net/bluetooth/mgmt.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2010  Nokia Corporation
   5    Copyright (C) 2011-2012 Intel Corporation
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI Management interface */
  26
  27 #include <linux/module.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_sock.h>
  33 #include <net/bluetooth/l2cap.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "smp.h"
  38 #include "mgmt_util.h"
  39 #include "mgmt_config.h"
  40 #include "msft.h"
  41
  42 #define MGMT_VERSION    1
  43 #define MGMT_REVISION   21
  44
  45 static const u16 mgmt_commands[] = {
  46         MGMT_OP_READ_INDEX_LIST,
  47         MGMT_OP_READ_INFO,
  48         MGMT_OP_SET_POWERED,
  49         MGMT_OP_SET_DISCOVERABLE,
  50         MGMT_OP_SET_CONNECTABLE,
  51         MGMT_OP_SET_FAST_CONNECTABLE,
  52         MGMT_OP_SET_BONDABLE,
  53         MGMT_OP_SET_LINK_SECURITY,
  54         MGMT_OP_SET_SSP,
  55         MGMT_OP_SET_HS,
  56         MGMT_OP_SET_LE,
  57         MGMT_OP_SET_DEV_CLASS,
  58         MGMT_OP_SET_LOCAL_NAME,
  59         MGMT_OP_ADD_UUID,
  60         MGMT_OP_REMOVE_UUID,
  61         MGMT_OP_LOAD_LINK_KEYS,
  62         MGMT_OP_LOAD_LONG_TERM_KEYS,
  63         MGMT_OP_DISCONNECT,
  64         MGMT_OP_GET_CONNECTIONS,
  65         MGMT_OP_PIN_CODE_REPLY,
  66         MGMT_OP_PIN_CODE_NEG_REPLY,
  67         MGMT_OP_SET_IO_CAPABILITY,
  68         MGMT_OP_PAIR_DEVICE,
  69         MGMT_OP_CANCEL_PAIR_DEVICE,
  70         MGMT_OP_UNPAIR_DEVICE,
  71         MGMT_OP_USER_CONFIRM_REPLY,
  72         MGMT_OP_USER_CONFIRM_NEG_REPLY,
  73         MGMT_OP_USER_PASSKEY_REPLY,
  74         MGMT_OP_USER_PASSKEY_NEG_REPLY,
  75         MGMT_OP_READ_LOCAL_OOB_DATA,
  76         MGMT_OP_ADD_REMOTE_OOB_DATA,
  77         MGMT_OP_REMOVE_REMOTE_OOB_DATA,
  78         MGMT_OP_START_DISCOVERY,
  79         MGMT_OP_STOP_DISCOVERY,
  80         MGMT_OP_CONFIRM_NAME,
  81         MGMT_OP_BLOCK_DEVICE,
  82         MGMT_OP_UNBLOCK_DEVICE,
  83         MGMT_OP_SET_DEVICE_ID,
  84         MGMT_OP_SET_ADVERTISING,
  85         MGMT_OP_SET_BREDR,
  86         MGMT_OP_SET_STATIC_ADDRESS,
  87         MGMT_OP_SET_SCAN_PARAMS,
  88         MGMT_OP_SET_SECURE_CONN,
  89         MGMT_OP_SET_DEBUG_KEYS,
  90         MGMT_OP_SET_PRIVACY,
  91         MGMT_OP_LOAD_IRKS,
  92         MGMT_OP_GET_CONN_INFO,
  93         MGMT_OP_GET_CLOCK_INFO,
  94         MGMT_OP_ADD_DEVICE,
  95         MGMT_OP_REMOVE_DEVICE,
  96         MGMT_OP_LOAD_CONN_PARAM,
  97         MGMT_OP_READ_UNCONF_INDEX_LIST,
  98         MGMT_OP_READ_CONFIG_INFO,
  99         MGMT_OP_SET_EXTERNAL_CONFIG,
 100         MGMT_OP_SET_PUBLIC_ADDRESS,
 101         MGMT_OP_START_SERVICE_DISCOVERY,
 102         MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
 103         MGMT_OP_READ_EXT_INDEX_LIST,
 104         MGMT_OP_READ_ADV_FEATURES,
 105         MGMT_OP_ADD_ADVERTISING,
 106         MGMT_OP_REMOVE_ADVERTISING,
 107         MGMT_OP_GET_ADV_SIZE_INFO,
 108         MGMT_OP_START_LIMITED_DISCOVERY,
 109         MGMT_OP_READ_EXT_INFO,
 110         MGMT_OP_SET_APPEARANCE,
 111         MGMT_OP_GET_PHY_CONFIGURATION,
 112         MGMT_OP_SET_PHY_CONFIGURATION,
 113         MGMT_OP_SET_BLOCKED_KEYS,
 114         MGMT_OP_SET_WIDEBAND_SPEECH,
 115         MGMT_OP_READ_CONTROLLER_CAP,
 116         MGMT_OP_READ_EXP_FEATURES_INFO,
 117         MGMT_OP_SET_EXP_FEATURE,
 118         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 119         MGMT_OP_SET_DEF_SYSTEM_CONFIG,
 120         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 121         MGMT_OP_SET_DEF_RUNTIME_CONFIG,
 122         MGMT_OP_GET_DEVICE_FLAGS,
 123         MGMT_OP_SET_DEVICE_FLAGS,
 124         MGMT_OP_READ_ADV_MONITOR_FEATURES,
 125         MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
 126         MGMT_OP_REMOVE_ADV_MONITOR,
 127         MGMT_OP_ADD_EXT_ADV_PARAMS,
 128         MGMT_OP_ADD_EXT_ADV_DATA,
 129         MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
 130 };
 131
 132 static const u16 mgmt_events[] = {
 133         MGMT_EV_CONTROLLER_ERROR,
 134         MGMT_EV_INDEX_ADDED,
 135         MGMT_EV_INDEX_REMOVED,
 136         MGMT_EV_NEW_SETTINGS,
 137         MGMT_EV_CLASS_OF_DEV_CHANGED,
 138         MGMT_EV_LOCAL_NAME_CHANGED,
 139         MGMT_EV_NEW_LINK_KEY,
 140         MGMT_EV_NEW_LONG_TERM_KEY,
 141         MGMT_EV_DEVICE_CONNECTED,
 142         MGMT_EV_DEVICE_DISCONNECTED,
 143         MGMT_EV_CONNECT_FAILED,
 144         MGMT_EV_PIN_CODE_REQUEST,
 145         MGMT_EV_USER_CONFIRM_REQUEST,
 146         MGMT_EV_USER_PASSKEY_REQUEST,
 147         MGMT_EV_AUTH_FAILED,
 148         MGMT_EV_DEVICE_FOUND,
 149         MGMT_EV_DISCOVERING,
 150         MGMT_EV_DEVICE_BLOCKED,
 151         MGMT_EV_DEVICE_UNBLOCKED,
 152         MGMT_EV_DEVICE_UNPAIRED,
 153         MGMT_EV_PASSKEY_NOTIFY,
 154         MGMT_EV_NEW_IRK,
 155         MGMT_EV_NEW_CSRK,
 156         MGMT_EV_DEVICE_ADDED,
 157         MGMT_EV_DEVICE_REMOVED,
 158         MGMT_EV_NEW_CONN_PARAM,
 159         MGMT_EV_UNCONF_INDEX_ADDED,
 160         MGMT_EV_UNCONF_INDEX_REMOVED,
 161         MGMT_EV_NEW_CONFIG_OPTIONS,
 162         MGMT_EV_EXT_INDEX_ADDED,
 163         MGMT_EV_EXT_INDEX_REMOVED,
 164         MGMT_EV_LOCAL_OOB_DATA_UPDATED,
 165         MGMT_EV_ADVERTISING_ADDED,
 166         MGMT_EV_ADVERTISING_REMOVED,
 167         MGMT_EV_EXT_INFO_CHANGED,
 168         MGMT_EV_PHY_CONFIGURATION_CHANGED,
 169         MGMT_EV_EXP_FEATURE_CHANGED,
 170         MGMT_EV_DEVICE_FLAGS_CHANGED,
 171         MGMT_EV_ADV_MONITOR_ADDED,
 172         MGMT_EV_ADV_MONITOR_REMOVED,
 173         MGMT_EV_CONTROLLER_SUSPEND,
 174         MGMT_EV_CONTROLLER_RESUME,
 175 };
 176
 177 static const u16 mgmt_untrusted_commands[] = {
 178         MGMT_OP_READ_INDEX_LIST,
 179         MGMT_OP_READ_INFO,
 180         MGMT_OP_READ_UNCONF_INDEX_LIST,
 181         MGMT_OP_READ_CONFIG_INFO,
 182         MGMT_OP_READ_EXT_INDEX_LIST,
 183         MGMT_OP_READ_EXT_INFO,
 184         MGMT_OP_READ_CONTROLLER_CAP,
 185         MGMT_OP_READ_EXP_FEATURES_INFO,
 186         MGMT_OP_READ_DEF_SYSTEM_CONFIG,
 187         MGMT_OP_READ_DEF_RUNTIME_CONFIG,
 188 };
 189
 190 static const u16 mgmt_untrusted_events[] = {
 191         MGMT_EV_INDEX_ADDED,
 192         MGMT_EV_INDEX_REMOVED,
 193         MGMT_EV_NEW_SETTINGS,
 194         MGMT_EV_CLASS_OF_DEV_CHANGED,
 195         MGMT_EV_LOCAL_NAME_CHANGED,
 196         MGMT_EV_UNCONF_INDEX_ADDED,
 197         MGMT_EV_UNCONF_INDEX_REMOVED,
 198         MGMT_EV_NEW_CONFIG_OPTIONS,
 199         MGMT_EV_EXT_INDEX_ADDED,
 200         MGMT_EV_EXT_INDEX_REMOVED,
 201         MGMT_EV_EXT_INFO_CHANGED,
 202         MGMT_EV_EXP_FEATURE_CHANGED,
 203 };
 204
 205 #define CACHE_TIMEOUT   msecs_to_jiffies(2 * 1000)
 206
 207 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
 208                  "\x00\x00\x00\x00\x00\x00\x00\x00"
 209
 210 /* HCI to MGMT error code conversion table */
 211 static const u8 mgmt_status_table[] = {
 212         MGMT_STATUS_SUCCESS,
 213         MGMT_STATUS_UNKNOWN_COMMAND,    /* Unknown Command */
 214         MGMT_STATUS_NOT_CONNECTED,      /* No Connection */
 215         MGMT_STATUS_FAILED,             /* Hardware Failure */
 216         MGMT_STATUS_CONNECT_FAILED,     /* Page Timeout */
 217         MGMT_STATUS_AUTH_FAILED,        /* Authentication Failed */
 218         MGMT_STATUS_AUTH_FAILED,        /* PIN or Key Missing */
 219         MGMT_STATUS_NO_RESOURCES,       /* Memory Full */
 220         MGMT_STATUS_TIMEOUT,            /* Connection Timeout */
 221         MGMT_STATUS_NO_RESOURCES,       /* Max Number of Connections */
 222         MGMT_STATUS_NO_RESOURCES,       /* Max Number of SCO Connections */
 223         MGMT_STATUS_ALREADY_CONNECTED,  /* ACL Connection Exists */
 224         MGMT_STATUS_BUSY,               /* Command Disallowed */
 225         MGMT_STATUS_NO_RESOURCES,       /* Rejected Limited Resources */
 226         MGMT_STATUS_REJECTED,           /* Rejected Security */
 227         MGMT_STATUS_REJECTED,           /* Rejected Personal */
 228         MGMT_STATUS_TIMEOUT,            /* Host Timeout */
 229         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Feature */
 230         MGMT_STATUS_INVALID_PARAMS,     /* Invalid Parameters */
 231         MGMT_STATUS_DISCONNECTED,       /* OE User Ended Connection */
 232         MGMT_STATUS_NO_RESOURCES,       /* OE Low Resources */
 233         MGMT_STATUS_DISCONNECTED,       /* OE Power Off */
 234         MGMT_STATUS_DISCONNECTED,       /* Connection Terminated */
 235         MGMT_STATUS_BUSY,               /* Repeated Attempts */
 236         MGMT_STATUS_REJECTED,           /* Pairing Not Allowed */
 237         MGMT_STATUS_FAILED,             /* Unknown LMP PDU */
 238         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported Remote Feature */
 239         MGMT_STATUS_REJECTED,           /* SCO Offset Rejected */
 240         MGMT_STATUS_REJECTED,           /* SCO Interval Rejected */
 241         MGMT_STATUS_REJECTED,           /* Air Mode Rejected */
 242         MGMT_STATUS_INVALID_PARAMS,     /* Invalid LMP Parameters */
 243         MGMT_STATUS_FAILED,             /* Unspecified Error */
 244         MGMT_STATUS_NOT_SUPPORTED,      /* Unsupported LMP Parameter Value */
 245         MGMT_STATUS_FAILED,             /* Role Change Not Allowed */
 246         MGMT_STATUS_TIMEOUT,            /* LMP Response Timeout */
 247         MGMT_STATUS_FAILED,             /* LMP Error Transaction Collision */
 248         MGMT_STATUS_FAILED,             /* LMP PDU Not Allowed */
 249         MGMT_STATUS_REJECTED,           /* Encryption Mode Not Accepted */
 250         MGMT_STATUS_FAILED,             /* Unit Link Key Used */
 251         MGMT_STATUS_NOT_SUPPORTED,      /* QoS Not Supported */
 252         MGMT_STATUS_TIMEOUT,            /* Instant Passed */
 253         MGMT_STATUS_NOT_SUPPORTED,      /* Pairing Not Supported */
 254         MGMT_STATUS_FAILED,             /* Transaction Collision */
 255         MGMT_STATUS_FAILED,             /* Reserved for future use */
 256         MGMT_STATUS_INVALID_PARAMS,     /* Unacceptable Parameter */
 257         MGMT_STATUS_REJECTED,           /* QoS Rejected */
 258         MGMT_STATUS_NOT_SUPPORTED,      /* Classification Not Supported */
 259         MGMT_STATUS_REJECTED,           /* Insufficient Security */
 260         MGMT_STATUS_INVALID_PARAMS,     /* Parameter Out Of Range */
 261         MGMT_STATUS_FAILED,             /* Reserved for future use */
 262         MGMT_STATUS_BUSY,               /* Role Switch Pending */
 263         MGMT_STATUS_FAILED,             /* Reserved for future use */
 264         MGMT_STATUS_FAILED,             /* Slot Violation */
 265         MGMT_STATUS_FAILED,             /* Role Switch Failed */
 266         MGMT_STATUS_INVALID_PARAMS,     /* EIR Too Large */
 267         MGMT_STATUS_NOT_SUPPORTED,      /* Simple Pairing Not Supported */
 268         MGMT_STATUS_BUSY,               /* Host Busy Pairing */
 269         MGMT_STATUS_REJECTED,           /* Rejected, No Suitable Channel */
 270         MGMT_STATUS_BUSY,               /* Controller Busy */
 271         MGMT_STATUS_INVALID_PARAMS,     /* Unsuitable Connection Interval */
 272         MGMT_STATUS_TIMEOUT,            /* Directed Advertising Timeout */
 273         MGMT_STATUS_AUTH_FAILED,        /* Terminated Due to MIC Failure */
 274         MGMT_STATUS_CONNECT_FAILED,     /* Connection Establishment Failed */
 275         MGMT_STATUS_CONNECT_FAILED,     /* MAC Connection Failed */
 276 };
 277
 278 static u8 mgmt_status(u8 hci_status)
 279 {
 280         if (hci_status < ARRAY_SIZE(mgmt_status_table))
 281                 return mgmt_status_table[hci_status];
 282
 283         return MGMT_STATUS_FAILED;
 284 }
 285
 286 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
 287                             u16 len, int flag)
 288 {
 289         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 290                                flag, NULL);
 291 }
 292
 293 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
 294                               u16 len, int flag, struct sock *skip_sk)
 295 {
 296         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 297                                flag, skip_sk);
 298 }
 299
 300 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
 301                       struct sock *skip_sk)
 302 {
 303         return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
 304                                HCI_SOCK_TRUSTED, skip_sk);
 305 }
 306
 307 static u8 le_addr_type(u8 mgmt_addr_type)
 308 {
 309         if (mgmt_addr_type == BDADDR_LE_PUBLIC)
 310                 return ADDR_LE_DEV_PUBLIC;
 311         else
 312                 return ADDR_LE_DEV_RANDOM;
 313 }
 314
 315 void mgmt_fill_version_info(void *ver)
 316 {
 317         struct mgmt_rp_read_version *rp = ver;
 318
 319         rp->version = MGMT_VERSION;
 320         rp->revision = cpu_to_le16(MGMT_REVISION);
 321 }
 322
 323 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
 324                         u16 data_len)
 325 {
 326         struct mgmt_rp_read_version rp;
 327
 328         bt_dev_dbg(hdev, "sock %p", sk);
 329
 330         mgmt_fill_version_info(&rp);
 331
 332         return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
 333                                  &rp, sizeof(rp));
 334 }
 335
 336 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
 337                          u16 data_len)
 338 {
 339         struct mgmt_rp_read_commands *rp;
 340         u16 num_commands, num_events;
 341         size_t rp_size;
 342         int i, err;
 343
 344         bt_dev_dbg(hdev, "sock %p", sk);
 345
 346         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 347                 num_commands = ARRAY_SIZE(mgmt_commands);
 348                 num_events = ARRAY_SIZE(mgmt_events);
 349         } else {
 350                 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
 351                 num_events = ARRAY_SIZE(mgmt_untrusted_events);
 352         }
 353
 354         rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 355
 356         rp = kmalloc(rp_size, GFP_KERNEL);
 357         if (!rp)
 358                 return -ENOMEM;
 359
 360         rp->num_commands = cpu_to_le16(num_commands);
 361         rp->num_events = cpu_to_le16(num_events);
 362
 363         if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
 364                 __le16 *opcode = rp->opcodes;
 365
 366                 for (i = 0; i < num_commands; i++, opcode++)
 367                         put_unaligned_le16(mgmt_commands[i], opcode);
 368
 369                 for (i = 0; i < num_events; i++, opcode++)
 370                         put_unaligned_le16(mgmt_events[i], opcode);
 371         } else {
 372                 __le16 *opcode = rp->opcodes;
 373
 374                 for (i = 0; i < num_commands; i++, opcode++)
 375                         put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 376
 377                 for (i = 0; i < num_events; i++, opcode++)
 378                         put_unaligned_le16(mgmt_untrusted_events[i], opcode);
 379         }
 380
 381         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
 382                                 rp, rp_size);
 383         kfree(rp);
 384
 385         return err;
 386 }
 387
 388 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 389                            u16 data_len)
 390 {
 391         struct mgmt_rp_read_index_list *rp;
 392         struct hci_dev *d;
 393         size_t rp_len;
 394         u16 count;
 395         int err;
 396
 397         bt_dev_dbg(hdev, "sock %p", sk);
 398
 399         read_lock(&hci_dev_list_lock);
 400
 401         count = 0;
 402         list_for_each_entry(d, &hci_dev_list, list) {
 403                 if (d->dev_type == HCI_PRIMARY &&
 404                     !hci_dev_test_flag(d, HCI_UNCONFIGURED))
 405                         count++;
 406         }
 407
 408         rp_len = sizeof(*rp) + (2 * count);
 409         rp = kmalloc(rp_len, GFP_ATOMIC);
 410         if (!rp) {
 411                 read_unlock(&hci_dev_list_lock);
 412                 return -ENOMEM;
 413         }
 414
 415         count = 0;
 416         list_for_each_entry(d, &hci_dev_list, list) {
 417                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 418                     hci_dev_test_flag(d, HCI_CONFIG) ||
 419                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 420                         continue;
 421
 422                 /* Devices marked as raw-only are neither configured
 423                  * nor unconfigured controllers.
