK_P256:
8323                 if (ltk->authenticated)
8324                         return MGMT_LTK_P256_AUTH;
8325                 return MGMT_LTK_P256_UNAUTH;
8326         case SMP_LTK_P256_DEBUG:
8327                 return MGMT_LTK_P256_DEBUG;
8328         }
8329
8330         return MGMT_LTK_UNAUTHENTICATED;
8331 }
8332
8333 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
8334 {
8335         struct mgmt_ev_new_long_term_key ev;
8336
8337         memset(&ev, 0, sizeof(ev));
8338
8339         /* Devices using resolvable or non-resolvable random addresses
8340          * without providing an indentity resolving key don't require
8341          * to store long term keys. Their addresses will change the
8342          * next time around.
8343          *
8344          * Only when a remote device provides an identity address
8345          * make sure the long term key is stored. If the remote
8346          * identity is known, the long term keys are internally
8347          * mapped to the identity address. So allow static random
8348          * and public addresses here.
8349          */
8350         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8351             (key->bdaddr.b[5] & 0xc0) != 0xc0)
8352                 ev.store_hint = 0x00;
8353         else
8354                 ev.store_hint = persistent;
8355
8356         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8357         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
8358         ev.key.type = mgmt_ltk_type(key);
8359         ev.key.enc_size = key->enc_size;
8360         ev.key.ediv = key->ediv;
8361         ev.key.rand = key->rand;
8362
8363         if (key->type == SMP_LTK)
8364                 ev.key.master = 1;
8365
8366         memcpy(ev.key.val, key->val, sizeof(key->val));
8367
8368         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
8369 }
8370
8371 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
8372 {
8373         struct mgmt_ev_new_irk ev;
8374
8375         memset(&ev, 0, sizeof(ev));
8376
8377         /* For identity resolving keys from devices that are already
8378          * using a public address or static random address, do not
8379          * ask for storing this key. The identity resolving key really
8380          * is only mandatory for devices using resovlable random
8381          * addresses.
8382          *
8383          * Storing all identity resolving keys has the downside that
8384          * they will be also loaded on next boot of they system. More
8385          * identity resolving keys, means more time during scanning is
8386          * needed to actually resolve these addresses.
8387          */
8388         if (bacmp(&irk->rpa, BDADDR_ANY))
8389                 ev.store_hint = 0x01;
8390         else
8391                 ev.store_hint = 0x00;
8392
8393         bacpy(&ev.rpa, &irk->rpa);
8394         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
8395         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
8396         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
8397
8398         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
8399 }
8400
8401 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
8402                    bool persistent)
8403 {
8404         struct mgmt_ev_new_csrk ev;
8405
8406         memset(&ev, 0, sizeof(ev));
8407
8408         /* Devices using resolvable or non-resolvable random addresses
8409          * without providing an indentity resolving key don't require
8410          * to store signature resolving keys. Their addresses will change
8411          * the next time around.
8412          *
8413          * Only when a remote device provides an identity address
8414          * make sure the signature resolving key is stored. So allow
8415          * static random and public addresses here.
8416          */
8417         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8418             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
8419                 ev.store_hint = 0x00;
8420         else
8421                 ev.store_hint = persistent;
8422
8423         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
8424         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
8425         ev.key.master = csrk->master;
8426         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
8427
8428         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
8429 }
8430
8431 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
8432                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
8433                          u16 max_interval, u16 latency, u16 timeout)
8434 {
8435         struct mgmt_ev_new_conn_param ev;
8436
8437         if (!hci_is_identity_address(bdaddr, bdaddr_type))
8438                 return;
8439
8440         memset(&ev, 0, sizeof(ev));
8441         bacpy(&ev.addr.bdaddr, bdaddr);
8442         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
8443         ev.store_hint = store_hint;
8444         ev.min_interval = cpu_to_le16(min_interval);
8445         ev.max_interval = cpu_to_le16(max_interval);
8446         ev.latency = cpu_to_le16(latency);
8447         ev.timeout = cpu_to_le16(timeout);
8448
8449         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
8450 }
8451
8452 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
8453                                   u8 data_len)
8454 {
8455         eir[eir_len++] = sizeof(type) + data_len;
8456         eir[eir_len++] = type;
8457         memcpy(&eir[eir_len], data, data_len);
8458         eir_len += data_len;
8459
8460         return eir_len;
8461 }
8462
8463 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
8464                            u32 flags, u8 *name, u8 name_len)
8465 {
8466         char buf[512];
8467         struct mgmt_ev_device_connected *ev = (void *) buf;
8468         u16 eir_len = 0;
8469
8470         bacpy(&ev->addr.bdaddr, &conn->dst);
8471         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8472
8473         ev->flags = __cpu_to_le32(flags);
8474
8475         /* We must ensure that the EIR Data fields are ordered and
8476          * unique. Keep it simple for now and avoid the problem by not
8477          * adding any BR/EDR data to the LE adv.