 424                  */
 425                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 426                         continue;
 427
 428                 if (d->dev_type == HCI_PRIMARY &&
 429                     !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 430                         rp->index[count++] = cpu_to_le16(d->id);
 431                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 432                 }
 433         }
 434
 435         rp->num_controllers = cpu_to_le16(count);
 436         rp_len = sizeof(*rp) + (2 * count);
 437
 438         read_unlock(&hci_dev_list_lock);
 439
 440         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
 441                                 0, rp, rp_len);
 442
 443         kfree(rp);
 444
 445         return err;
 446 }
 447
 448 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 449                                   void *data, u16 data_len)
 450 {
 451         struct mgmt_rp_read_unconf_index_list *rp;
 452         struct hci_dev *d;
 453         size_t rp_len;
 454         u16 count;
 455         int err;
 456
 457         bt_dev_dbg(hdev, "sock %p", sk);
 458
 459         read_lock(&hci_dev_list_lock);
 460
 461         count = 0;
 462         list_for_each_entry(d, &hci_dev_list, list) {
 463                 if (d->dev_type == HCI_PRIMARY &&
 464                     hci_dev_test_flag(d, HCI_UNCONFIGURED))
 465                         count++;
 466         }
 467
 468         rp_len = sizeof(*rp) + (2 * count);
 469         rp = kmalloc(rp_len, GFP_ATOMIC);
 470         if (!rp) {
 471                 read_unlock(&hci_dev_list_lock);
 472                 return -ENOMEM;
 473         }
 474
 475         count = 0;
 476         list_for_each_entry(d, &hci_dev_list, list) {
 477                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 478                     hci_dev_test_flag(d, HCI_CONFIG) ||
 479                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 480                         continue;
 481
 482                 /* Devices marked as raw-only are neither configured
 483                  * nor unconfigured controllers.
 484                  */
 485                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 486                         continue;
 487
 488                 if (d->dev_type == HCI_PRIMARY &&
 489                     hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
 490                         rp->index[count++] = cpu_to_le16(d->id);
 491                         bt_dev_dbg(hdev, "Added hci%u", d->id);
 492                 }
 493         }
 494
 495         rp->num_controllers = cpu_to_le16(count);
 496         rp_len = sizeof(*rp) + (2 * count);
 497
 498         read_unlock(&hci_dev_list_lock);
 499
 500         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 501                                 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
 502
 503         kfree(rp);
 504
 505         return err;
 506 }
 507
 508 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
 509                                void *data, u16 data_len)
 510 {
 511         struct mgmt_rp_read_ext_index_list *rp;
 512         struct hci_dev *d;
 513         u16 count;
 514         int err;
 515
 516         bt_dev_dbg(hdev, "sock %p", sk);
 517
 518         read_lock(&hci_dev_list_lock);
 519
 520         count = 0;
 521         list_for_each_entry(d, &hci_dev_list, list) {
 522                 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
 523                         count++;
 524         }
 525
 526         rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
 527         if (!rp) {
 528                 read_unlock(&hci_dev_list_lock);
 529                 return -ENOMEM;
 530         }
 531
 532         count = 0;
 533         list_for_each_entry(d, &hci_dev_list, list) {
 534                 if (hci_dev_test_flag(d, HCI_SETUP) ||
 535                     hci_dev_test_flag(d, HCI_CONFIG) ||
 536                     hci_dev_test_flag(d, HCI_USER_CHANNEL))
 537                         continue;
 538
 539                 /* Devices marked as raw-only are neither configured
 540                  * nor unconfigured controllers.
 541                  */
 542                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
 543                         continue;
 544
 545                 if (d->dev_type == HCI_PRIMARY) {
 546                         if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
 547                                 rp->entry[count].type = 0x01;
 548                         else
 549                                 rp->entry[count].type = 0x00;
 550                 } else if (d->dev_type == HCI_AMP) {
 551                         rp->entry[count].type = 0x02;
 552                 } else {
 553                         continue;
 554                 }
 555
 556                 rp->entry[count].bus = d->bus;
 557                 rp->entry[count++].index = cpu_to_le16(d->id);
 558                 bt_dev_dbg(hdev, "Added hci%u", d->id);
 559         }
 560
 561         rp->num_controllers = cpu_to_le16(count);
 562
 563         read_unlock(&hci_dev_list_lock);
 564
 565         /* If this command is called at least once, then all the
 566          * default index and unconfigured index events are disabled
 567          * and from now on only extended index events are used.
 568          */
 569         hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
 570         hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
 571         hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 572
 573         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
 574                                 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
 575                                 struct_size(rp, entry, count));
 576
 577         kfree(rp);
 578
 579         return err;
 580 }
 581
 582 static bool is_configured(struct hci_dev *hdev)
 583 {
 584         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 585             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 586                 return false;
 587
 588         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 589              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 590             !bacmp(&hdev->public_addr, BDADDR_ANY))
 591                 return false;
 592
 593         return true;
 594 }
 595
 596 static __le32 get_missing_options(struct hci_dev *hdev)
 597 {
 598         u32 options = 0;
 599
 600         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
 601             !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
 602                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 603
 604         if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
 605              test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
 606             !bacmp(&hdev->public_addr, BDADDR_ANY))
 607                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 608
 609         return cpu_to_le32(options);
 610 }
 611
 612 static int new_options(struct hci_dev *hdev, struct sock *skip)
 613 {
 614         __le32 options = get_missing_options(hdev);
 615
 616         return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
 617                                   sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
 618 }
 619
 620 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 621 {
 622         __le32 options = get_missing_options(hdev);
 623
 624         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
 625                                  sizeof(options));
 626 }
 627
 628 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 629                             void *data, u16 data_len)
 630 {
 631         struct mgmt_rp_read_config_info rp;
 632         u32 options = 0;
 633
 634         bt_dev_dbg(hdev, "sock %p", sk);
 635
 636         hci_dev_lock(hdev);
 637
 638         memset(&rp, 0, sizeof(rp));
 639         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
 640
 641         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
 642                 options |= MGMT_OPTION_EXTERNAL_CONFIG;
 643
 644         if (hdev->set_bdaddr)
 645                 options |= MGMT_OPTION_PUBLIC_ADDRESS;
 646
 647         rp.supported_options = cpu_to_le32(options);
 648         rp.missing_options = get_missing_options(hdev);
 649
 650         hci_dev_unlock(hdev);
 651
 652         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
 653                                  &rp, sizeof(rp));
 654 }
 655
 656 static u32 get_supported_phys(struct hci_dev *hdev)
 657 {
 658         u32 supported_phys = 0;
 659
 660         if (lmp_bredr_capable(hdev)) {
 661                 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
 662
 663                 if (hdev->features[0][0] & LMP_3SLOT)
 664                         supported_phys |= MGMT_PHY_BR_1M_3SLOT;
 665
 666                 if (hdev->features[0][0] & LMP_5SLOT)
 667                         supported_phys |= MGMT_PHY_BR_1M_5SLOT;
 668
 669                 if (lmp_edr_2m_capable(hdev)) {
 670                         supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
 671
 672                         if (lmp_edr_3slot_capable(hdev))
 673                                 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
 674
 675                         if (lmp_edr_5slot_capable(hdev))
 676                                 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
 677
 678                         if (lmp_edr_3m_capable(hdev)) {
 679                                 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
 680
 681                                 if (lmp_edr_3slot_capable(hdev))
 682                                         supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
 683
 684                                 if (lmp_edr_5slot_capable(hdev))
 685                                         supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
 686                         }
 687                 }
 688         }
 689
 690         if (lmp_le_capable(hdev)) {
 691                 supported_phys |= MGMT_PHY_LE_1M_TX;
 692                 supported_phys |= MGMT_PHY_LE_1M_RX;
 693
 694                 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
 695                         supported_phys |= MGMT_PHY_LE_2M_TX;
 696                         supported_phys |= MGMT_PHY_LE_2M_RX;
 697                 }
 698
 699                 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
 700                         supported_phys |= MGMT_PHY_LE_CODED_TX;
 701                         supported_phys |= MGMT_PHY_LE_CODED_RX;
 702                 }
 703         }
 704
 705         return supported_phys;
 706 }
 707
 708 static u32 get_selected_phys(struct hci_dev *hdev)
 709 {
 710         u32 selected_phys = 0;
 711
 712         if (lmp_bredr_capable(hdev)) {
 713                 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
 714
 715                 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
 716                         selected_phys |= MGMT_PHY_BR_1M_3SLOT;
 717
 718                 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
 719                         selected_phys |= MGMT_PHY_BR_1M_5SLOT;
 720
 721                 if (lmp_edr_2m_capable(hdev)) {
 722                         if (!(hdev->pkt_type & HCI_2DH1))
 723                                 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
 724
 725                         if (lmp_edr_3slot_capable(hdev) &&
 726                             !(hdev->pkt_type & HCI_2DH3))
 727                                 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
 728
 729                         if (lmp_edr_5slot_capable(hdev) &&
 730                             !(hdev->pkt_type & HCI_2DH5))
 731                                 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
 732
 733                         if (lmp_edr_3m_capable(hdev)) {
 734                                 if (!(hdev->pkt_type & HCI_3DH1))
 735                                         selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
 736
 737                                 if (lmp_edr_3slot_capable(hdev) &&
 738                                     !(hdev->pkt_type & HCI_3DH3))
 739                                         selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
 740
 741                                 if (lmp_edr_5slot_capable(hdev) &&
 742                                     !(hdev->pkt_type & HCI_3DH5))
 743                                         selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
 744                         }
 745                 }
 746         }
 747
 748         if (lmp_le_capable(hdev)) {
 749                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
 750                         selected_phys |= MGMT_PHY_LE_1M_TX;
 751
 752                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
 753                         selected_phys |= MGMT_PHY_LE_1M_RX;
 754
 755                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
 756                         selected_phys |= MGMT_PHY_LE_2M_TX;
 757
 758                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
 759                         selected_phys |= MGMT_PHY_LE_2M_RX;
 760
 761                 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
 762                         selected_phys |= MGMT_PHY_LE_CODED_TX;
 763
 764                 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
 765                         selected_phys |= MGMT_PHY_LE_CODED_RX;
 766         }
 767
 768         return selected_phys;
 769 }
 770
 771 static u32 get_configurable_phys(struct hci_dev *hdev)
 772 {
 773         return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
 774                 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
 775 }
 776
 777 static u32 get_supported_settings(struct hci_dev *hdev)
 778 {
 779         u32 settings = 0;
 780
 781         settings |= MGMT_SETTING_POWERED;
 782         settings |= MGMT_SETTING_BONDABLE;
 783         settings |= MGMT_SETTING_DEBUG_KEYS;
 784         settings |= MGMT_SETTING_CONNECTABLE;
 785         settings |= MGMT_SETTING_DISCOVERABLE;
 786
 787         if (lmp_bredr_capable(hdev)) {
 788                 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
 789                         settings |= MGMT_SETTING_FAST_CONNECTABLE;
 790                 settings |= MGMT_SETTING_BREDR;
 791                 settings |= MGMT_SETTING_LINK_SECURITY;
 792
 793                 if (lmp_ssp_capable(hdev)) {
 794                         settings |= MGMT_SETTING_SSP;
 795                         if (IS_ENABLED(CONFIG_BT_HS))
 796                                 settings |= MGMT_SETTING_HS;
 797                 }
 798
 799                 if (lmp_sc_capable(hdev))
 800                         settings |= MGMT_SETTING_SECURE_CONN;
 801
 802                 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
 803                              &hdev->quirks))
 804                         settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 805         }
 806
 807         if (lmp_le_capable(hdev)) {
 808                 settings |= MGMT_SETTING_LE;
 809                 settings |= MGMT_SETTING_SECURE_CONN;
 810                 settings |= MGMT_SETTING_PRIVACY;
 811                 settings |= MGMT_SETTING_STATIC_ADDRESS;
 812
 813                 /* When the experimental feature for LL Privacy support is
 814                  * enabled, then advertising is no longer supported.
 815                  */
 816                 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
 817                         settings |= MGMT_SETTING_ADVERTISING;
 818         }
 819
 820         if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
 821             hdev->set_bdaddr)
 822                 settings |= MGMT_SETTING_CONFIGURATION;
 823
 824         settings |= MGMT_SETTING_PHY_CONFIGURATION;
 825
 826         return settings;
 827 }
 828
 829 static u32 get_current_settings(struct hci_dev *hdev)
 830 {
 831         u32 settings = 0;
 832
 833         if (hdev_is_powered(hdev))
 834                 settings |= MGMT_SETTING_POWERED;
 835
 836         if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
 837                 settings |= MGMT_SETTING_CONNECTABLE;
 838
 839         if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
 840                 settings |= MGMT_SETTING_FAST_CONNECTABLE;
 841
 842         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 843                 settings |= MGMT_SETTING_DISCOVERABLE;
 844
 845         if (hci_dev_test_flag(hdev, HCI_BONDABLE))
 846                 settings |= MGMT_SETTING_BONDABLE;
 847
 848         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
 849                 settings |= MGMT_SETTING_BREDR;
 850
 851         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
 852                 settings |= MGMT_SETTING_LE;
 853
 854         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
 855                 settings |= MGMT_SETTING_LINK_SECURITY;
 856
 857         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
 858                 settings |= MGMT_SETTING_SSP;
 859
 860         if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
 861                 settings |= MGMT_SETTING_HS;
 862
 863         if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
 864                 settings |= MGMT_SETTING_ADVERTISING;
 865
 866         if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
 867                 settings |= MGMT_SETTING_SECURE_CONN;
 868
 869         if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
 870                 settings |= MGMT_SETTING_DEBUG_KEYS;
 871
 872         if (hci_dev_test_flag(hdev, HCI_PRIVACY))
 873                 settings |= MGMT_SETTING_PRIVACY;
 874
 875         /* The current setting for static address has two purposes. The
 876          * first is to indicate if the static address will be used and
 877          * the second is to indicate if it is actually set.
 878          *
 879          * This means if the static address is not configured, this flag
 880          * will never be set. If the address is configured, then if the
 881          * address is actually used decides if the flag is set or not.
 882          *
 883          * For single mode LE only controllers and dual-mode controllers
 884          * with BR/EDR disabled, the existence of the static address will
 885          * be evaluated.
 886          */
 887         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
 888             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
 889             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
 890                 if (bacmp(&hdev->static_addr, BDADDR_ANY))
 891                         settings |= MGMT_SETTING_STATIC_ADDRESS;
 892         }
 893
 894         if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
 895                 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
 896
 897         return settings;
 898 }
 899
 900 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 901 {
 902         return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 903 }
 904
 905 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
 906                                                   struct hci_dev *hdev,
 907                                                   const void *data)
 908 {
 909         return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 910 }
 911
 912 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
 913 {
 914         struct mgmt_pending_cmd *cmd;
 915
 916         /* If there's a pending mgmt command the flags will not yet have
 917          * their final values, so check for this first.
 918          */
 919         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
 920         if (cmd) {
 921                 struct mgmt_mode *cp = cmd->param;
 922                 if (cp->val == 0x01)
 923                         return LE_AD_GENERAL;
 924                 else if (cp->val == 0x02)
 925                         return LE_AD_LIMITED;
 926         } else {
 927                 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
 928                         return LE_AD_LIMITED;
 929                 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
 930                         return LE_AD_GENERAL;
 931         }
 932
 933         return 0;
 934 }
 935
 936 bool mgmt_get_connectable(struct hci_dev *hdev)
 937 {
 938         struct mgmt_pending_cmd *cmd;
 939
 940         /* If there's a pending mgmt command the flag will not yet have
 941          * it's final value, so check for this first.