8478          */
8479         if (conn->le_adv_data_len > 0) {
8480                 memcpy(&ev->eir[eir_len],
8481                        conn->le_adv_data, conn->le_adv_data_len);
8482                 eir_len = conn->le_adv_data_len;
8483         } else {
8484                 if (name_len > 0)
8485                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
8486                                                   name, name_len);
8487
8488                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
8489                         eir_len = eir_append_data(ev->eir, eir_len,
8490                                                   EIR_CLASS_OF_DEV,
8491                                                   conn->dev_class, 3);
8492         }
8493
8494         ev->eir_len = cpu_to_le16(eir_len);
8495
8496         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
8497                     sizeof(*ev) + eir_len, NULL);
8498 }
8499
8500 #ifdef CONFIG_TIZEN_WIP
8501 /* BEGIN TIZEN_Bluetooth :: name update changes */
8502 int mgmt_device_name_update(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name,
8503                             u8 name_len)
8504 {
8505         char buf[512];
8506         struct mgmt_ev_device_name_update *ev = (void *) buf;
8507         u16 eir_len = 0;
8508
8509         if (name_len <= 0)
8510                 return -EINVAL;
8511
8512         bacpy(&ev->addr.bdaddr, bdaddr);
8513         ev->addr.type = BDADDR_BREDR;
8514
8515         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8516                                   name_len);
8517
8518         ev->eir_len = cpu_to_le16(eir_len);
8519
8520         return mgmt_event(MGMT_EV_DEVICE_NAME_UPDATE, hdev, buf,
8521                           sizeof(*ev) + eir_len, NULL);
8522 }
8523 /* END TIZEN_Bluetooth :: name update changes */
8524 #endif
8525
8526 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
8527 {
8528         struct sock **sk = data;
8529
8530         cmd->cmd_complete(cmd, 0);
8531
8532         *sk = cmd->sk;
8533         sock_hold(*sk);
8534
8535         mgmt_pending_remove(cmd);
8536 }
8537
8538 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
8539 {
8540         struct hci_dev *hdev = data;
8541         struct mgmt_cp_unpair_device *cp = cmd->param;
8542
8543         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
8544
8545         cmd->cmd_complete(cmd, 0);
8546         mgmt_pending_remove(cmd);
8547 }
8548
8549 bool mgmt_powering_down(struct hci_dev *hdev)
8550 {
8551         struct pending_cmd *cmd;
8552         struct mgmt_mode *cp;
8553
8554         cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
8555         if (!cmd)
8556                 return false;
8557
8558         cp = cmd->param;
8559         if (!cp->val)
8560                 return true;
8561
8562         return false;
8563 }
8564
8565 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
8566                               u8 link_type, u8 addr_type, u8 reason,
8567                               bool mgmt_connected)
8568 {
8569         struct mgmt_ev_device_disconnected ev;
8570         struct sock *sk = NULL;
8571
8572         /* The connection is still in hci_conn_hash so test for 1
8573          * instead of 0 to know if this is the last one.
8574          */
8575         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8576                 cancel_delayed_work(&hdev->power_off);
8577                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8578         }
8579
8580         if (!mgmt_connected)
8581                 return;
8582
8583         if (link_type != ACL_LINK && link_type != LE_LINK)
8584                 return;
8585
8586         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
8587
8588         bacpy(&ev.addr.bdaddr, bdaddr);
8589         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8590         ev.reason = reason;
8591
8592         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8593
8594         if (sk)
8595                 sock_put(sk);
8596
8597         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8598                              hdev);
8599 }
8600
8601 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8602                             u8 link_type, u8 addr_type, u8 status)
8603 {
8604         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8605         struct mgmt_cp_disconnect *cp;
8606         struct pending_cmd *cmd;
8607
8608         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8609                              hdev);
8610
8611         cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
8612         if (!cmd)
8613                 return;
8614
8615         cp = cmd->param;
8616
8617         if (bacmp(bdaddr, &cp->addr.bdaddr))
8618                 return;
8619
8620         if (cp->addr.type != bdaddr_type)
8621                 return;
8622
8623         cmd->cmd_complete(cmd, mgmt_status(status));
8624         mgmt_pending_remove(cmd);
8625 }
8626
8627 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8628                          u8 addr_type, u8 status)
8629 {
8630         struct mgmt_ev_connect_failed ev;
8631
8632         /* The connection is still in hci_conn_hash so test for 1
8633          * instead of 0 to know if this is the last one.
8634          */
8635         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8636                 cancel_delayed_work(&hdev->power_off);
8637                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8638         }
8639
8640         bacpy(&ev.addr.bdaddr, bdaddr);
8641         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8642         ev.status = mgmt_status(status);
8643
8644         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
8645 }
8646 #ifdef CONFIG_TIZEN_WIP
8647 void mgmt_hardware_error(struct hci_dev *hdev, u8 err_code)
8648 {
8649         struct mgmt_ev_hardware_error ev;
8650
8651         ev.error_code = err_code;
8652         mgmt_event(MGMT_EV_HARDWARE_ERROR, hdev, &ev, sizeof(ev), NULL);
8653 }
8654
8655 void mgmt_tx_timeout_error(struct hci_dev *hdev)
8656 {
8657         mgmt_event(MGMT_EV_TX_TIMEOUT_ERROR, hdev, NULL, 0, NULL);
8658 }
8659 #endif
8660
8661 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
8662 {
8663         struct mgmt_ev_pin_code_request ev;
8664
8665         bacpy(&ev.addr.bdaddr, bdaddr);
8666         ev.addr.type = BDADDR_BREDR;
8667         ev.secure = secure;
8668
8669         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
8670 }
8671
8672 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8673                                   u8 status)
8674 {
8675         struct pending_cmd *cmd;
8676
8677         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
8678         if (!cmd)
8679                 return;
8680
8681         cmd->cmd_complete(cmd, mgmt_status(status));
8682         mgmt_pending_remove(cmd);
8683 }
8684
8685 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8686                                       u8 status)
8687 {
8688         struct pending_cmd *cmd;
8689
8690         cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
8691         if (!cmd)
8692                 return;
8693
8694         cmd->cmd_complete(cmd, mgmt_status(status));
8695         mgmt_pending_remove(cmd);
8696 }
8697
8698 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8699                               u8 link_type, u8 addr_type, u32 value,
8700                               u8 confirm_hint)
8701 {
8702         struct mgmt_ev_user_confirm_request ev;
8703
8704         BT_DBG("%s", hdev->name);
8705
8706         bacpy(&ev.addr.bdaddr, bdaddr);
8707         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8708         ev.confirm_hint = confirm_hint;
8709         ev.value = cpu_to_le32(value);
8710
8711         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
8712                           NULL);
8713 }
8714
8715 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8716                               u8 link_type, u8 addr_type)
8717 {
8718         struct mgmt_ev_user_passkey_request ev;
8719
8720         BT_DBG("%s", hdev->name);
8721
8722         bacpy(&ev.addr.bdaddr, bdaddr);
8723         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8724
8725         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
8726                           NULL);
8727 }
8728
8729 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8730                                       u8 link_type, u8 addr_type, u8 status,
8731                                       u8 opcode)
8732 {
8733         struct pending_cmd *cmd;
8734
8735         cmd = mgmt_pending_find(opcode, hdev);
8736         if (!cmd)
8737                 return -ENOENT;
8738
8739         cmd->cmd_complete(cmd, mgmt_status(status));
8740         mgmt_pending_remove(cmd);
8741
8742         return 0;
8743 }
8744
8745 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8746                                      u8 link_type, u8 addr_type, u8 status)
8747 {
8748         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8749                                           status, MGMT_OP_USER_CONFIRM_REPLY);
8750 }
8751
8752 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8753                                          u8 link_type, u8 addr_type, u8 status)
8754 {
8755         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8756                                           status,
8757                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
8758 }
8759
8760 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8761                                      u8 link_type, u8 addr_type, u8 status)
8762 {
8763         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8764                                           status, MGMT_OP_USER_PASSKEY_REPLY);
8765 }
8766