 942          */
 943         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
 944         if (cmd) {
 945                 struct mgmt_mode *cp = cmd->param;
 946
 947                 return cp->val;
 948         }
 949
 950         return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
 951 }
 952
 953 static void service_cache_off(struct work_struct *work)
 954 {
 955         struct hci_dev *hdev = container_of(work, struct hci_dev,
 956                                             service_cache.work);
 957         struct hci_request req;
 958
 959         if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
 960                 return;
 961
 962         hci_req_init(&req, hdev);
 963
 964         hci_dev_lock(hdev);
 965
 966         __hci_req_update_eir(&req);
 967         __hci_req_update_class(&req);
 968
 969         hci_dev_unlock(hdev);
 970
 971         hci_req_run(&req, NULL);
 972 }
 973
 974 static void rpa_expired(struct work_struct *work)
 975 {
 976         struct hci_dev *hdev = container_of(work, struct hci_dev,
 977                                             rpa_expired.work);
 978         struct hci_request req;
 979
 980         bt_dev_dbg(hdev, "");
 981
 982         hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 983
 984         if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
 985                 return;
 986
 987         /* The generation of a new RPA and programming it into the
 988          * controller happens in the hci_req_enable_advertising()
 989          * function.
 990          */
 991         hci_req_init(&req, hdev);
 992         if (ext_adv_capable(hdev))
 993                 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
 994         else
 995                 __hci_req_enable_advertising(&req);
 996         hci_req_run(&req, NULL);
 997 }
 998
 999 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1000 {
1001         if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
1002                 return;
1003
1004         INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1005         INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1006
1007         /* Non-mgmt controlled devices get this bit set
1008          * implicitly so that pairing works for them, however
1009          * for mgmt we require user-space to explicitly enable
1010          * it
1011          */
1012         hci_dev_clear_flag(hdev, HCI_BONDABLE);
1013 }
1014
1015 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1016                                 void *data, u16 data_len)
1017 {
1018         struct mgmt_rp_read_info rp;
1019
1020         bt_dev_dbg(hdev, "sock %p", sk);
1021
1022         hci_dev_lock(hdev);
1023
1024         memset(&rp, 0, sizeof(rp));
1025
1026         bacpy(&rp.bdaddr, &hdev->bdaddr);
1027
1028         rp.version = hdev->hci_ver;
1029         rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1030
1031         rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1032         rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1033
1034         memcpy(rp.dev_class, hdev->dev_class, 3);
1035
1036         memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1037         memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1038
1039         hci_dev_unlock(hdev);
1040
1041         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1042                                  sizeof(rp));
1043 }
1044
1045 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1046 {
1047         u16 eir_len = 0;
1048         size_t name_len;
1049
1050         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1051                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1052                                           hdev->dev_class, 3);
1053
1054         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1055                 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1056                                           hdev->appearance);
1057
1058         name_len = strlen(hdev->dev_name);
1059         eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1060                                   hdev->dev_name, name_len);
1061
1062         name_len = strlen(hdev->short_name);
1063         eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1064                                   hdev->short_name, name_len);
1065
1066         return eir_len;
1067 }
1068
1069 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1070                                     void *data, u16 data_len)
1071 {
1072         char buf[512];
1073         struct mgmt_rp_read_ext_info *rp = (void *)buf;
1074         u16 eir_len;
1075
1076         bt_dev_dbg(hdev, "sock %p", sk);
1077
1078         memset(&buf, 0, sizeof(buf));
1079
1080         hci_dev_lock(hdev);
1081
1082         bacpy(&rp->bdaddr, &hdev->bdaddr);
1083
1084         rp->version = hdev->hci_ver;
1085         rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1086
1087         rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1088         rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1089
1090
1091         eir_len = append_eir_data_to_buf(hdev, rp->eir);
1092         rp->eir_len = cpu_to_le16(eir_len);
1093
1094         hci_dev_unlock(hdev);
1095
1096         /* If this command is called at least once, then the events
1097          * for class of device and local name changes are disabled
1098          * and only the new extended controller information event
1099          * is used.
1100          */
1101         hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1102         hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1103         hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1104
1105         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1106                                  sizeof(*rp) + eir_len);
1107 }
1108
1109 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1110 {
1111         char buf[512];
1112         struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1113         u16 eir_len;
1114
1115         memset(buf, 0, sizeof(buf));
1116
1117         eir_len = append_eir_data_to_buf(hdev, ev->eir);
1118         ev->eir_len = cpu_to_le16(eir_len);
1119
1120         return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1121                                   sizeof(*ev) + eir_len,
1122                                   HCI_MGMT_EXT_INFO_EVENTS, skip);
1123 }
1124
1125 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1126 {
1127         __le32 settings = cpu_to_le32(get_current_settings(hdev));
1128
1129         return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1130                                  sizeof(settings));
1131 }
1132
1133 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1134 {
1135         bt_dev_dbg(hdev, "status 0x%02x", status);
1136
1137         if (hci_conn_count(hdev) == 0) {
1138                 cancel_delayed_work(&hdev->power_off);
1139                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1140         }
1141 }
1142
1143 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1144 {
1145         struct mgmt_ev_advertising_added ev;
1146
1147         ev.instance = instance;
1148
1149         mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1150 }
1151
1152 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1153                               u8 instance)
1154 {
1155         struct mgmt_ev_advertising_removed ev;
1156
1157         ev.instance = instance;
1158
1159         mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1160 }
1161
1162 static void cancel_adv_timeout(struct hci_dev *hdev)
1163 {
1164         if (hdev->adv_instance_timeout) {
1165                 hdev->adv_instance_timeout = 0;
1166                 cancel_delayed_work(&hdev->adv_instance_expire);
1167         }
1168 }
1169
1170 static int clean_up_hci_state(struct hci_dev *hdev)
1171 {
1172         struct hci_request req;
1173         struct hci_conn *conn;
1174         bool discov_stopped;
1175         int err;
1176
1177         hci_req_init(&req, hdev);
1178
1179         if (test_bit(HCI_ISCAN, &hdev->flags) ||
1180             test_bit(HCI_PSCAN, &hdev->flags)) {
1181                 u8 scan = 0x00;
1182                 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1183         }
1184
1185         hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1186
1187         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1188                 __hci_req_disable_advertising(&req);
1189
1190         discov_stopped = hci_req_stop_discovery(&req);
1191
1192         list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1193                 /* 0x15 == Terminated due to Power Off */
1194                 __hci_abort_conn(&req, conn, 0x15);
1195         }
1196
1197         err = hci_req_run(&req, clean_up_hci_complete);
1198         if (!err && discov_stopped)
1199                 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1200
1201         return err;
1202 }
1203
1204 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1205                        u16 len)
1206 {
1207         struct mgmt_mode *cp = data;
1208         struct mgmt_pending_cmd *cmd;
1209         int err;
1210
1211         bt_dev_dbg(hdev, "sock %p", sk);
1212
1213         if (cp->val != 0x00 && cp->val != 0x01)
1214                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1215                                        MGMT_STATUS_INVALID_PARAMS);
1216
1217         hci_dev_lock(hdev);
1218
1219         if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1220                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1221                                       MGMT_STATUS_BUSY);
1222                 goto failed;
1223         }
1224
1225         if (!!cp->val == hdev_is_powered(hdev)) {
1226                 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1227                 goto failed;
1228         }
1229
1230         cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1231         if (!cmd) {
1232                 err = -ENOMEM;
1233                 goto failed;
1234         }
1235
1236         if (cp->val) {
1237                 queue_work(hdev->req_workqueue, &hdev->power_on);
1238                 err = 0;
1239         } else {
1240                 /* Disconnect connections, stop scans, etc */
1241                 err = clean_up_hci_state(hdev);
1242                 if (!err)
1243                         queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1244                                            HCI_POWER_OFF_TIMEOUT);
1245
1246                 /* ENODATA means there were no HCI commands queued */
1247                 if (err == -ENODATA) {
1248                         cancel_delayed_work(&hdev->power_off);
1249                         queue_work(hdev->req_workqueue, &hdev->power_off.work);
1250                         err = 0;
1251                 }
1252         }
1253
1254 failed:
1255         hci_dev_unlock(hdev);
1256         return err;
1257 }
1258
1259 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1260 {
1261         __le32 ev = cpu_to_le32(get_current_settings(hdev));
1262
1263         return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1264                                   sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1265 }
1266
1267 int mgmt_new_settings(struct hci_dev *hdev)
1268 {
1269         return new_settings(hdev, NULL);
1270 }
1271
1272 struct cmd_lookup {
1273         struct sock *sk;
1274         struct hci_dev *hdev;
1275         u8 mgmt_status;
1276 };
1277
1278 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1279 {
1280         struct cmd_lookup *match = data;
1281
1282         send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1283
1284         list_del(&cmd->list);
1285
1286         if (match->sk == NULL) {
1287                 match->sk = cmd->sk;
1288                 sock_hold(match->sk);
1289         }
1290
1291         mgmt_pending_free(cmd);
1292 }
1293
1294 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1295 {
1296         u8 *status = data;
1297
1298         mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1299         mgmt_pending_remove(cmd);
1300 }
1301
1302 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1303 {
1304         if (cmd->cmd_complete) {
1305                 u8 *status = data;
1306
1307                 cmd->cmd_complete(cmd, *status);
1308                 mgmt_pending_remove(cmd);
1309
1310                 return;
1311         }
1312
1313         cmd_status_rsp(cmd, data);
1314 }
1315
1316 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1317 {
1318         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1319                                  cmd->param, cmd->param_len);
1320 }
1321
1322 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1323 {
1324         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1325                                  cmd->param, sizeof(struct mgmt_addr_info));
1326 }
1327
1328 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1329 {
1330         if (!lmp_bredr_capable(hdev))
1331                 return MGMT_STATUS_NOT_SUPPORTED;
1332         else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1333                 return MGMT_STATUS_REJECTED;
1334         else
1335                 return MGMT_STATUS_SUCCESS;
1336 }
1337
1338 static u8 mgmt_le_support(struct hci_dev *hdev)
1339 {
1340         if (!lmp_le_capable(hdev))
1341                 return MGMT_STATUS_NOT_SUPPORTED;
1342         else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1343                 return MGMT_STATUS_REJECTED;
1344         else
1345                 return MGMT_STATUS_SUCCESS;
1346 }
1347
1348 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1349 {
1350         struct mgmt_pending_cmd *cmd;
1351
1352         bt_dev_dbg(hdev, "status 0x%02x", status);
1353
1354         hci_dev_lock(hdev);
1355
1356         cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1357         if (!cmd)
1358                 goto unlock;
1359
1360         if (status) {
1361                 u8 mgmt_err = mgmt_status(status);
1362                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1363                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1364                 goto remove_cmd;
1365         }
1366
1367         if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1368             hdev->discov_timeout > 0) {
1369                 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1370                 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1371         }
1372
1373         send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1374         new_settings(hdev, cmd->sk);
1375
1376 remove_cmd:
1377         mgmt_pending_remove(cmd);
1378
1379 unlock:
1380         hci_dev_unlock(hdev);
1381 }
1382
1383 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1384                             u16 len)
1385 {
1386         struct mgmt_cp_set_discoverable *cp = data;
1387         struct mgmt_pending_cmd *cmd;
1388         u16 timeout;
1389         int err;
1390
1391         bt_dev_dbg(hdev, "sock %p", sk);
1392
1393         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1394             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1395                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1396                                        MGMT_STATUS_REJECTED);
1397
1398         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1399                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1400                                        MGMT_STATUS_INVALID_PARAMS);
1401
1402         timeout = __le16_to_cpu(cp->timeout);
1403
1404         /* Disabling discoverable requires that no timeout is set,
1405          * and enabling limited discoverable requires a timeout.
1406          */
1407         if ((cp->val == 0x00 && timeout > 0) ||
1408             (cp->val == 0x02 && timeout == 0))
1409                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1410                                        MGMT_STATUS_INVALID_PARAMS);
1411
1412         hci_dev_lock(hdev);
1413
1414         if (!hdev_is_powered(hdev) && timeout > 0) {
1415                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1416                                       MGMT_STATUS_NOT_POWERED);
1417                 goto failed;
1418         }
1419
1420         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1421             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1422                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1423                                       MGMT_STATUS_BUSY);
1424                 goto failed;
1425         }
1426
1427         if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1428                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1429                                       MGMT_STATUS_REJECTED);
1430                 goto failed;
1431         }
1432
1433         if (hdev->advertising_paused) {
1434                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1435                                       MGMT_STATUS_BUSY);
1436                 goto failed;
1437         }
1438
1439         if (!hdev_is_powered(hdev)) {
1440                 bool changed = false;
1441
1442                 /* Setting limited discoverable when powered off is
1443                  * not a valid operation since it requires a timeout
1444                  * and so no need to check HCI_LIMITED_DISCOVERABLE.
1445                  */
1446                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1447                         hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1448                         changed = true;
1449                 }
1450
1451                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1452                 if (err < 0)
1453                         goto failed;
1454
1455                 if (changed)
1456                         err = new_settings(hdev, sk);
1457
1458                 goto failed;
1459         }
1460
1461         /* If the current mode is the same, then just update the timeout
1462          * value with the new value. And if only the timeout gets updated,
1463          * then no need for any HCI transactions.
1464          */
1465         if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1466             (cp->val == 0x02) == hci_dev_test_flag(hdev,
1467                                                    HCI_LIMITED_DISCOVERABLE)) {
1468                 cancel_delayed_work(&hdev->discov_off);
1469                 hdev->discov_timeout = timeout;
1470
1471                 if (cp->val && hdev->discov_timeout > 0) {
1472                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1473                         queue_delayed_work(hdev->req_workqueue,
1474                                            &hdev->discov_off, to);
1475                 }
1476
1477                 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1478                 goto failed;
1479         }
1480
1481         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1482         if (!cmd) {
1483                 err = -ENOMEM;
1484                 goto failed;
1485         }
1486
1487         /* Cancel any potential discoverable timeout that might be
1488          * still active and store new timeout value. The arming of
1489          * the timeout happens in the complete handler.
1490          */
1491         cancel_delayed_work(&hdev->discov_off);
1492         hdev->discov_timeout = timeout;
1493
1494         if (cp->val)
1495                 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1496         else
1497                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1498
1499         /* Limited discoverable mode */
1500         if (cp->val == 0x02)
1501                 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1502         else
1503                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1504
1505         queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1506         err = 0;
1507
1508 failed:
1509         hci_dev_unlock(hdev);
1510         return err;
1511 }
1512
1513 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1514 {
1515         struct mgmt_pending_cmd *cmd;
1516
1517         bt_dev_dbg(hdev, "status 0x%02x", status);
1518
1519         hci_dev_lock(hdev);
1520
1521         cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1522         if (!cmd)
1523                 goto unlock;
1524
1525         if (status) {
1526                 u8 mgmt_err = mgmt_status(status);
1527                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1528                 goto remove_cmd;
1529         }
1530
1531         send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1532         new_settings(hdev, cmd->sk);
1533
1534 remove_cmd:
1535         mgmt_pending_remove(cmd);
1536
1537 unlock:
1538         hci_dev_unlock(hdev);
1539 }
1540
1541 static int set_connectable_update_settings(struct hci_dev *hdev,
1542                                            struct sock *sk, u8 val)
1543 {
1544         bool changed = false;
1545         int err;
1546
1547         if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1548                 changed = true;
1549
1550         if (val) {
1551                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1552         } else {
1553                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1554                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1555         }
1556
1557         err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1558         if (err < 0)
1559                 return err;
1560
1561         if (changed) {
1562                 hci_req_update_scan(hdev);
1563                 hci_update_background_scan(hdev);
1564                 return new_settings(hdev, sk);
1565         }
1566
1567         return 0;
1568 }
1569
1570 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1571                            u16 len)
1572 {
1573         struct mgmt_mode *cp = data;
1574         struct mgmt_pending_cmd *cmd;
1575         int err;
1576
1577         bt_dev_dbg(hdev, "sock %p", sk);
1578
1579         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1580             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1581                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1582                                        MGMT_STATUS_REJECTED);
1583
1584         if (cp->val != 0x00 && cp->val != 0x01)
1585                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1586                                        MGMT_STATUS_INVALID_PARAMS);
1587
1588         hci_dev_lock(hdev);
1589
1590         if (!hdev_is_powered(hdev)) {
1591                 err = set_connectable_update_settings(hdev, sk, cp->val);
1592                 goto failed;
1593         }
1594
1595         if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1596             pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1597                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1598                                       MGMT_STATUS_BUSY);
1599                 goto failed;
1600         }
1601
1602         cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1603         if (!cmd) {
1604                 err = -ENOMEM;
1605                 goto failed;
1606         }
1607
1608         if (cp->val) {
1609                 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1610         } else {
1611                 if (hdev->discov_timeout > 0)
1612                         cancel_delayed_work(&hdev->discov_off);
1613
1614                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1615                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1616                 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1617         }
1618
1619         queue_work(hdev->req_workqueue, &hdev->connectable_update);
1620         err = 0;
1621
1622 failed:
1623         hci_dev_unlock(hdev);
1624         return err;
1625 }
1626
1627 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1628                         u16 len)
1629 {
1630         struct mgmt_mode *cp = data;
1631         bool changed;
1632         int err;
1633
1634         bt_dev_dbg(hdev, "sock %p", sk);
1635
1636         if (cp->val != 0x00 && cp->val != 0x01)
1637                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1638                                        MGMT_STATUS_INVALID_PARAMS);
1639
1640         hci_dev_lock(hdev);
1641
1642         if (cp->val)
1643                 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1644         else
1645                 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1646
1647         err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1648         if (err < 0)
1649                 goto unlock;
1650
1651         if (changed) {
1652                 /* In limited privacy mode the change of bondable mode
1653                  * may affect the local advertising address.