8767 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8768                                          u8 link_type, u8 addr_type, u8 status)
8769 {
8770         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8771                                           status,
8772                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
8773 }
8774
8775 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
8776                              u8 link_type, u8 addr_type, u32 passkey,
8777                              u8 entered)
8778 {
8779         struct mgmt_ev_passkey_notify ev;
8780
8781         BT_DBG("%s", hdev->name);
8782
8783         bacpy(&ev.addr.bdaddr, bdaddr);
8784         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8785         ev.passkey = __cpu_to_le32(passkey);
8786         ev.entered = entered;
8787
8788         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
8789 }
8790
8791 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
8792 {
8793         struct mgmt_ev_auth_failed ev;
8794         struct pending_cmd *cmd;
8795         u8 status = mgmt_status(hci_status);
8796
8797         bacpy(&ev.addr.bdaddr, &conn->dst);
8798         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8799         ev.status = status;
8800
8801         cmd = find_pairing(conn);
8802
8803         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
8804                     cmd ? cmd->sk : NULL);
8805
8806         if (cmd) {
8807                 cmd->cmd_complete(cmd, status);
8808                 mgmt_pending_remove(cmd);
8809         }
8810 }
8811
8812 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
8813 {
8814         struct cmd_lookup match = { NULL, hdev };
8815         bool changed;
8816
8817         if (status) {
8818                 u8 mgmt_err = mgmt_status(status);
8819                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
8820                                      cmd_status_rsp, &mgmt_err);
8821                 return;
8822         }
8823
8824         if (test_bit(HCI_AUTH, &hdev->flags))
8825                 changed = !test_and_set_bit(HCI_LINK_SECURITY,
8826                                             &hdev->dev_flags);
8827         else
8828                 changed = test_and_clear_bit(HCI_LINK_SECURITY,
8829                                              &hdev->dev_flags);
8830
8831         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
8832                              &match);
8833
8834         if (changed)
8835                 new_settings(hdev, match.sk);
8836
8837         if (match.sk)
8838                 sock_put(match.sk);
8839 }
8840
8841 static void clear_eir(struct hci_request *req)
8842 {
8843         struct hci_dev *hdev = req->hdev;
8844         struct hci_cp_write_eir cp;
8845
8846         if (!lmp_ext_inq_capable(hdev))
8847                 return;
8848
8849         memset(hdev->eir, 0, sizeof(hdev->eir));
8850
8851         memset(&cp, 0, sizeof(cp));
8852
8853         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
8854 }
8855
8856 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
8857 {
8858         struct cmd_lookup match = { NULL, hdev };
8859         struct hci_request req;
8860         bool changed = false;
8861
8862         if (status) {
8863                 u8 mgmt_err = mgmt_status(status);
8864
8865                 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
8866                                                  &hdev->dev_flags)) {
8867                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
8868                         new_settings(hdev, NULL);
8869                 }
8870
8871                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
8872                                      &mgmt_err);
8873                 return;
8874         }
8875
8876         if (enable) {
8877                 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
8878         } else {
8879                 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
8880                 if (!changed)
8881                         changed = test_and_clear_bit(HCI_HS_ENABLED,
8882                                                      &hdev->dev_flags);
8883                 else
8884                         clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
8885         }
8886
8887         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
8888
8889         if (changed)
8890                 new_settings(hdev, match.sk);
8891
8892         if (match.sk)
8893                 sock_put(match.sk);
8894
8895         hci_req_init(&req, hdev);
8896
8897         if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
8898                 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
8899                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
8900                                     sizeof(enable), &enable);
8901                 update_eir(&req);
8902         } else {
8903                 clear_eir(&req);
8904         }
8905
8906         hci_req_run(&req, NULL);
8907 }
8908
8909 static void sk_lookup(struct pending_cmd *cmd, void *data)
8910 {
8911         struct cmd_lookup *match = data;
8912
8913         if (match->sk == NULL) {
8914                 match->sk = cmd->sk;
8915                 sock_hold(match->sk);
8916         }
8917 }
8918
8919 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
8920                                     u8 status)
8921 {
8922         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
8923
8924         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
8925         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
8926         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
8927
8928         if (!status)
8929                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
8930                            NULL);
8931
8932         if (match.sk)
8933                 sock_put(match.sk);
8934 }
8935
8936 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
8937 {
8938         struct mgmt_cp_set_local_name ev;
8939         struct pending_cmd *cmd;
8940
8941         if (status)
8942                 return;
8943
8944         memset(&ev, 0, sizeof(ev));
8945         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
8946         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
8947
8948         cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
8949         if (!cmd) {
8950                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
8951
8952                 /* If this is a HCI command related to powering on the
8953                  * HCI dev don't send any mgmt signals.