1654                  */
1655                 if (hdev_is_powered(hdev) &&
1656                     hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1657                     hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1658                     hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1659                         queue_work(hdev->req_workqueue,
1660                                    &hdev->discoverable_update);
1661
1662                 err = new_settings(hdev, sk);
1663         }
1664
1665 unlock:
1666         hci_dev_unlock(hdev);
1667         return err;
1668 }
1669
1670 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1671                              u16 len)
1672 {
1673         struct mgmt_mode *cp = data;
1674         struct mgmt_pending_cmd *cmd;
1675         u8 val, status;
1676         int err;
1677
1678         bt_dev_dbg(hdev, "sock %p", sk);
1679
1680         status = mgmt_bredr_support(hdev);
1681         if (status)
1682                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1683                                        status);
1684
1685         if (cp->val != 0x00 && cp->val != 0x01)
1686                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1687                                        MGMT_STATUS_INVALID_PARAMS);
1688
1689         hci_dev_lock(hdev);
1690
1691         if (!hdev_is_powered(hdev)) {
1692                 bool changed = false;
1693
1694                 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1695                         hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1696                         changed = true;
1697                 }
1698
1699                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1700                 if (err < 0)
1701                         goto failed;
1702
1703                 if (changed)
1704                         err = new_settings(hdev, sk);
1705
1706                 goto failed;
1707         }
1708
1709         if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1710                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1711                                       MGMT_STATUS_BUSY);
1712                 goto failed;
1713         }
1714
1715         val = !!cp->val;
1716
1717         if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1718                 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1719                 goto failed;
1720         }
1721
1722         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1723         if (!cmd) {
1724                 err = -ENOMEM;
1725                 goto failed;
1726         }
1727
1728         err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1729         if (err < 0) {
1730                 mgmt_pending_remove(cmd);
1731                 goto failed;
1732         }
1733
1734 failed:
1735         hci_dev_unlock(hdev);
1736         return err;
1737 }
1738
1739 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1740 {
1741         struct mgmt_mode *cp = data;
1742         struct mgmt_pending_cmd *cmd;
1743         u8 status;
1744         int err;
1745
1746         bt_dev_dbg(hdev, "sock %p", sk);
1747
1748         status = mgmt_bredr_support(hdev);
1749         if (status)
1750                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1751
1752         if (!lmp_ssp_capable(hdev))
1753                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1754                                        MGMT_STATUS_NOT_SUPPORTED);
1755
1756         if (cp->val != 0x00 && cp->val != 0x01)
1757                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1758                                        MGMT_STATUS_INVALID_PARAMS);
1759
1760         hci_dev_lock(hdev);
1761
1762         if (!hdev_is_powered(hdev)) {
1763                 bool changed;
1764
1765                 if (cp->val) {
1766                         changed = !hci_dev_test_and_set_flag(hdev,
1767                                                              HCI_SSP_ENABLED);
1768                 } else {
1769                         changed = hci_dev_test_and_clear_flag(hdev,
1770                                                               HCI_SSP_ENABLED);
1771                         if (!changed)
1772                                 changed = hci_dev_test_and_clear_flag(hdev,
1773                                                                       HCI_HS_ENABLED);
1774                         else
1775                                 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1776                 }
1777
1778                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1779                 if (err < 0)
1780                         goto failed;
1781
1782                 if (changed)
1783                         err = new_settings(hdev, sk);
1784
1785                 goto failed;
1786         }
1787
1788         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1789                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1790                                       MGMT_STATUS_BUSY);
1791                 goto failed;
1792         }
1793
1794         if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1795                 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1796                 goto failed;
1797         }
1798
1799         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1800         if (!cmd) {
1801                 err = -ENOMEM;
1802                 goto failed;
1803         }
1804
1805         if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1806                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1807                              sizeof(cp->val), &cp->val);
1808
1809         err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1810         if (err < 0) {
1811                 mgmt_pending_remove(cmd);
1812                 goto failed;
1813         }
1814
1815 failed:
1816         hci_dev_unlock(hdev);
1817         return err;
1818 }
1819
1820 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1821 {
1822         struct mgmt_mode *cp = data;
1823         bool changed;
1824         u8 status;
1825         int err;
1826
1827         bt_dev_dbg(hdev, "sock %p", sk);
1828
1829         if (!IS_ENABLED(CONFIG_BT_HS))
1830                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1831                                        MGMT_STATUS_NOT_SUPPORTED);
1832
1833         status = mgmt_bredr_support(hdev);
1834         if (status)
1835                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1836
1837         if (!lmp_ssp_capable(hdev))
1838                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1839                                        MGMT_STATUS_NOT_SUPPORTED);
1840
1841         if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1842                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1843                                        MGMT_STATUS_REJECTED);
1844
1845         if (cp->val != 0x00 && cp->val != 0x01)
1846                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1847                                        MGMT_STATUS_INVALID_PARAMS);
1848
1849         hci_dev_lock(hdev);
1850
1851         if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1852                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1853                                       MGMT_STATUS_BUSY);
1854                 goto unlock;
1855         }
1856
1857         if (cp->val) {
1858                 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1859         } else {
1860                 if (hdev_is_powered(hdev)) {
1861                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1862                                               MGMT_STATUS_REJECTED);
1863                         goto unlock;
1864                 }
1865
1866                 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1867         }
1868
1869         err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1870         if (err < 0)
1871                 goto unlock;
1872
1873         if (changed)
1874                 err = new_settings(hdev, sk);
1875
1876 unlock:
1877         hci_dev_unlock(hdev);
1878         return err;
1879 }
1880
1881 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1882 {
1883         struct cmd_lookup match = { NULL, hdev };
1884
1885         hci_dev_lock(hdev);
1886
1887         if (status) {
1888                 u8 mgmt_err = mgmt_status(status);
1889
1890                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1891                                      &mgmt_err);
1892                 goto unlock;
1893         }
1894
1895         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1896
1897         new_settings(hdev, match.sk);
1898
1899         if (match.sk)
1900                 sock_put(match.sk);
1901
1902         /* Make sure the controller has a good default for
1903          * advertising data. Restrict the update to when LE
1904          * has actually been enabled. During power on, the
1905          * update in powered_update_hci will take care of it.
1906          */
1907         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1908                 struct hci_request req;
1909                 hci_req_init(&req, hdev);
1910                 if (ext_adv_capable(hdev)) {
1911                         int err;
1912
1913                         err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1914                         if (!err)
1915                                 __hci_req_update_scan_rsp_data(&req, 0x00);
1916                 } else {
1917                         __hci_req_update_adv_data(&req, 0x00);
1918                         __hci_req_update_scan_rsp_data(&req, 0x00);
1919                 }
1920                 hci_req_run(&req, NULL);
1921                 hci_update_background_scan(hdev);
1922         }
1923
1924 unlock:
1925         hci_dev_unlock(hdev);
1926 }
1927
1928 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1929 {
1930         struct mgmt_mode *cp = data;
1931         struct hci_cp_write_le_host_supported hci_cp;
1932         struct mgmt_pending_cmd *cmd;
1933         struct hci_request req;
1934         int err;
1935         u8 val, enabled;
1936
1937         bt_dev_dbg(hdev, "sock %p", sk);
1938
1939         if (!lmp_le_capable(hdev))
1940                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1941                                        MGMT_STATUS_NOT_SUPPORTED);
1942
1943         if (cp->val != 0x00 && cp->val != 0x01)
1944                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1945                                        MGMT_STATUS_INVALID_PARAMS);
1946
1947         /* Bluetooth single mode LE only controllers or dual-mode
1948          * controllers configured as LE only devices, do not allow
1949          * switching LE off. These have either LE enabled explicitly
1950          * or BR/EDR has been previously switched off.
1951          *
1952          * When trying to enable an already enabled LE, then gracefully
1953          * send a positive response. Trying to disable it however will
1954          * result into rejection.
1955          */
1956         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1957                 if (cp->val == 0x01)
1958                         return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1959
1960                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1961                                        MGMT_STATUS_REJECTED);
1962         }
1963
1964         hci_dev_lock(hdev);
1965
1966         val = !!cp->val;
1967         enabled = lmp_host_le_capable(hdev);
1968
1969         if (!val)
1970                 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1971
1972         if (!hdev_is_powered(hdev) || val == enabled) {
1973                 bool changed = false;
1974
1975                 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1976                         hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1977                         changed = true;
1978                 }
1979
1980                 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1981                         hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1982                         changed = true;
1983                 }
1984
1985                 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1986                 if (err < 0)
1987                         goto unlock;
1988
1989                 if (changed)
1990                         err = new_settings(hdev, sk);
1991
1992                 goto unlock;
1993         }
1994
1995         if (pending_find(MGMT_OP_SET_LE, hdev) ||
1996             pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1997                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1998                                       MGMT_STATUS_BUSY);
1999                 goto unlock;
2000         }
2001
2002         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2003         if (!cmd) {
2004                 err = -ENOMEM;
2005                 goto unlock;
2006         }
2007
2008         hci_req_init(&req, hdev);
2009
2010         memset(&hci_cp, 0, sizeof(hci_cp));
2011
2012         if (val) {
2013                 hci_cp.le = val;
2014                 hci_cp.simul = 0x00;
2015         } else {
2016                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2017                         __hci_req_disable_advertising(&req);
2018
2019                 if (ext_adv_capable(hdev))
2020                         __hci_req_clear_ext_adv_sets(&req);
2021         }
2022
2023         hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2024                     &hci_cp);
2025
2026         err = hci_req_run(&req, le_enable_complete);
2027         if (err < 0)
2028                 mgmt_pending_remove(cmd);
2029
2030 unlock:
2031         hci_dev_unlock(hdev);
2032         return err;
2033 }
2034
2035 /* This is a helper function to test for pending mgmt commands that can
2036  * cause CoD or EIR HCI commands. We can only allow one such pending
2037  * mgmt command at a time since otherwise we cannot easily track what
2038  * the current values are, will be, and based on that calculate if a new
2039  * HCI command needs to be sent and if yes with what value.
2040  */
2041 static bool pending_eir_or_class(struct hci_dev *hdev)
2042 {
2043         struct mgmt_pending_cmd *cmd;
2044
2045         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2046                 switch (cmd->opcode) {
2047                 case MGMT_OP_ADD_UUID:
2048                 case MGMT_OP_REMOVE_UUID:
2049                 case MGMT_OP_SET_DEV_CLASS:
2050                 case MGMT_OP_SET_POWERED:
2051                         return true;
2052                 }
2053         }
2054
2055         return false;
2056 }
2057
2058 static const u8 bluetooth_base_uuid[] = {
2059                         0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2060                         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2061 };
2062
2063 static u8 get_uuid_size(const u8 *uuid)
2064 {
2065         u32 val;
2066
2067         if (memcmp(uuid, bluetooth_base_uuid, 12))
2068                 return 128;
2069
2070         val = get_unaligned_le32(&uuid[12]);
2071         if (val > 0xffff)
2072                 return 32;
2073
2074         return 16;
2075 }
2076
2077 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2078 {
2079         struct mgmt_pending_cmd *cmd;
2080
2081         hci_dev_lock(hdev);
2082
2083         cmd = pending_find(mgmt_op, hdev);
2084         if (!cmd)
2085                 goto unlock;
2086
2087         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2088                           mgmt_status(status), hdev->dev_class, 3);
2089
2090         mgmt_pending_remove(cmd);
2091
2092 unlock:
2093         hci_dev_unlock(hdev);
2094 }
2095
2096 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2097 {
2098         bt_dev_dbg(hdev, "status 0x%02x", status);
2099
2100         mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2101 }
2102
2103 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2104 {
2105         struct mgmt_cp_add_uuid *cp = data;
2106         struct mgmt_pending_cmd *cmd;
2107         struct hci_request req;
2108         struct bt_uuid *uuid;
2109         int err;
2110
2111         bt_dev_dbg(hdev, "sock %p", sk);
2112
2113         hci_dev_lock(hdev);
2114
2115         if (pending_eir_or_class(hdev)) {
2116                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2117                                       MGMT_STATUS_BUSY);
2118                 goto failed;
2119         }
2120
2121         uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2122         if (!uuid) {
2123                 err = -ENOMEM;
2124                 goto failed;
2125         }
2126
2127         memcpy(uuid->uuid, cp->uuid, 16);
2128         uuid->svc_hint = cp->svc_hint;
2129         uuid->size = get_uuid_size(cp->uuid);
2130
2131         list_add_tail(&uuid->list, &hdev->uuids);
2132
2133         hci_req_init(&req, hdev);
2134
2135         __hci_req_update_class(&req);
2136         __hci_req_update_eir(&req);
2137
2138         err = hci_req_run(&req, add_uuid_complete);
2139         if (err < 0) {
2140                 if (err != -ENODATA)
2141                         goto failed;
2142
2143                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2144                                         hdev->dev_class, 3);
2145                 goto failed;
2146         }
2147
2148         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2149         if (!cmd) {
2150                 err = -ENOMEM;
2151                 goto failed;
2152         }
2153
2154         err = 0;
2155
2156 failed:
2157         hci_dev_unlock(hdev);
2158         return err;
2159 }
2160
2161 static bool enable_service_cache(struct hci_dev *hdev)
2162 {
2163         if (!hdev_is_powered(hdev))
2164                 return false;
2165
2166         if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2167                 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2168                                    CACHE_TIMEOUT);
2169                 return true;
2170         }
2171
2172         return false;
2173 }
2174
2175 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2176 {
2177         bt_dev_dbg(hdev, "status 0x%02x", status);
2178
2179         mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2180 }
2181
2182 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2183                        u16 len)
2184 {
2185         struct mgmt_cp_remove_uuid *cp = data;
2186         struct mgmt_pending_cmd *cmd;
2187         struct bt_uuid *match, *tmp;
2188         u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2189         struct hci_request req;
2190         int err, found;
2191
2192         bt_dev_dbg(hdev, "sock %p", sk);
2193
2194         hci_dev_lock(hdev);
2195
2196         if (pending_eir_or_class(hdev)) {
2197                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2198                                       MGMT_STATUS_BUSY);
2199                 goto unlock;
2200         }
2201
2202         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2203                 hci_uuids_clear(hdev);
2204
2205                 if (enable_service_cache(hdev)) {
2206                         err = mgmt_cmd_complete(sk, hdev->id,
2207                                                 MGMT_OP_REMOVE_UUID,
2208                                                 0, hdev->dev_class, 3);
2209                         goto unlock;
2210                 }
2211
2212                 goto update_class;
2213         }
2214
2215         found = 0;
2216
2217         list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2218                 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2219                         continue;
2220
2221                 list_del(&match->list);
2222                 kfree(match);
2223                 found++;
2224         }
2225
2226         if (found == 0) {
2227                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2228                                       MGMT_STATUS_INVALID_PARAMS);
2229                 goto unlock;
2230         }
2231
2232 update_class:
2233         hci_req_init(&req, hdev);
2234
2235         __hci_req_update_class(&req);
2236         __hci_req_update_eir(&req);
2237
2238         err = hci_req_run(&req, remove_uuid_complete);
2239         if (err < 0) {
2240                 if (err != -ENODATA)
2241                         goto unlock;
2242
2243                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2244                                         hdev->dev_class, 3);
2245                 goto unlock;
2246         }
2247
2248         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2249         if (!cmd) {
2250                 err = -ENOMEM;
2251                 goto unlock;
2252         }
2253
2254         err = 0;
2255
2256 unlock:
2257         hci_dev_unlock(hdev);
2258         return err;
2259 }
2260
2261 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2262 {
2263         bt_dev_dbg(hdev, "status 0x%02x", status);
2264
2265         mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2266 }
2267
2268 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2269                          u16 len)
2270 {
2271         struct mgmt_cp_set_dev_class *cp = data;
2272         struct mgmt_pending_cmd *cmd;
2273         struct hci_request req;
2274         int err;
2275
2276         bt_dev_dbg(hdev, "sock %p", sk);
2277
2278         if (!lmp_bredr_capable(hdev))
2279                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2280                                        MGMT_STATUS_NOT_SUPPORTED);
2281
2282         hci_dev_lock(hdev);
2283
2284         if (pending_eir_or_class(hdev)) {
2285                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2286                                       MGMT_STATUS_BUSY);
2287                 goto unlock;
2288         }
2289
2290         if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2291                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2292                                       MGMT_STATUS_INVALID_PARAMS);
2293                 goto unlock;
2294         }
2295
2296         hdev->major_class = cp->major;
2297         hdev->minor_class = cp->minor;
2298
2299         if (!hdev_is_powered(hdev)) {
2300                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2301                                         hdev->dev_class, 3);
2302                 goto unlock;
2303         }
2304
2305         hci_req_init(&req, hdev);
2306
2307         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2308                 hci_dev_unlock(hdev);
2309                 cancel_delayed_work_sync(&hdev->service_cache);
2310                 hci_dev_lock(hdev);
2311                 __hci_req_update_eir(&req);
2312         }
2313
2314         __hci_req_update_class(&req);
2315
2316         err = hci_req_run(&req, set_class_complete);
2317         if (err < 0) {
2318                 if (err != -ENODATA)
2319                         goto unlock;
2320
2321                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2322                                         hdev->dev_class, 3);
2323                 goto unlock;
2324         }
2325
2326         cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2327         if (!cmd) {
2328                 err = -ENOMEM;
2329                 goto unlock;
2330         }
2331
2332         err = 0;
2333
2334 unlock:
2335         hci_dev_unlock(hdev);
2336         return err;
2337 }
2338
2339 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2340                           u16 len)
2341 {
2342         struct mgmt_cp_load_link_keys *cp = data;
2343         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2344                                    sizeof(struct mgmt_link_key_info));
2345         u16 key_count, expected_len;
2346         bool changed;
2347         int i;
2348
2349         bt_dev_dbg(hdev, "sock %p", sk);
2350
2351         if (!lmp_bredr_capable(hdev))
2352                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2353                                        MGMT_STATUS_NOT_SUPPORTED);
2354
2355         key_count = __le16_to_cpu(cp->key_count);
2356         if (key_count > max_key_count) {
2357                 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2358                            key_count);
2359                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2360                                        MGMT_STATUS_INVALID_PARAMS);
2361         }
2362
2363         expected_len = struct_size(cp, keys, key_count);
2364         if (expected_len != len) {
2365                 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2366                            expected_len, len);
2367                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2368                                        MGMT_STATUS_INVALID_PARAMS);
2369         }
2370
2371         if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2372                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2373                                        MGMT_STATUS_INVALID_PARAMS);
2374
2375         bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2376                    key_count);
2377
2378         for (i = 0; i < key_count; i++) {
2379                 struct mgmt_link_key_info *key = &cp->keys[i];
2380
2381                 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2382                         return mgmt_cmd_status(sk, hdev->id,
2383                                                MGMT_OP_LOAD_LINK_KEYS,
2384                                                MGMT_STATUS_INVALID_PARAMS);
2385         }
2386
2387         hci_dev_lock(hdev);
2388
2389         hci_link_keys_clear(hdev);
2390
2391         if (cp->debug_keys)
2392                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2393         else
2394                 changed = hci_dev_test_and_clear_flag(hdev,
2395                                                       HCI_KEEP_DEBUG_KEYS);
2396
2397         if (changed)
2398                 new_settings(hdev, NULL);
2399
2400         for (i = 0; i < key_count; i++) {
2401                 struct mgmt_link_key_info *key = &cp->keys[i];
2402
2403                 if (hci_is_blocked_key(hdev,
2404                                        HCI_BLOCKED_KEY_TYPE_LINKKEY,
2405                                        key->val)) {
2406                         bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2407                                     &key->addr.bdaddr);
2408                         continue;
2409                 }
2410
2411                 /* Always ignore debug keys and require a new pairing if
2412                  * the user wants to use them.
2413                  */
2414                 if (key->type == HCI_LK_DEBUG_COMBINATION)
2415                         continue;
2416
2417                 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2418                                  key->type, key->pin_len, NULL);
2419         }
2420
2421         mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2422
2423         hci_dev_unlock(hdev);
2424
2425         return 0;
2426 }
2427
2428 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2429                            u8 addr_type, struct sock *skip_sk)
2430 {
2431         struct mgmt_ev_device_unpaired ev;
2432
2433         bacpy(&ev.addr.bdaddr, bdaddr);
2434         ev.addr.type = addr_type;
2435
2436         return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2437                           skip_sk);
2438 }
2439
2440 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2441                          u16 len)
2442 {
2443         struct mgmt_cp_unpair_device *cp = data;
2444         struct mgmt_rp_unpair_device rp;
2445         struct hci_conn_params *params;
2446         struct mgmt_pending_cmd *cmd;
2447         struct hci_conn *conn;
2448         u8 addr_type;
2449         int err;
2450
2451         memset(&rp, 0, sizeof(rp));
2452         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2453         rp.addr.type = cp->addr.type;
2454
2455         if (!bdaddr_type_is_valid(cp->addr.type))
2456                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2457                                          MGMT_STATUS_INVALID_PARAMS,
2458                                          &rp, sizeof(rp));
2459
2460         if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2461                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2462                                          MGMT_STATUS_INVALID_PARAMS,
2463                                          &rp, sizeof(rp));
2464
2465         hci_dev_lock(hdev);
2466
2467         if (!hdev_is_powered(hdev)) {
2468                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2469                                         MGMT_STATUS_NOT_POWERED, &rp,
2470                                         sizeof(rp));
2471                 goto unlock;
2472         }
2473
2474         if (cp->addr.type == BDADDR_BREDR) {
2475                 /* If disconnection is requested, then look up the
2476                  * connection. If the remote device is connected, it
2477                  * will be later used to terminate the link.
2478                  *
2479                  * Setting it to NULL explicitly will cause no
2480                  * termination of the link.
2481                  */
2482                 if (cp->disconnect)
2483                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2484                                                        &cp->addr.bdaddr);
2485                 else
2486                         conn = NULL;
2487
2488                 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2489                 if (err < 0) {
2490                         err = mgmt_cmd_complete(sk, hdev->id,
2491                                                 MGMT_OP_UNPAIR_DEVICE,
2492                                                 MGMT_STATUS_NOT_PAIRED, &rp,
2493                                                 sizeof(rp));
2494                         goto unlock;
2495                 }
2496
2497                 goto done;
2498         }
2499
2500         /* LE address type */
2501         addr_type = le_addr_type(cp->addr.type);
2502
2503         /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2504         err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2505         if (err < 0) {
2506                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2507                                         MGMT_STATUS_NOT_PAIRED, &rp,
2508                                         sizeof(rp));
2509                 goto unlock;
2510         }
2511
2512         conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2513         if (!conn) {
2514                 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2515                 goto done;
2516         }
2517
2518
2519         /* Defer clearing up the connection parameters until closing to
2520          * give a chance of keeping them if a repairing happens.
2521          */
2522         set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2523
2524         /* Disable auto-connection parameters if present */
2525         params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2526         if (params) {
2527                 if (params->explicit_connect)
2528                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2529                 else
2530                         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2531         }
2532
2533         /* If disconnection is not requested, then clear the connection
2534          * variable so that the link is not terminated.
2535          */
2536         if (!cp->disconnect)
2537                 conn = NULL;
2538
2539 done:
2540         /* If the connection variable is set, then termination of the
2541          * link is requested.
2542          */
2543         if (!conn) {
2544                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2545                                         &rp, sizeof(rp));
2546                 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2547                 goto unlock;
2548         }
2549
2550         cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2551                                sizeof(*cp));
2552         if (!cmd) {
2553                 err = -ENOMEM;
2554                 goto unlock;
2555         }
2556
2557         cmd->cmd_complete = addr_cmd_complete;
2558
2559         err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2560         if (err < 0)
2561                 mgmt_pending_remove(cmd);
2562
2563 unlock:
2564         hci_dev_unlock(hdev);
2565         return err;
2566 }
2567
2568 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2569                       u16 len)
2570 {
2571         struct mgmt_cp_disconnect *cp = data;
2572         struct mgmt_rp_disconnect rp;
2573         struct mgmt_pending_cmd *cmd;
2574         struct hci_conn *conn;
2575         int err;
2576
2577         bt_dev_dbg(hdev, "sock %p", sk);
2578
2579         memset(&rp, 0, sizeof(rp));
2580         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2581         rp.addr.type = cp->addr.type;
2582
2583         if (!bdaddr_type_is_valid(cp->addr.type))
2584                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2585                                          MGMT_STATUS_INVALID_PARAMS,
2586                                          &rp, sizeof(rp));
2587
2588         hci_dev_lock(hdev);
2589
2590         if (!test_bit(HCI_UP, &hdev->flags)) {
2591                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2592                                         MGMT_STATUS_NOT_POWERED, &rp,
2593                                         sizeof(rp));
2594                 goto failed;
2595         }
2596
2597         if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2598                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2599                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2600                 goto failed;
2601         }
2602
2603         if (cp->addr.type == BDADDR_BREDR)
2604                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2605                                                &cp->addr.bdaddr);
2606         else
2607                 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2608                                                le_addr_type(cp->addr.type));
2609
2610         if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2611                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2612                                         MGMT_STATUS_NOT_CONNECTED, &rp,
2613                                         sizeof(rp));
2614                 goto failed;
2615         }
2616
2617         cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2618         if (!cmd) {
2619                 err = -ENOMEM;
2620                 goto failed;
2621         }
2622
2623         cmd->cmd_complete = generic_cmd_complete;
2624
2625         err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2626         if (err < 0)
2627                 mgmt_pending_remove(cmd);
2628
2629 failed:
2630         hci_dev_unlock(hdev);
2631         return err;
2632 }
2633
2634 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2635 {
2636         switch (link_type) {
2637         case LE_LINK:
2638                 switch (addr_type) {
2639                 case ADDR_LE_DEV_PUBLIC:
2640                         return BDADDR_LE_PUBLIC;
2641
2642                 default:
2643                         /* Fallback to LE Random address type */
2644                         return BDADDR_LE_RANDOM;
2645                 }
2646
2647         default:
2648                 /* Fallback to BR/EDR type */
2649                 return BDADDR_BREDR;
2650         }
2651 }
2652
2653 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2654                            u16 data_len)
2655 {
2656         struct mgmt_rp_get_connections *rp;
2657         struct hci_conn *c;
2658         int err;
2659         u16 i;
2660
2661         bt_dev_dbg(hdev, "sock %p", sk);
2662
2663         hci_dev_lock(hdev);
2664
2665         if (!hdev_is_powered(hdev)) {
2666                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2667                                       MGMT_STATUS_NOT_POWERED);
2668                 goto unlock;
2669         }
2670
2671         i = 0;
2672         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2673                 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2674                         i++;
2675         }
2676
2677         rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2678         if (!rp) {
2679                 err = -ENOMEM;
2680                 goto unlock;
2681         }
2682
2683         i = 0;
2684         list_for_each_entry(c, &hdev->conn_hash.list, list) {
2685                 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2686                         continue;
2687                 bacpy(&rp->addr[i].bdaddr, &c->dst);
2688                 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2689                 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2690                         continue;
2691                 i++;
2692         }
2693
2694         rp->conn_count = cpu_to_le16(i);
2695
2696         /* Recalculate length in case of filtered SCO connections, etc */
2697         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2698                                 struct_size(rp, addr, i));
2699
2700         kfree(rp);
2701
2702 unlock:
2703         hci_dev_unlock(hdev);
2704         return err;
2705 }
2706
2707 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2708                                    struct mgmt_cp_pin_code_neg_reply *cp)
2709 {
2710         struct mgmt_pending_cmd *cmd;
2711         int err;
2712
2713         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2714                                sizeof(*cp));
2715         if (!cmd)
2716                 return -ENOMEM;
2717
2718         cmd->cmd_complete = addr_cmd_complete;
2719
2720         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2721                            sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2722         if (err < 0)
2723                 mgmt_pending_remove(cmd);
2724
2725         return err;
2726 }
2727
2728 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2729                           u16 len)
2730 {
2731         struct hci_conn *conn;
2732         struct mgmt_cp_pin_code_reply *cp = data;
2733         struct hci_cp_pin_code_reply reply;
2734         struct mgmt_pending_cmd *cmd;
2735         int err;
2736
2737         bt_dev_dbg(hdev, "sock %p", sk);
2738
2739         hci_dev_lock(hdev);
2740
2741         if (!hdev_is_powered(hdev)) {
2742                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2743                                       MGMT_STATUS_NOT_POWERED);
2744                 goto failed;
2745         }
2746
2747         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2748         if (!conn) {
2749                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2750                                       MGMT_STATUS_NOT_CONNECTED);
2751                 goto failed;
2752         }
2753
2754         if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2755                 struct mgmt_cp_pin_code_neg_reply ncp;
2756
2757                 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2758
2759                 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2760
2761                 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2762                 if (err >= 0)
2763                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2764                                               MGMT_STATUS_INVALID_PARAMS);
2765
2766                 goto failed;
2767         }
2768
2769         cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2770         if (!cmd) {
2771                 err = -ENOMEM;
2772                 goto failed;
2773         }
2774
2775         cmd->cmd_complete = addr_cmd_complete;
2776
2777         bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2778         reply.pin_len = cp->pin_len;
2779         memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2780
2781         err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2782         if (err < 0)
2783                 mgmt_pending_remove(cmd);
2784
2785 failed:
2786         hci_dev_unlock(hdev);
2787         return err;
2788 }
2789
2790 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2791                              u16 len)
2792 {
2793         struct mgmt_cp_set_io_capability *cp = data;
2794
2795         bt_dev_dbg(hdev, "sock %p", sk);
2796
2797         if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2798                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2799                                        MGMT_STATUS_INVALID_PARAMS);
2800
2801         hci_dev_lock(hdev);
2802
2803         hdev->io_capability = cp->io_capability;
2804
2805         bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2806
2807         hci_dev_unlock(hdev);
2808
2809         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2810                                  NULL, 0);
2811 }
2812
2813 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2814 {
2815         struct hci_dev *hdev = conn->hdev;
2816         struct mgmt_pending_cmd *cmd;
2817
2818         list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2819                 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2820                         continue;
2821
2822                 if (cmd->user_data != conn)
2823                         continue;
2824
2825                 return cmd;
2826         }
2827
2828         return NULL;
2829 }
2830
2831 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2832 {
2833         struct mgmt_rp_pair_device rp;
2834         struct hci_conn *conn = cmd->user_data;
2835         int err;
2836
2837         bacpy(&rp.addr.bdaddr, &conn->dst);
2838         rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2839
2840         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2841                                 status, &rp, sizeof(rp));
2842
2843         /* So we don't get further callbacks for this connection */
2844         conn->connect_cfm_cb = NULL;
2845         conn->security_cfm_cb = NULL;
2846         conn->disconn_cfm_cb = NULL;
2847
2848         hci_conn_drop(conn);
2849
2850         /* The device is paired so there is no need to remove
2851          * its connection parameters anymore.
2852          */
2853         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2854
2855         hci_conn_put(conn);
2856
2857         return err;
2858 }
2859
2860 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2861 {
2862         u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2863         struct mgmt_pending_cmd *cmd;
2864
2865         cmd = find_pairing(conn);
2866         if (cmd) {
2867                 cmd->cmd_complete(cmd, status);
2868                 mgmt_pending_remove(cmd);
2869         }
2870 }
2871
2872 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2873 {
2874         struct mgmt_pending_cmd *cmd;
2875
2876         BT_DBG("status %u", status);
2877
2878         cmd = find_pairing(conn);
2879         if (!cmd) {
2880                 BT_DBG("Unable to find a pending command");
2881                 return;
2882         }
2883
2884         cmd->cmd_complete(cmd, mgmt_status(status));
2885         mgmt_pending_remove(cmd);
2886 }
2887
2888 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2889 {
2890         struct mgmt_pending_cmd *cmd;
2891
2892         BT_DBG("status %u", status);
2893
2894         if (!status)
2895                 return;
2896
2897         cmd = find_pairing(conn);
2898         if (!cmd) {
2899                 BT_DBG("Unable to find a pending command");
2900                 return;
2901         }
2902
2903         cmd->cmd_complete(cmd, mgmt_status(status));
2904         mgmt_pending_remove(cmd);
2905 }
2906
2907 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2908                        u16 len)
2909 {
2910         struct mgmt_cp_pair_device *cp = data;
2911         struct mgmt_rp_pair_device rp;
2912         struct mgmt_pending_cmd *cmd;
2913         u8 sec_level, auth_type;
2914         struct hci_conn *conn;
2915         int err;
2916
2917         bt_dev_dbg(hdev, "sock %p", sk);
2918
2919         memset(&rp, 0, sizeof(rp));
2920         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2921         rp.addr.type = cp->addr.type;
2922
2923         if (!bdaddr_type_is_valid(cp->addr.type))
2924                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2925                                          MGMT_STATUS_INVALID_PARAMS,
2926                                          &rp, sizeof(rp));
2927
2928         if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2929                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2930                                          MGMT_STATUS_INVALID_PARAMS,
2931                                          &rp, sizeof(rp));
2932
2933         hci_dev_lock(hdev);
2934
2935         if (!hdev_is_powered(hdev)) {
2936                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2937                                         MGMT_STATUS_NOT_POWERED, &rp,
2938                                         sizeof(rp));
2939                 goto unlock;
2940         }
2941
2942         if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2943                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2944                                         MGMT_STATUS_ALREADY_PAIRED, &rp,
2945                                         sizeof(rp));
2946                 goto unlock;
2947         }
2948
2949         sec_level = BT_SECURITY_MEDIUM;
2950         auth_type = HCI_AT_DEDICATED_BONDING;
2951
2952         if (cp->addr.type == BDADDR_BREDR) {
2953                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2954                                        auth_type, CONN_REASON_PAIR_DEVICE);
2955         } else {
2956                 u8 addr_type = le_addr_type(cp->addr.type);
2957                 struct hci_conn_params *p;
2958
2959                 /* When pairing a new device, it is expected to remember
2960                  * this device for future connections. Adding the connection
2961                  * parameter information ahead of time allows tracking
2962                  * of the peripheral preferred values and will speed up any
2963                  * further connection establishment.
2964                  *
2965                  * If connection parameters already exist, then they
2966                  * will be kept and this function does nothing.
2967                  */
2968                 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2969
2970                 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2971                         p->auto_connect = HCI_AUTO_CONN_DISABLED;
2972
2973                 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2974                                            sec_level, HCI_LE_CONN_TIMEOUT,
2975                                            CONN_REASON_PAIR_DEVICE);
2976         }
2977
2978         if (IS_ERR(conn)) {
2979                 int status;
2980
2981                 if (PTR_ERR(conn) == -EBUSY)
2982                         status = MGMT_STATUS_BUSY;
2983                 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2984                         status = MGMT_STATUS_NOT_SUPPORTED;
2985                 else if (PTR_ERR(conn) == -ECONNREFUSED)
2986                         status = MGMT_STATUS_REJECTED;
2987                 else
2988                         status = MGMT_STATUS_CONNECT_FAILED;
2989
2990                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2991                                         status, &rp, sizeof(rp));
2992                 goto unlock;
2993         }
2994
2995         if (conn->connect_cfm_cb) {
2996                 hci_conn_drop(conn);
2997                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2998                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
2999                 goto unlock;
3000         }
3001
3002         cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3003         if (!cmd) {
3004                 err = -ENOMEM;
3005                 hci_conn_drop(conn);
3006                 goto unlock;
3007         }
3008
3009         cmd->cmd_complete = pairing_complete;
3010
3011         /* For LE, just connecting isn't a proof that the pairing finished */
3012         if (cp->addr.type == BDADDR_BREDR) {
3013                 conn->connect_cfm_cb = pairing_complete_cb;
3014                 conn->security_cfm_cb = pairing_complete_cb;
3015                 conn->disconn_cfm_cb = pairing_complete_cb;
3016         } else {
3017                 conn->connect_cfm_cb = le_pairing_complete_cb;
3018                 conn->security_cfm_cb = le_pairing_complete_cb;
3019                 conn->disconn_cfm_cb = le_pairing_complete_cb;
3020         }
3021
3022         conn->io_capability = cp->io_cap;
3023         cmd->user_data = hci_conn_get(conn);
3024
3025         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3026             hci_conn_security(conn, sec_level, auth_type, true)) {
3027                 cmd->cmd_complete(cmd, 0);
3028                 mgmt_pending_remove(cmd);
3029         }
3030
3031         err = 0;
3032
3033 unlock:
3034         hci_dev_unlock(hdev);
3035         return err;
3036 }
3037
3038 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3039                               u16 len)
3040 {
3041         struct mgmt_addr_info *addr = data;
3042         struct mgmt_pending_cmd *cmd;
3043         struct hci_conn *conn;
3044         int err;
3045
3046         bt_dev_dbg(hdev, "sock %p", sk);
3047
3048         hci_dev_lock(hdev);
3049
3050         if (!hdev_is_powered(hdev)) {
3051                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3052                                       MGMT_STATUS_NOT_POWERED);
3053                 goto unlock;
3054         }
3055
3056         cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3057         if (!cmd) {
3058                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3059                                       MGMT_STATUS_INVALID_PARAMS);
3060                 goto unlock;
3061         }
3062
3063         conn = cmd->user_data;
3064
3065         if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3066                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3067                                       MGMT_STATUS_INVALID_PARAMS);
3068                 goto unlock;
3069         }
3070
3071         cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3072         mgmt_pending_remove(cmd);
3073
3074         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3075                                 addr, sizeof(*addr));
3076
3077         /* Since user doesn't want to proceed with the connection, abort any
3078          * ongoing pairing and then terminate the link if it was created
3079          * because of the pair device action.