8954                  */
8955                 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
8956                         return;
8957         }
8958
8959         mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
8960                    cmd ? cmd->sk : NULL);
8961 }
8962
8963 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
8964                                        u8 *rand192, u8 *hash256, u8 *rand256,
8965                                        u8 status)
8966 {
8967         struct pending_cmd *cmd;
8968
8969         BT_DBG("%s status %u", hdev->name, status);
8970
8971         cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
8972         if (!cmd)
8973                 return;
8974
8975         if (status) {
8976                 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
8977                            mgmt_status(status));
8978         } else {
8979                 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
8980                         struct mgmt_rp_read_local_oob_ext_data rp;
8981
8982                         memcpy(rp.hash192, hash192, sizeof(rp.hash192));
8983                         memcpy(rp.rand192, rand192, sizeof(rp.rand192));
8984
8985                         memcpy(rp.hash256, hash256, sizeof(rp.hash256));
8986                         memcpy(rp.rand256, rand256, sizeof(rp.rand256));
8987
8988                         cmd_complete(cmd->sk, hdev->id,
8989                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
8990                                      &rp, sizeof(rp));
8991                 } else {
8992                         struct mgmt_rp_read_local_oob_data rp;
8993
8994                         memcpy(rp.hash, hash192, sizeof(rp.hash));
8995                         memcpy(rp.rand, rand192, sizeof(rp.rand));
8996
8997                         cmd_complete(cmd->sk, hdev->id,
8998                                      MGMT_OP_READ_LOCAL_OOB_DATA, 0,
8999                                      &rp, sizeof(rp));
9000                 }
9001         }
9002
9003         mgmt_pending_remove(cmd);
9004 }
9005
9006 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
9007 {
9008         int i;
9009
9010         for (i = 0; i < uuid_count; i++) {
9011                 if (!memcmp(uuid, uuids[i], 16))
9012                         return true;
9013         }
9014
9015         return false;
9016 }
9017
9018 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
9019 {
9020         u16 parsed = 0;
9021
9022         while (parsed < eir_len) {
9023                 u8 field_len = eir[0];
9024                 u8 uuid[16];
9025                 int i;
9026
9027                 if (field_len == 0)
9028                         break;
9029
9030                 if (eir_len - parsed < field_len + 1)
9031                         break;
9032
9033                 switch (eir[1]) {
9034                 case EIR_UUID16_ALL:
9035                 case EIR_UUID16_SOME:
9036                         for (i = 0; i + 3 <= field_len; i += 2) {
9037                                 memcpy(uuid, bluetooth_base_uuid, 16);
9038                                 uuid[13] = eir[i + 3];
9039                                 uuid[12] = eir[i + 2];
9040                                 if (has_uuid(uuid, uuid_count, uuids))
9041                                         return true;
9042                         }
9043                         break;
9044                 case EIR_UUID32_ALL:
9045                 case EIR_UUID32_SOME:
9046                         for (i = 0; i + 5 <= field_len; i += 4) {
9047                                 memcpy(uuid, bluetooth_base_uuid, 16);
9048                                 uuid[15] = eir[i + 5];
9049                                 uuid[14] = eir[i + 4];
9050                                 uuid[13] = eir[i + 3];
9051                                 uuid[12] = eir[i + 2];
9052                                 if (has_uuid(uuid, uuid_count, uuids))
9053                                         return true;
9054                         }
9055                         break;
9056                 case EIR_UUID128_ALL:
9057                 case EIR_UUID128_SOME:
9058                         for (i = 0; i + 17 <= field_len; i += 16) {
9059                                 memcpy(uuid, eir + i + 2, 16);
9060                                 if (has_uuid(uuid, uuid_count, uuids))
9061                                         return true;
9062                         }
9063                         break;
9064                 }
9065
9066                 parsed += field_len + 1;
9067                 eir += field_len + 1;
9068         }
9069
9070         return false;
9071 }
9072
9073 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9074                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9075                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9076 {
9077         char buf[512];
9078         struct mgmt_ev_device_found *ev = (void *) buf;
9079         size_t ev_size;
9080         bool match;
9081
9082         /* Don't send events for a non-kernel initiated discovery. With
9083          * LE one exception is if we have pend_le_reports > 0 in which
9084          * case we're doing passive scanning and want these events.