3080          */
3081         if (addr->type == BDADDR_BREDR)
3082                 hci_remove_link_key(hdev, &addr->bdaddr);
3083         else
3084                 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3085                                               le_addr_type(addr->type));
3086
3087         if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3088                 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3089
3090 unlock:
3091         hci_dev_unlock(hdev);
3092         return err;
3093 }
3094
3095 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3096                              struct mgmt_addr_info *addr, u16 mgmt_op,
3097                              u16 hci_op, __le32 passkey)
3098 {
3099         struct mgmt_pending_cmd *cmd;
3100         struct hci_conn *conn;
3101         int err;
3102
3103         hci_dev_lock(hdev);
3104
3105         if (!hdev_is_powered(hdev)) {
3106                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3107                                         MGMT_STATUS_NOT_POWERED, addr,
3108                                         sizeof(*addr));
3109                 goto done;
3110         }
3111
3112         if (addr->type == BDADDR_BREDR)
3113                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3114         else
3115                 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3116                                                le_addr_type(addr->type));
3117
3118         if (!conn) {
3119                 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3120                                         MGMT_STATUS_NOT_CONNECTED, addr,
3121                                         sizeof(*addr));
3122                 goto done;
3123         }
3124
3125         if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3126                 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3127                 if (!err)
3128                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3129                                                 MGMT_STATUS_SUCCESS, addr,
3130                                                 sizeof(*addr));
3131                 else
3132                         err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3133                                                 MGMT_STATUS_FAILED, addr,
3134                                                 sizeof(*addr));
3135
3136                 goto done;
3137         }
3138
3139         cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3140         if (!cmd) {
3141                 err = -ENOMEM;
3142                 goto done;
3143         }
3144
3145         cmd->cmd_complete = addr_cmd_complete;
3146
3147         /* Continue with pairing via HCI */
3148         if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3149                 struct hci_cp_user_passkey_reply cp;
3150
3151                 bacpy(&cp.bdaddr, &addr->bdaddr);
3152                 cp.passkey = passkey;
3153                 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3154         } else
3155                 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3156                                    &addr->bdaddr);
3157
3158         if (err < 0)
3159                 mgmt_pending_remove(cmd);
3160
3161 done:
3162         hci_dev_unlock(hdev);
3163         return err;
3164 }
3165
3166 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3167                               void *data, u16 len)
3168 {
3169         struct mgmt_cp_pin_code_neg_reply *cp = data;
3170
3171         bt_dev_dbg(hdev, "sock %p", sk);
3172
3173         return user_pairing_resp(sk, hdev, &cp->addr,
3174                                 MGMT_OP_PIN_CODE_NEG_REPLY,
3175                                 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3176 }
3177
3178 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3179                               u16 len)
3180 {
3181         struct mgmt_cp_user_confirm_reply *cp = data;
3182
3183         bt_dev_dbg(hdev, "sock %p", sk);
3184
3185         if (len != sizeof(*cp))
3186                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3187                                        MGMT_STATUS_INVALID_PARAMS);
3188
3189         return user_pairing_resp(sk, hdev, &cp->addr,
3190                                  MGMT_OP_USER_CONFIRM_REPLY,
3191                                  HCI_OP_USER_CONFIRM_REPLY, 0);
3192 }
3193
3194 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3195                                   void *data, u16 len)
3196 {
3197         struct mgmt_cp_user_confirm_neg_reply *cp = data;
3198
3199         bt_dev_dbg(hdev, "sock %p", sk);
3200
3201         return user_pairing_resp(sk, hdev, &cp->addr,
3202                                  MGMT_OP_USER_CONFIRM_NEG_REPLY,
3203                                  HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3204 }
3205
3206 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3207                               u16 len)
3208 {
3209         struct mgmt_cp_user_passkey_reply *cp = data;
3210
3211         bt_dev_dbg(hdev, "sock %p", sk);
3212
3213         return user_pairing_resp(sk, hdev, &cp->addr,
3214                                  MGMT_OP_USER_PASSKEY_REPLY,
3215                                  HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3216 }
3217
3218 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3219                                   void *data, u16 len)
3220 {
3221         struct mgmt_cp_user_passkey_neg_reply *cp = data;
3222
3223         bt_dev_dbg(hdev, "sock %p", sk);
3224
3225         return user_pairing_resp(sk, hdev, &cp->addr,
3226                                  MGMT_OP_USER_PASSKEY_NEG_REPLY,
3227                                  HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3228 }
3229
3230 static void adv_expire(struct hci_dev *hdev, u32 flags)
3231 {
3232         struct adv_info *adv_instance;
3233         struct hci_request req;
3234         int err;
3235
3236         adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3237         if (!adv_instance)
3238                 return;
3239
3240         /* stop if current instance doesn't need to be changed */
3241         if (!(adv_instance->flags & flags))
3242                 return;
3243
3244         cancel_adv_timeout(hdev);
3245
3246         adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3247         if (!adv_instance)
3248                 return;
3249
3250         hci_req_init(&req, hdev);
3251         err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3252                                               true);
3253         if (err)
3254                 return;
3255
3256         hci_req_run(&req, NULL);
3257 }
3258
3259 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3260 {
3261         struct mgmt_cp_set_local_name *cp;
3262         struct mgmt_pending_cmd *cmd;
3263
3264         bt_dev_dbg(hdev, "status 0x%02x", status);
3265
3266         hci_dev_lock(hdev);
3267
3268         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3269         if (!cmd)
3270                 goto unlock;
3271
3272         cp = cmd->param;
3273
3274         if (status) {
3275                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3276                                 mgmt_status(status));
3277         } else {
3278                 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3279                                   cp, sizeof(*cp));
3280
3281                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3282                         adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3283         }
3284
3285         mgmt_pending_remove(cmd);
3286
3287 unlock:
3288         hci_dev_unlock(hdev);
3289 }
3290
3291 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3292                           u16 len)
3293 {
3294         struct mgmt_cp_set_local_name *cp = data;
3295         struct mgmt_pending_cmd *cmd;
3296         struct hci_request req;
3297         int err;
3298
3299         bt_dev_dbg(hdev, "sock %p", sk);
3300
3301         hci_dev_lock(hdev);
3302
3303         /* If the old values are the same as the new ones just return a
3304          * direct command complete event.
3305          */
3306         if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3307             !memcmp(hdev->short_name, cp->short_name,
3308                     sizeof(hdev->short_name))) {
3309                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3310                                         data, len);
3311                 goto failed;
3312         }
3313
3314         memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3315
3316         if (!hdev_is_powered(hdev)) {
3317                 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3318
3319                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3320                                         data, len);
3321                 if (err < 0)
3322                         goto failed;
3323
3324                 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3325                                          len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3326                 ext_info_changed(hdev, sk);
3327
3328                 goto failed;
3329         }
3330
3331         cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3332         if (!cmd) {
3333                 err = -ENOMEM;
3334                 goto failed;
3335         }
3336
3337         memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3338
3339         hci_req_init(&req, hdev);
3340
3341         if (lmp_bredr_capable(hdev)) {
3342                 __hci_req_update_name(&req);
3343                 __hci_req_update_eir(&req);
3344         }
3345
3346         /* The name is stored in the scan response data and so
3347          * no need to update the advertising data here.
3348          */
3349         if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3350                 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3351
3352         err = hci_req_run(&req, set_name_complete);
3353         if (err < 0)
3354                 mgmt_pending_remove(cmd);
3355
3356 failed:
3357         hci_dev_unlock(hdev);
3358         return err;
3359 }
3360
3361 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3362                           u16 len)
3363 {
3364         struct mgmt_cp_set_appearance *cp = data;
3365         u16 appearance;
3366         int err;
3367
3368         bt_dev_dbg(hdev, "sock %p", sk);
3369
3370         if (!lmp_le_capable(hdev))
3371                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3372                                        MGMT_STATUS_NOT_SUPPORTED);
3373
3374         appearance = le16_to_cpu(cp->appearance);
3375
3376         hci_dev_lock(hdev);
3377
3378         if (hdev->appearance != appearance) {
3379                 hdev->appearance = appearance;
3380
3381                 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3382                         adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3383
3384                 ext_info_changed(hdev, sk);
3385         }
3386
3387         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3388                                 0);
3389
3390         hci_dev_unlock(hdev);
3391
3392         return err;
3393 }
3394
3395 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3396                                  void *data, u16 len)
3397 {
3398         struct mgmt_rp_get_phy_configuration rp;
3399
3400         bt_dev_dbg(hdev, "sock %p", sk);
3401
3402         hci_dev_lock(hdev);
3403
3404         memset(&rp, 0, sizeof(rp));
3405
3406         rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3407         rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3408         rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3409
3410         hci_dev_unlock(hdev);
3411
3412         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3413                                  &rp, sizeof(rp));
3414 }
3415
3416 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3417 {
3418         struct mgmt_ev_phy_configuration_changed ev;
3419
3420         memset(&ev, 0, sizeof(ev));
3421
3422         ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3423
3424         return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3425                           sizeof(ev), skip);
3426 }
3427
3428 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3429                                      u16 opcode, struct sk_buff *skb)
3430 {
3431         struct mgmt_pending_cmd *cmd;
3432
3433         bt_dev_dbg(hdev, "status 0x%02x", status);
3434
3435         hci_dev_lock(hdev);
3436
3437         cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3438         if (!cmd)
3439                 goto unlock;
3440
3441         if (status) {
3442                 mgmt_cmd_status(cmd->sk, hdev->id,
3443                                 MGMT_OP_SET_PHY_CONFIGURATION,
3444                                 mgmt_status(status));
3445         } else {
3446                 mgmt_cmd_complete(cmd->sk, hdev->id,
3447                                   MGMT_OP_SET_PHY_CONFIGURATION, 0,
3448                                   NULL, 0);
3449
3450                 mgmt_phy_configuration_changed(hdev, cmd->sk);
3451         }
3452
3453         mgmt_pending_remove(cmd);
3454
3455 unlock:
3456         hci_dev_unlock(hdev);
3457 }
3458
3459 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3460                                  void *data, u16 len)
3461 {
3462         struct mgmt_cp_set_phy_configuration *cp = data;
3463         struct hci_cp_le_set_default_phy cp_phy;
3464         struct mgmt_pending_cmd *cmd;
3465         struct hci_request req;
3466         u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3467         u16 pkt_type = (HCI_DH1 | HCI_DM1);
3468         bool changed = false;
3469         int err;
3470
3471         bt_dev_dbg(hdev, "sock %p", sk);
3472
3473         configurable_phys = get_configurable_phys(hdev);
3474         supported_phys = get_supported_phys(hdev);
3475         selected_phys = __le32_to_cpu(cp->selected_phys);
3476
3477         if (selected_phys & ~supported_phys)
3478                 return mgmt_cmd_status(sk, hdev->id,
3479                                        MGMT_OP_SET_PHY_CONFIGURATION,
3480                                        MGMT_STATUS_INVALID_PARAMS);
3481
3482         unconfigure_phys = supported_phys & ~configurable_phys;
3483
3484         if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3485                 return mgmt_cmd_status(sk, hdev->id,
3486                                        MGMT_OP_SET_PHY_CONFIGURATION,
3487                                        MGMT_STATUS_INVALID_PARAMS);
3488
3489         if (selected_phys == get_selected_phys(hdev))
3490                 return mgmt_cmd_complete(sk, hdev->id,
3491                                          MGMT_OP_SET_PHY_CONFIGURATION,
3492                                          0, NULL, 0);
3493
3494         hci_dev_lock(hdev);
3495
3496         if (!hdev_is_powered(hdev)) {
3497                 err = mgmt_cmd_status(sk, hdev->id,
3498                                       MGMT_OP_SET_PHY_CONFIGURATION,
3499                                       MGMT_STATUS_REJECTED);
3500                 goto unlock;
3501         }
3502
3503         if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3504                 err = mgmt_cmd_status(sk, hdev->id,
3505                                       MGMT_OP_SET_PHY_CONFIGURATION,
3506                                       MGMT_STATUS_BUSY);
3507                 goto unlock;
3508         }
3509
3510         if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3511                 pkt_type |= (HCI_DH3 | HCI_DM3);
3512         else
3513                 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3514
3515         if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3516                 pkt_type |= (HCI_DH5 | HCI_DM5);
3517         else
3518                 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3519
3520         if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3521                 pkt_type &= ~HCI_2DH1;
3522         else
3523                 pkt_type |= HCI_2DH1;
3524
3525         if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3526                 pkt_type &= ~HCI_2DH3;
3527         else
3528                 pkt_type |= HCI_2DH3;
3529
3530         if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3531                 pkt_type &= ~HCI_2DH5;
3532         else
3533                 pkt_type |= HCI_2DH5;
3534
3535         if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3536                 pkt_type &= ~HCI_3DH1;
3537         else
3538                 pkt_type |= HCI_3DH1;
3539
3540         if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3541                 pkt_type &= ~HCI_3DH3;
3542         else
3543                 pkt_type |= HCI_3DH3;
3544
3545         if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3546                 pkt_type &= ~HCI_3DH5;
3547         else
3548                 pkt_type |= HCI_3DH5;
3549
3550         if (pkt_type != hdev->pkt_type) {
3551                 hdev->pkt_type = pkt_type;
3552                 changed = true;
3553         }
3554
3555         if ((selected_phys & MGMT_PHY_LE_MASK) ==
3556             (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3557                 if (changed)
3558                         mgmt_phy_configuration_changed(hdev, sk);
3559
3560                 err = mgmt_cmd_complete(sk, hdev->id,
3561                                         MGMT_OP_SET_PHY_CONFIGURATION,
3562                                         0, NULL, 0);
3563
3564                 goto unlock;
3565         }
3566
3567         cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3568                                len);
3569         if (!cmd) {
3570                 err = -ENOMEM;
3571                 goto unlock;
3572         }
3573
3574         hci_req_init(&req, hdev);
3575
3576         memset(&cp_phy, 0, sizeof(cp_phy));
3577
3578         if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3579                 cp_phy.all_phys |= 0x01;
3580
3581         if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3582                 cp_phy.all_phys |= 0x02;
3583
3584         if (selected_phys & MGMT_PHY_LE_1M_TX)
3585                 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3586
3587         if (selected_phys & MGMT_PHY_LE_2M_TX)
3588                 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3589
3590         if (selected_phys & MGMT_PHY_LE_CODED_TX)
3591                 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3592
3593         if (selected_phys & MGMT_PHY_LE_1M_RX)
3594                 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3595
3596         if (selected_phys & MGMT_PHY_LE_2M_RX)
3597                 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3598
3599         if (selected_phys & MGMT_PHY_LE_CODED_RX)
3600                 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3601
3602         hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3603
3604         err = hci_req_run_skb(&req, set_default_phy_complete);
3605         if (err < 0)
3606                 mgmt_pending_remove(cmd);
3607
3608 unlock:
3609         hci_dev_unlock(hdev);
3610
3611         return err;
3612 }
3613
3614 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3615                             u16 len)
3616 {
3617         int err = MGMT_STATUS_SUCCESS;
3618         struct mgmt_cp_set_blocked_keys *keys = data;
3619         const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3620                                    sizeof(struct mgmt_blocked_key_info));
3621         u16 key_count, expected_len;
3622         int i;
3623
3624         bt_dev_dbg(hdev, "sock %p", sk);
3625
3626         key_count = __le16_to_cpu(keys->key_count);
3627         if (key_count > max_key_count) {
3628                 bt_dev_err(hdev, "too big key_count value %u", key_count);
3629                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3630                                        MGMT_STATUS_INVALID_PARAMS);
3631         }
3632
3633         expected_len = struct_size(keys, keys, key_count);
3634         if (expected_len != len) {
3635                 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3636                            expected_len, len);
3637                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3638                                        MGMT_STATUS_INVALID_PARAMS);
3639         }
3640
3641         hci_dev_lock(hdev);
3642
3643         hci_blocked_keys_clear(hdev);
3644
3645         for (i = 0; i < keys->key_count; ++i) {
3646                 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3647
3648                 if (!b) {
3649                         err = MGMT_STATUS_NO_RESOURCES;
3650                         break;
3651                 }
3652
3653                 b->type = keys->keys[i].type;
3654                 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3655                 list_add_rcu(&b->list, &hdev->blocked_keys);
3656         }
3657         hci_dev_unlock(hdev);
3658
3659         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3660                                 err, NULL, 0);
3661 }
3662
3663 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3664                                void *data, u16 len)
3665 {
3666         struct mgmt_mode *cp = data;
3667         int err;
3668         bool changed = false;
3669
3670         bt_dev_dbg(hdev, "sock %p", sk);
3671
3672         if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3673                 return mgmt_cmd_status(sk, hdev->id,
3674                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3675                                        MGMT_STATUS_NOT_SUPPORTED);
3676
3677         if (cp->val != 0x00 && cp->val != 0x01)
3678                 return mgmt_cmd_status(sk, hdev->id,
3679                                        MGMT_OP_SET_WIDEBAND_SPEECH,
3680                                        MGMT_STATUS_INVALID_PARAMS);
3681
3682         hci_dev_lock(hdev);
3683
3684         if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3685                 err = mgmt_cmd_status(sk, hdev->id,
3686                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3687                                       MGMT_STATUS_BUSY);
3688                 goto unlock;
3689         }
3690
3691         if (hdev_is_powered(hdev) &&
3692             !!cp->val != hci_dev_test_flag(hdev,
3693                                            HCI_WIDEBAND_SPEECH_ENABLED)) {
3694                 err = mgmt_cmd_status(sk, hdev->id,
3695                                       MGMT_OP_SET_WIDEBAND_SPEECH,
3696                                       MGMT_STATUS_REJECTED);
3697                 goto unlock;
3698         }
3699
3700         if (cp->val)
3701                 changed = !hci_dev_test_and_set_flag(hdev,
3702                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3703         else
3704                 changed = hci_dev_test_and_clear_flag(hdev,
3705                                                    HCI_WIDEBAND_SPEECH_ENABLED);
3706
3707         err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3708         if (err < 0)
3709                 goto unlock;
3710
3711         if (changed)
3712                 err = new_settings(hdev, sk);
3713
3714 unlock:
3715         hci_dev_unlock(hdev);
3716         return err;
3717 }
3718
3719 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3720                                void *data, u16 data_len)
3721 {
3722         char buf[20];
3723         struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3724         u16 cap_len = 0;
3725         u8 flags = 0;
3726         u8 tx_power_range[2];
3727
3728         bt_dev_dbg(hdev, "sock %p", sk);
3729
3730         memset(&buf, 0, sizeof(buf));
3731
3732         hci_dev_lock(hdev);
3733
3734         /* When the Read Simple Pairing Options command is supported, then
3735          * the remote public key validation is supported.
3736          *
3737          * Alternatively, when Microsoft extensions are available, they can
3738          * indicate support for public key validation as well.
3739          */
3740         if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
3741                 flags |= 0x01;  /* Remote public key validation (BR/EDR) */
3742
3743         flags |= 0x02;          /* Remote public key validation (LE) */
3744
3745         /* When the Read Encryption Key Size command is supported, then the
3746          * encryption key size is enforced.
3747          */
3748         if (hdev->commands[20] & 0x10)
3749                 flags |= 0x04;  /* Encryption key size enforcement (BR/EDR) */
3750
3751         flags |= 0x08;          /* Encryption key size enforcement (LE) */
3752
3753         cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3754                                   &flags, 1);
3755
3756         /* When the Read Simple Pairing Options command is supported, then
3757          * also max encryption key size information is provided.
3758          */
3759         if (hdev->commands[41] & 0x08)
3760                 cap_len = eir_append_le16(rp->cap, cap_len,
3761                                           MGMT_CAP_MAX_ENC_KEY_SIZE,
3762                                           hdev->max_enc_key_size);
3763
3764         cap_len = eir_append_le16(rp->cap, cap_len,
3765                                   MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3766                                   SMP_MAX_ENC_KEY_SIZE);
3767
3768         /* Append the min/max LE tx power parameters if we were able to fetch
3769          * it from the controller
3770          */
3771         if (hdev->commands[38] & 0x80) {
3772                 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3773                 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3774                 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3775                                           tx_power_range, 2);
3776         }
3777
3778         rp->cap_len = cpu_to_le16(cap_len);
3779
3780         hci_dev_unlock(hdev);
3781
3782         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3783                                  rp, sizeof(*rp) + cap_len);
3784 }
3785
3786 #ifdef CONFIG_BT_FEATURE_DEBUG
3787 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3788 static const u8 debug_uuid[16] = {
3789         0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3790         0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3791 };
3792 #endif
3793
3794 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3795 static const u8 simult_central_periph_uuid[16] = {
3796         0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3797         0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3798 };
3799
3800 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3801 static const u8 rpa_resolution_uuid[16] = {
3802         0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3803         0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3804 };
3805
3806 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3807                                   void *data, u16 data_len)
3808 {
3809         char buf[62];   /* Enough space for 3 features */
3810         struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3811         u16 idx = 0;
3812         u32 flags;
3813
3814         bt_dev_dbg(hdev, "sock %p", sk);
3815
3816         memset(&buf, 0, sizeof(buf));
3817
3818 #ifdef CONFIG_BT_FEATURE_DEBUG
3819         if (!hdev) {
3820                 flags = bt_dbg_get() ? BIT(0) : 0;
3821
3822                 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3823                 rp->features[idx].flags = cpu_to_le32(flags);
3824                 idx++;
3825         }
3826 #endif
3827
3828         if (hdev) {
3829                 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3830                     (hdev->le_states[4] & 0x08) &&      /* Central */
3831                     (hdev->le_states[4] & 0x40) &&      /* Peripheral */
3832                     (hdev->le_states[3] & 0x10))        /* Simultaneous */
3833                         flags = BIT(0);
3834                 else
3835                         flags = 0;
3836
3837                 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3838                 rp->features[idx].flags = cpu_to_le32(flags);
3839                 idx++;
3840         }
3841
3842         if (hdev && use_ll_privacy(hdev)) {
3843                 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3844                         flags = BIT(0) | BIT(1);
3845                 else
3846                         flags = BIT(1);
3847
3848                 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3849                 rp->features[idx].flags = cpu_to_le32(flags);
3850                 idx++;
3851         }
3852
3853         rp->feature_count = cpu_to_le16(idx);
3854
3855         /* After reading the experimental features information, enable
3856          * the events to update client on any future change.
3857          */
3858         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3859
3860         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3861                                  MGMT_OP_READ_EXP_FEATURES_INFO,
3862                                  0, rp, sizeof(*rp) + (20 * idx));
3863 }
3864
3865 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3866                                           struct sock *skip)
3867 {
3868         struct mgmt_ev_exp_feature_changed ev;
3869
3870         memset(&ev, 0, sizeof(ev));
3871         memcpy(ev.uuid, rpa_resolution_uuid, 16);
3872         ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3873
3874         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3875                                   &ev, sizeof(ev),
3876                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3877
3878 }
3879
3880 #ifdef CONFIG_BT_FEATURE_DEBUG
3881 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3882 {
3883         struct mgmt_ev_exp_feature_changed ev;
3884
3885         memset(&ev, 0, sizeof(ev));
3886         memcpy(ev.uuid, debug_uuid, 16);
3887         ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3888
3889         return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3890                                   &ev, sizeof(ev),
3891                                   HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3892 }
3893 #endif
3894
3895 #define EXP_FEAT(_uuid, _set_func)      \
3896 {                                       \
3897         .uuid = _uuid,                  \
3898         .set_func = _set_func,          \
3899 }
3900
3901 /* The zero key uuid is special. Multiple exp features are set through it. */
3902 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
3903                              struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3904 {
3905         struct mgmt_rp_set_exp_feature rp;
3906
3907         memset(rp.uuid, 0, 16);
3908         rp.flags = cpu_to_le32(0);
3909
3910 #ifdef CONFIG_BT_FEATURE_DEBUG
3911         if (!hdev) {
3912                 bool changed = bt_dbg_get();
3913
3914                 bt_dbg_set(false);
3915
3916                 if (changed)
3917                         exp_debug_feature_changed(false, sk);
3918         }
3919 #endif
3920
3921         if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3922                 bool changed;
3923
3924                 changed = hci_dev_test_and_clear_flag(hdev,
3925                                                       HCI_ENABLE_LL_PRIVACY);
3926                 if (changed)
3927                         exp_ll_privacy_feature_changed(false, hdev, sk);
3928         }
3929
3930         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3931
3932         return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3933                                  MGMT_OP_SET_EXP_FEATURE, 0,
3934                                  &rp, sizeof(rp));
3935 }
3936
3937 #ifdef CONFIG_BT_FEATURE_DEBUG
3938 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
3939                           struct mgmt_cp_set_exp_feature *cp, u16 data_len)
3940 {
3941         struct mgmt_rp_set_exp_feature rp;
3942
3943         bool val, changed;
3944         int err;
3945
3946         /* Command requires to use the non-controller index */
3947         if (hdev)
3948                 return mgmt_cmd_status(sk, hdev->id,
3949                                        MGMT_OP_SET_EXP_FEATURE,
3950                                        MGMT_STATUS_INVALID_INDEX);
3951
3952         /* Parameters are limited to a single octet */
3953         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3954                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3955                                        MGMT_OP_SET_EXP_FEATURE,
3956                                        MGMT_STATUS_INVALID_PARAMS);
3957
3958         /* Only boolean on/off is supported */
3959         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3960                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3961                                        MGMT_OP_SET_EXP_FEATURE,
3962                                        MGMT_STATUS_INVALID_PARAMS);
3963
3964         val = !!cp->param[0];
3965         changed = val ? !bt_dbg_get() : bt_dbg_get();
3966         bt_dbg_set(val);
3967
3968         memcpy(rp.uuid, debug_uuid, 16);
3969         rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3970
3971         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3972
3973         err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3974                                 MGMT_OP_SET_EXP_FEATURE, 0,
3975                                 &rp, sizeof(rp));
3976
3977         if (changed)
3978                 exp_debug_feature_changed(val, sk);
3979
3980         return err;
3981 }
3982 #endif
3983
3984 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev,
3985                                    struct mgmt_cp_set_exp_feature *cp,
3986                                    u16 data_len)
3987 {
3988         struct mgmt_rp_set_exp_feature rp;
3989         bool val, changed;
3990         int err;
3991         u32 flags;
3992
3993         /* Command requires to use the controller index */
3994         if (!hdev)
3995                 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3996                                        MGMT_OP_SET_EXP_FEATURE,
3997                                        MGMT_STATUS_INVALID_INDEX);
3998
3999         /* Changes can only be made when controller is powered down */
4000         if (hdev_is_powered(hdev))
4001                 return mgmt_cmd_status(sk, hdev->id,
4002                                        MGMT_OP_SET_EXP_FEATURE,
4003                                        MGMT_STATUS_REJECTED);
4004
4005         /* Parameters are limited to a single octet */
4006         if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4007                 return mgmt_cmd_status(sk, hdev->id,
4008                                        MGMT_OP_SET_EXP_FEATURE,
4009                                        MGMT_STATUS_INVALID_PARAMS);
4010
4011         /* Only boolean on/off is supported */
4012         if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4013                 return mgmt_cmd_status(sk, hdev->id,
4014                                        MGMT_OP_SET_EXP_FEATURE,
4015                                        MGMT_STATUS_INVALID_PARAMS);
4016
4017         val = !!cp->param[0];
4018
4019         if (val) {
4020                 changed = !hci_dev_test_and_set_flag(hdev,
4021                                                      HCI_ENABLE_LL_PRIVACY);
4022                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4023
4024                 /* Enable LL privacy + supported settings changed */
4025                 flags = BIT(0) | BIT(1);
4026         } else {
4027                 changed = hci_dev_test_and_clear_flag(hdev,
4028                                                       HCI_ENABLE_LL_PRIVACY);
4029
4030                 /* Disable LL privacy + supported settings changed */
4031                 flags = BIT(1);
4032         }
4033
4034         memcpy(rp.uuid, rpa_resolution_uuid, 16);
4035         rp.flags = cpu_to_le32(flags);
4036
4037         hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4038
4039         err = mgmt_cmd_complete(sk, hdev->id,
4040                                 MGMT_OP_SET_EXP_FEATURE, 0,
4041                                 &rp, sizeof(rp));
4042
4043         if (changed)
4044                 exp_ll_privacy_feature_changed(val, hdev, sk);
4045
4046         return err;
4047 }
4048
4049 static const struct mgmt_exp_feature {
4050         const u8 *uuid;
4051         int (*set_func)(struct sock *sk, struct hci_dev *hdev,
4052                         struct mgmt_cp_set_exp_feature *cp, u16 data_len);
4053 } exp_features[] = {
4054         EXP_FEAT(ZERO_KEY, set_zero_key_func),
4055 #ifdef CONFIG_BT_FEATURE_DEBUG
4056         EXP_FEAT(debug_uuid, set_debug_func),
4057 #endif
4058         EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func),
4059
4060         /* end with a null feature */
4061         EXP_FEAT(NULL, NULL)
4062 };
4063
4064 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
4065                            void *data, u16 data_len)
4066 {
4067         struct mgmt_cp_set_exp_feature *cp = data;
4068         size_t i = 0;
4069
4070         bt_dev_dbg(hdev, "sock %p", sk);
4071
4072         for (i = 0; exp_features[i].uuid; i++) {
4073                 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
4074                         return exp_features[i].set_func(sk, hdev, cp, data_len);
4075         }
4076
4077         return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4078                                MGMT_OP_SET_EXP_FEATURE,
4079                                MGMT_STATUS_NOT_SUPPORTED);
4080 }
4081
4082 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4083
4084 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4085                             u16 data_len)
4086 {
4087         struct mgmt_cp_get_device_flags *cp = data;
4088         struct mgmt_rp_get_device_flags rp;
4089         struct bdaddr_list_with_flags *br_params;
4090         struct hci_conn_params *params;
4091         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4092         u32 current_flags = 0;
4093         u8 status = MGMT_STATUS_INVALID_PARAMS;
4094
4095         bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4096                    &cp->addr.bdaddr, cp->addr.type);
4097
4098         hci_dev_lock(hdev);
4099
4100         memset(&rp, 0, sizeof(rp));
4101
4102         if (cp->addr.type == BDADDR_BREDR) {
4103                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4104                                                               &cp->addr.bdaddr,
4105                                                               cp->addr.type);
4106                 if (!br_params)
4107                         goto done;
4108
4109                 current_flags = br_params->current_flags;
4110         } else {
4111                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4112                                                 le_addr_type(cp->addr.type));
4113
4114                 if (!params)
4115                         goto done;
4116
4117                 current_flags = params->current_flags;
4118         }
4119
4120         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4121         rp.addr.type = cp->addr.type;
4122         rp.supported_flags = cpu_to_le32(supported_flags);
4123         rp.current_flags = cpu_to_le32(current_flags);
4124
4125         status = MGMT_STATUS_SUCCESS;
4126
4127 done:
4128         hci_dev_unlock(hdev);
4129
4130         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4131                                 &rp, sizeof(rp));
4132 }
4133
4134 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4135                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4136                                  u32 supported_flags, u32 current_flags)
4137 {
4138         struct mgmt_ev_device_flags_changed ev;
4139
4140         bacpy(&ev.addr.bdaddr, bdaddr);
4141         ev.addr.type = bdaddr_type;
4142         ev.supported_flags = cpu_to_le32(supported_flags);
4143         ev.current_flags = cpu_to_le32(current_flags);
4144
4145         mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4146 }
4147
4148 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4149                             u16 len)
4150 {
4151         struct mgmt_cp_set_device_flags *cp = data;
4152         struct bdaddr_list_with_flags *br_params;
4153         struct hci_conn_params *params;
4154         u8 status = MGMT_STATUS_INVALID_PARAMS;
4155         u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4156         u32 current_flags = __le32_to_cpu(cp->current_flags);
4157
4158         bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4159                    &cp->addr.bdaddr, cp->addr.type,
4160                    __le32_to_cpu(current_flags));
4161
4162         if ((supported_flags | current_flags) != supported_flags) {
4163                 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4164                             current_flags, supported_flags);
4165                 goto done;
4166         }
4167
4168         hci_dev_lock(hdev);
4169
4170         if (cp->addr.type == BDADDR_BREDR) {
4171                 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
4172                                                               &cp->addr.bdaddr,
4173                                                               cp->addr.type);
4174
4175                 if (br_params) {
4176                         br_params->current_flags = current_flags;
4177                         status = MGMT_STATUS_SUCCESS;
4178                 } else {
4179                         bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4180                                     &cp->addr.bdaddr, cp->addr.type);
4181                 }
4182         } else {
4183                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4184                                                 le_addr_type(cp->addr.type));
4185                 if (params) {
4186                         params->current_flags = current_flags;
4187                         status = MGMT_STATUS_SUCCESS;
4188                 } else {
4189                         bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4190                                     &cp->addr.bdaddr,
4191                                     le_addr_type(cp->addr.type));
4192                 }
4193         }
4194
4195 done:
4196         hci_dev_unlock(hdev);
4197
4198         if (status == MGMT_STATUS_SUCCESS)
4199                 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4200                                      supported_flags, current_flags);
4201
4202         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4203                                  &cp->addr, sizeof(cp->addr));
4204 }
4205
4206 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4207                                    u16 handle)
4208 {
4209         struct mgmt_ev_adv_monitor_added ev;
4210
4211         ev.monitor_handle = cpu_to_le16(handle);
4212
4213         mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4214 }
4215
4216 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle)
4217 {
4218         struct mgmt_ev_adv_monitor_removed ev;
4219         struct mgmt_pending_cmd *cmd;
4220         struct sock *sk_skip = NULL;
4221         struct mgmt_cp_remove_adv_monitor *cp;
4222
4223         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4224         if (cmd) {
4225                 cp = cmd->param;
4226
4227                 if (cp->monitor_handle)
4228                         sk_skip = cmd->sk;
4229         }
4230
4231         ev.monitor_handle = cpu_to_le16(handle);
4232
4233         mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip);
4234 }
4235
4236 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4237                                  void *data, u16 len)
4238 {
4239         struct adv_monitor *monitor = NULL;
4240         struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4241         int handle, err;
4242         size_t rp_size = 0;
4243         __u32 supported = 0;
4244         __u32 enabled = 0;
4245         __u16 num_handles = 0;
4246         __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4247
4248         BT_DBG("request for %s", hdev->name);
4249
4250         hci_dev_lock(hdev);
4251
4252         if (msft_monitor_supported(hdev))
4253                 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4254
4255         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
4256                 handles[num_handles++] = monitor->handle;
4257
4258         hci_dev_unlock(hdev);
4259
4260         rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4261         rp = kmalloc(rp_size, GFP_KERNEL);
4262         if (!rp)
4263                 return -ENOMEM;
4264
4265         /* All supported features are currently enabled */
4266         enabled = supported;
4267
4268         rp->supported_features = cpu_to_le32(supported);
4269         rp->enabled_features = cpu_to_le32(enabled);
4270         rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4271         rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4272         rp->num_handles = cpu_to_le16(num_handles);
4273         if (num_handles)
4274                 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4275
4276         err = mgmt_cmd_complete(sk, hdev->id,
4277                                 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4278                                 MGMT_STATUS_SUCCESS, rp, rp_size);
4279
4280         kfree(rp);
4281
4282         return err;
4283 }
4284
4285 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
4286 {
4287         struct mgmt_rp_add_adv_patterns_monitor rp;
4288         struct mgmt_pending_cmd *cmd;
4289         struct adv_monitor *monitor;
4290         int err = 0;
4291
4292         hci_dev_lock(hdev);
4293
4294         cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev);
4295         if (!cmd) {
4296                 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev);
4297                 if (!cmd)
4298                         goto done;
4299         }
4300
4301         monitor = cmd->user_data;
4302         rp.monitor_handle = cpu_to_le16(monitor->handle);
4303
4304         if (!status) {
4305                 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
4306                 hdev->adv_monitors_cnt++;
4307                 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
4308                         monitor->state = ADV_MONITOR_STATE_REGISTERED;
4309                 hci_update_background_scan(hdev);
4310         }
4311
4312         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4313                                 mgmt_status(status), &rp, sizeof(rp));
4314         mgmt_pending_remove(cmd);
4315
4316 done:
4317         hci_dev_unlock(hdev);
4318         bt_dev_dbg(hdev, "add monitor %d complete, status %u",
4319                    rp.monitor_handle, status);
4320
4321         return err;
4322 }
4323
4324 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4325                                       struct adv_monitor *m, u8 status,
4326                                       void *data, u16 len, u16 op)
4327 {
4328         struct mgmt_rp_add_adv_patterns_monitor rp;
4329         struct mgmt_pending_cmd *cmd;
4330         int err;
4331         bool pending;
4332
4333         hci_dev_lock(hdev);
4334
4335         if (status)
4336                 goto unlock;
4337
4338         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4339             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4340             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) ||
4341             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) {
4342                 status = MGMT_STATUS_BUSY;
4343                 goto unlock;
4344         }
4345
4346         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4347         if (!cmd) {
4348                 status = MGMT_STATUS_NO_RESOURCES;
4349                 goto unlock;
4350         }
4351
4352         cmd->user_data = m;
4353         pending = hci_add_adv_monitor(hdev, m, &err);
4354         if (err) {
4355                 if (err == -ENOSPC || err == -ENOMEM)
4356                         status = MGMT_STATUS_NO_RESOURCES;
4357                 else if (err == -EINVAL)
4358                         status = MGMT_STATUS_INVALID_PARAMS;
4359                 else
4360                         status = MGMT_STATUS_FAILED;
4361
4362                 mgmt_pending_remove(cmd);
4363                 goto unlock;
4364         }
4365
4366         if (!pending) {
4367                 mgmt_pending_remove(cmd);
4368                 rp.monitor_handle = cpu_to_le16(m->handle);
4369                 mgmt_adv_monitor_added(sk, hdev, m->handle);
4370                 m->state = ADV_MONITOR_STATE_REGISTERED;
4371                 hdev->adv_monitors_cnt++;
4372
4373                 hci_dev_unlock(hdev);
4374                 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS,
4375                                          &rp, sizeof(rp));
4376         }
4377
4378         hci_dev_unlock(hdev);
4379
4380         return 0;
4381
4382 unlock:
4383         hci_free_adv_monitor(hdev, m);
4384         hci_dev_unlock(hdev);
4385         return mgmt_cmd_status(sk, hdev->id, op, status);
4386 }
4387
4388 static void parse_adv_monitor_rssi(struct adv_monitor *m,
4389                                    struct mgmt_adv_rssi_thresholds *rssi)
4390 {
4391         if (rssi) {
4392                 m->rssi.low_threshold = rssi->low_threshold;
4393                 m->rssi.low_threshold_timeout =
4394                     __le16_to_cpu(rssi->low_threshold_timeout);
4395                 m->rssi.high_threshold = rssi->high_threshold;
4396                 m->rssi.high_threshold_timeout =
4397                     __le16_to_cpu(rssi->high_threshold_timeout);
4398                 m->rssi.sampling_period = rssi->sampling_period;
4399         } else {
4400                 /* Default values. These numbers are the least constricting
4401                  * parameters for MSFT API to work, so it behaves as if there
4402                  * are no rssi parameter to consider. May need to be changed
4403                  * if other API are to be supported.