9085          */
9086         if (!hci_discovery_active(hdev)) {
9087                 if (link_type == ACL_LINK)
9088                         return;
9089                 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
9090                         return;
9091         }
9092
9093         /* When using service discovery with a RSSI threshold, then check
9094          * if such a RSSI threshold is specified. If a RSSI threshold has
9095          * been specified, then all results with a RSSI smaller than the
9096          * RSSI threshold will be dropped.
9097          *
9098          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
9099          * the results are also dropped.
9100          */
9101         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9102             (rssi < hdev->discovery.rssi || rssi == HCI_RSSI_INVALID))
9103                 return;
9104
9105         /* Make sure that the buffer is big enough. The 5 extra bytes
9106          * are for the potential CoD field.
9107          */
9108         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9109                 return;
9110
9111         memset(buf, 0, sizeof(buf));
9112
9113         /* In case of device discovery with BR/EDR devices (pre 1.2), the
9114          * RSSI value was reported as 0 when not available. This behavior
9115          * is kept when using device discovery. This is required for full
9116          * backwards compatibility with the API.
9117          *
9118          * However when using service discovery, the value 127 will be
9119          * returned when the RSSI is not available.
9120          */
9121         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
9122             link_type == ACL_LINK)
9123                 rssi = 0;
9124
9125         bacpy(&ev->addr.bdaddr, bdaddr);
9126         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9127         ev->rssi = rssi;
9128         ev->flags = cpu_to_le32(flags);
9129
9130         if (eir_len > 0) {
9131                 /* When using service discovery and a list of UUID is
9132                  * provided, results with no matching UUID should be
9133                  * dropped. In case there is a match the result is
9134                  * kept and checking possible scan response data
9135                  * will be skipped.
9136                  */
9137                 if (hdev->discovery.uuid_count > 0)
9138                         match = eir_has_uuids(eir, eir_len,
9139                                               hdev->discovery.uuid_count,
9140                                               hdev->discovery.uuids);
9141                 else
9142                         match = true;
9143
9144                 if (!match && !scan_rsp_len)
9145                         return;
9146
9147                 /* Copy EIR or advertising data into event */
9148                 memcpy(ev->eir, eir, eir_len);
9149         } else {
9150                 /* When using service discovery and a list of UUID is
9151                  * provided, results with empty EIR or advertising data
9152                  * should be dropped since they do not match any UUID.
9153                  */
9154                 if (hdev->discovery.uuid_count > 0 && !scan_rsp_len)
9155                         return;
9156
9157                 match = false;
9158         }
9159
9160         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
9161                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9162                                           dev_class, 3);
9163
9164         if (scan_rsp_len > 0) {
9165                 /* When using service discovery and a list of UUID is
9166                  * provided, results with no matching UUID should be
9167                  * dropped if there is no previous match from the
9168                  * advertising data.
9169                  */
9170                 if (hdev->discovery.uuid_count > 0) {
9171                         if (!match && !eir_has_uuids(scan_rsp, scan_rsp_len,
9172                                                      hdev->discovery.uuid_count,
9173                                                      hdev->discovery.uuids))
9174                                 return;
9175                 }
9176
9177                 /* Append scan response data to event */
9178                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9179         } else {
9180                 /* When using service discovery and a list of UUID is
9181                  * provided, results with empty scan response and no
9182                  * previous matched advertising data should be dropped.
9183                  */
9184                 if (hdev->discovery.uuid_count > 0 && !match)
9185                         return;
9186         }
9187
9188         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9189         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9190
9191         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9192 }
9193
9194 #ifdef CONFIG_TIZEN_WIP /* TIZEN_Bluetooth :: Pass adv type */
9195 void mgmt_le_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9196                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9197                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, u8 adv_type)
9198 {
9199         char buf[512];
9200         struct mgmt_ev_le_device_found *ev = (void *) buf;
9201         size_t ev_size;
9202
9203         if (!hci_discovery_active(hdev) && !hci_le_discovery_active(hdev))
9204                 return;
9205
9206         /* Make sure that the buffer is big enough. The 5 extra bytes
9207          * are for the potential CoD field.
9208          */
9209         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9210                 return;
9211
9212         memset(buf, 0, sizeof(buf));
9213
9214         bacpy(&ev->addr.bdaddr, bdaddr);
9215         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9216         ev->rssi = rssi;
9217         ev->flags = cpu_to_le32(flags);
9218         ev->adv_type = adv_type;
9219
9220         if (eir_len > 0)
9221                 memcpy(ev->eir, eir, eir_len);
9222
9223         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
9224                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9225                                           dev_class, 3);
9226
9227         if (scan_rsp_len > 0)
9228                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9229
9230         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9231         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9232
9233         mgmt_event(MGMT_EV_LE_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9234 }
9235 #endif
9236
9237 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9238                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
9239 {
9240         struct mgmt_ev_device_found *ev;
9241         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
9242         u16 eir_len;
9243
9244         ev = (struct mgmt_ev_device_found *) buf;
9245
9246         memset(buf, 0, sizeof(buf));
9247
9248         bacpy(&ev->addr.bdaddr, bdaddr);
9249         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9250         ev->rssi = rssi;
9251
9252         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9253                                   name_len);
9254
9255         ev->eir_len = cpu_to_le16(eir_len);
9256
9257         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
9258 }
9259
9260 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
9261 {
9262         struct mgmt_ev_discovering ev;
9263
9264         BT_DBG("%s discovering %u", hdev->name, discovering);
9265
9266         memset(&ev, 0, sizeof(ev));
9267         ev.type = hdev->discovery.type;
9268         ev.discovering = discovering;
9269
9270         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9271 }
9272
9273 #ifdef CONFIG_TIZEN_WIP
9274 /* BEGIN TIZEN_Bluetooth :: Seperate LE discovery */
9275 void mgmt_le_discovering(struct hci_dev *hdev, u8 discovering)
9276 {
9277         struct mgmt_ev_discovering ev;
9278         struct pending_cmd *cmd;
9279
9280         BT_DBG("%s le discovering %u", hdev->name, discovering);
9281
9282         if (discovering)
9283                 cmd = mgmt_pending_find(MGMT_OP_START_LE_DISCOVERY, hdev);
9284         else
9285                 cmd = mgmt_pending_find(MGMT_OP_STOP_LE_DISCOVERY, hdev);
9286
9287         if (cmd != NULL) {
9288                 u8 type = hdev->le_discovery.type;
9289
9290                 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
9291                              sizeof(type));
9292                 mgmt_pending_remove(cmd);
9293         }
9294
9295         memset(&ev, 0, sizeof(ev));
9296         ev.type = hdev->le_discovery.type;
9297         ev.discovering = discovering;
9298
9299         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9300 }
9301 /* END TIZEN_Bluetooth */
9302 #endif
9303
9304 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
9305 {
9306         BT_DBG("%s status %u", hdev->name, status);
9307 }
9308
9309 void mgmt_reenable_advertising(struct hci_dev *hdev)
9310 {
9311         struct hci_request req;
9312
9313         if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
9314                 return;
9315
9316         hci_req_init(&req, hdev);
9317         enable_advertising(&req);
9318         hci_req_run(&req, adv_enable_complete);
9319 }