4404                  */
4405                 m->rssi.low_threshold = -127;
4406                 m->rssi.low_threshold_timeout = 60;
4407                 m->rssi.high_threshold = -127;
4408                 m->rssi.high_threshold_timeout = 0;
4409                 m->rssi.sampling_period = 0;
4410         }
4411 }
4412
4413 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
4414                                     struct mgmt_adv_pattern *patterns)
4415 {
4416         u8 offset = 0, length = 0;
4417         struct adv_pattern *p = NULL;
4418         int i;
4419
4420         for (i = 0; i < pattern_count; i++) {
4421                 offset = patterns[i].offset;
4422                 length = patterns[i].length;
4423                 if (offset >= HCI_MAX_AD_LENGTH ||
4424                     length > HCI_MAX_AD_LENGTH ||
4425                     (offset + length) > HCI_MAX_AD_LENGTH)
4426                         return MGMT_STATUS_INVALID_PARAMS;
4427
4428                 p = kmalloc(sizeof(*p), GFP_KERNEL);
4429                 if (!p)
4430                         return MGMT_STATUS_NO_RESOURCES;
4431
4432                 p->ad_type = patterns[i].ad_type;
4433                 p->offset = patterns[i].offset;
4434                 p->length = patterns[i].length;
4435                 memcpy(p->value, patterns[i].value, p->length);
4436
4437                 INIT_LIST_HEAD(&p->list);
4438                 list_add(&p->list, &m->patterns);
4439         }
4440
4441         return MGMT_STATUS_SUCCESS;
4442 }
4443
4444 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4445                                     void *data, u16 len)
4446 {
4447         struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4448         struct adv_monitor *m = NULL;
4449         u8 status = MGMT_STATUS_SUCCESS;
4450         size_t expected_size = sizeof(*cp);
4451
4452         BT_DBG("request for %s", hdev->name);
4453
4454         if (len <= sizeof(*cp)) {
4455                 status = MGMT_STATUS_INVALID_PARAMS;
4456                 goto done;
4457         }
4458
4459         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4460         if (len != expected_size) {
4461                 status = MGMT_STATUS_INVALID_PARAMS;
4462                 goto done;
4463         }
4464
4465         m = kzalloc(sizeof(*m), GFP_KERNEL);
4466         if (!m) {
4467                 status = MGMT_STATUS_NO_RESOURCES;
4468                 goto done;
4469         }
4470
4471         INIT_LIST_HEAD(&m->patterns);
4472
4473         parse_adv_monitor_rssi(m, NULL);
4474         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4475
4476 done:
4477         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4478                                           MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
4479 }
4480
4481 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
4482                                          void *data, u16 len)
4483 {
4484         struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
4485         struct adv_monitor *m = NULL;
4486         u8 status = MGMT_STATUS_SUCCESS;
4487         size_t expected_size = sizeof(*cp);
4488
4489         BT_DBG("request for %s", hdev->name);
4490
4491         if (len <= sizeof(*cp)) {
4492                 status = MGMT_STATUS_INVALID_PARAMS;
4493                 goto done;
4494         }
4495
4496         expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
4497         if (len != expected_size) {
4498                 status = MGMT_STATUS_INVALID_PARAMS;
4499                 goto done;
4500         }
4501
4502         m = kzalloc(sizeof(*m), GFP_KERNEL);
4503         if (!m) {
4504                 status = MGMT_STATUS_NO_RESOURCES;
4505                 goto done;
4506         }
4507
4508         INIT_LIST_HEAD(&m->patterns);
4509
4510         parse_adv_monitor_rssi(m, &cp->rssi);
4511         status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
4512
4513 done:
4514         return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
4515                                          MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
4516 }
4517
4518 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
4519 {
4520         struct mgmt_rp_remove_adv_monitor rp;
4521         struct mgmt_cp_remove_adv_monitor *cp;
4522         struct mgmt_pending_cmd *cmd;
4523         int err = 0;
4524
4525         hci_dev_lock(hdev);
4526
4527         cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev);
4528         if (!cmd)
4529                 goto done;
4530
4531         cp = cmd->param;
4532         rp.monitor_handle = cp->monitor_handle;
4533
4534         if (!status)
4535                 hci_update_background_scan(hdev);
4536
4537         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
4538                                 mgmt_status(status), &rp, sizeof(rp));
4539         mgmt_pending_remove(cmd);
4540
4541 done:
4542         hci_dev_unlock(hdev);
4543         bt_dev_dbg(hdev, "remove monitor %d complete, status %u",
4544                    rp.monitor_handle, status);
4545
4546         return err;
4547 }
4548
4549 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4550                               void *data, u16 len)
4551 {
4552         struct mgmt_cp_remove_adv_monitor *cp = data;
4553         struct mgmt_rp_remove_adv_monitor rp;
4554         struct mgmt_pending_cmd *cmd;
4555         u16 handle = __le16_to_cpu(cp->monitor_handle);
4556         int err, status;
4557         bool pending;
4558
4559         BT_DBG("request for %s", hdev->name);
4560         rp.monitor_handle = cp->monitor_handle;
4561
4562         hci_dev_lock(hdev);
4563
4564         if (pending_find(MGMT_OP_SET_LE, hdev) ||
4565             pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) ||
4566             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
4567             pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
4568                 status = MGMT_STATUS_BUSY;
4569                 goto unlock;
4570         }
4571
4572         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
4573         if (!cmd) {
4574                 status = MGMT_STATUS_NO_RESOURCES;
4575                 goto unlock;
4576         }
4577
4578         if (handle)
4579                 pending = hci_remove_single_adv_monitor(hdev, handle, &err);
4580         else
4581                 pending = hci_remove_all_adv_monitor(hdev, &err);
4582
4583         if (err) {
4584                 mgmt_pending_remove(cmd);
4585
4586                 if (err == -ENOENT)
4587                         status = MGMT_STATUS_INVALID_INDEX;
4588                 else
4589                         status = MGMT_STATUS_FAILED;
4590
4591                 goto unlock;
4592         }
4593
4594         /* monitor can be removed without forwarding request to controller */
4595         if (!pending) {
4596                 mgmt_pending_remove(cmd);
4597                 hci_dev_unlock(hdev);
4598
4599                 return mgmt_cmd_complete(sk, hdev->id,
4600                                          MGMT_OP_REMOVE_ADV_MONITOR,
4601                                          MGMT_STATUS_SUCCESS,
4602                                          &rp, sizeof(rp));
4603         }
4604
4605         hci_dev_unlock(hdev);
4606         return 0;
4607
4608 unlock:
4609         hci_dev_unlock(hdev);
4610         return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4611                                status);
4612 }
4613
4614 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4615                                          u16 opcode, struct sk_buff *skb)
4616 {
4617         struct mgmt_rp_read_local_oob_data mgmt_rp;
4618         size_t rp_size = sizeof(mgmt_rp);
4619         struct mgmt_pending_cmd *cmd;
4620
4621         bt_dev_dbg(hdev, "status %u", status);
4622
4623         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4624         if (!cmd)
4625                 return;
4626
4627         if (status || !skb) {
4628                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4629                                 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4630                 goto remove;
4631         }
4632
4633         memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4634
4635         if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4636                 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4637
4638                 if (skb->len < sizeof(*rp)) {
4639                         mgmt_cmd_status(cmd->sk, hdev->id,
4640                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4641                                         MGMT_STATUS_FAILED);
4642                         goto remove;
4643                 }
4644
4645                 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4646                 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4647
4648                 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4649         } else {
4650                 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4651
4652                 if (skb->len < sizeof(*rp)) {
4653                         mgmt_cmd_status(cmd->sk, hdev->id,
4654                                         MGMT_OP_READ_LOCAL_OOB_DATA,
4655                                         MGMT_STATUS_FAILED);
4656                         goto remove;
4657                 }
4658
4659                 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4660                 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4661
4662                 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4663                 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4664         }
4665
4666         mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4667                           MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4668
4669 remove:
4670         mgmt_pending_remove(cmd);
4671 }
4672
4673 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4674                                void *data, u16 data_len)
4675 {
4676         struct mgmt_pending_cmd *cmd;
4677         struct hci_request req;
4678         int err;
4679
4680         bt_dev_dbg(hdev, "sock %p", sk);
4681
4682         hci_dev_lock(hdev);
4683
4684         if (!hdev_is_powered(hdev)) {
4685                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4686                                       MGMT_STATUS_NOT_POWERED);
4687                 goto unlock;
4688         }
4689
4690         if (!lmp_ssp_capable(hdev)) {
4691                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4692                                       MGMT_STATUS_NOT_SUPPORTED);
4693                 goto unlock;
4694         }
4695
4696         if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4697                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4698                                       MGMT_STATUS_BUSY);
4699                 goto unlock;
4700         }
4701
4702         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4703         if (!cmd) {
4704                 err = -ENOMEM;
4705                 goto unlock;
4706         }
4707
4708         hci_req_init(&req, hdev);
4709
4710         if (bredr_sc_enabled(hdev))
4711                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4712         else
4713                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4714
4715         err = hci_req_run_skb(&req, read_local_oob_data_complete);
4716         if (err < 0)
4717                 mgmt_pending_remove(cmd);
4718
4719 unlock:
4720         hci_dev_unlock(hdev);
4721         return err;
4722 }
4723
4724 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4725                                void *data, u16 len)
4726 {
4727         struct mgmt_addr_info *addr = data;
4728         int err;
4729
4730         bt_dev_dbg(hdev, "sock %p", sk);
4731
4732         if (!bdaddr_type_is_valid(addr->type))
4733                 return mgmt_cmd_complete(sk, hdev->id,
4734                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
4735                                          MGMT_STATUS_INVALID_PARAMS,
4736                                          addr, sizeof(*addr));
4737
4738         hci_dev_lock(hdev);
4739
4740         if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4741                 struct mgmt_cp_add_remote_oob_data *cp = data;
4742                 u8 status;
4743
4744                 if (cp->addr.type != BDADDR_BREDR) {
4745                         err = mgmt_cmd_complete(sk, hdev->id,
4746                                                 MGMT_OP_ADD_REMOTE_OOB_DATA,
4747                                                 MGMT_STATUS_INVALID_PARAMS,
4748                                                 &cp->addr, sizeof(cp->addr));
4749                         goto unlock;
4750                 }
4751
4752                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4753                                               cp->addr.type, cp->hash,
4754                                               cp->rand, NULL, NULL);
4755                 if (err < 0)
4756                         status = MGMT_STATUS_FAILED;
4757                 else
4758                         status = MGMT_STATUS_SUCCESS;
4759
4760                 err = mgmt_cmd_complete(sk, hdev->id,
4761                                         MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4762                                         &cp->addr, sizeof(cp->addr));
4763         } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4764                 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4765                 u8 *rand192, *hash192, *rand256, *hash256;
4766                 u8 status;
4767
4768                 if (bdaddr_type_is_le(cp->addr.type)) {
4769                         /* Enforce zero-valued 192-bit parameters as
4770                          * long as legacy SMP OOB isn't implemented.
4771                          */
4772                         if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4773                             memcmp(cp->hash192, ZERO_KEY, 16)) {
4774                                 err = mgmt_cmd_complete(sk, hdev->id,
4775                                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4776                                                         MGMT_STATUS_INVALID_PARAMS,
4777                                                         addr, sizeof(*addr));
4778                                 goto unlock;
4779                         }
4780
4781                         rand192 = NULL;
4782                         hash192 = NULL;
4783                 } else {
4784                         /* In case one of the P-192 values is set to zero,
4785                          * then just disable OOB data for P-192.
4786                          */
4787                         if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4788                             !memcmp(cp->hash192, ZERO_KEY, 16)) {
4789                                 rand192 = NULL;
4790                                 hash192 = NULL;
4791                         } else {
4792                                 rand192 = cp->rand192;
4793                                 hash192 = cp->hash192;
4794                         }
4795                 }
4796
4797                 /* In case one of the P-256 values is set to zero, then just
4798                  * disable OOB data for P-256.
4799                  */
4800                 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4801                     !memcmp(cp->hash256, ZERO_KEY, 16)) {
4802                         rand256 = NULL;
4803                         hash256 = NULL;
4804                 } else {
4805                         rand256 = cp->rand256;
4806                         hash256 = cp->hash256;
4807                 }
4808
4809                 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4810                                               cp->addr.type, hash192, rand192,
4811                                               hash256, rand256);
4812                 if (err < 0)
4813                         status = MGMT_STATUS_FAILED;
4814                 else
4815                         status = MGMT_STATUS_SUCCESS;
4816
4817                 err = mgmt_cmd_complete(sk, hdev->id,
4818                                         MGMT_OP_ADD_REMOTE_OOB_DATA,
4819                                         status, &cp->addr, sizeof(cp->addr));
4820         } else {
4821                 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4822                            len);
4823                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4824                                       MGMT_STATUS_INVALID_PARAMS);
4825         }
4826
4827 unlock:
4828         hci_dev_unlock(hdev);
4829         return err;
4830 }
4831
4832 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4833                                   void *data, u16 len)
4834 {
4835         struct mgmt_cp_remove_remote_oob_data *cp = data;
4836         u8 status;
4837         int err;
4838
4839         bt_dev_dbg(hdev, "sock %p", sk);
4840
4841         if (cp->addr.type != BDADDR_BREDR)
4842                 return mgmt_cmd_complete(sk, hdev->id,
4843                                          MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4844                                          MGMT_STATUS_INVALID_PARAMS,
4845                                          &cp->addr, sizeof(cp->addr));
4846
4847         hci_dev_lock(hdev);
4848
4849         if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4850                 hci_remote_oob_data_clear(hdev);
4851                 status = MGMT_STATUS_SUCCESS;
4852                 goto done;
4853         }
4854
4855         err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4856         if (err < 0)
4857                 status = MGMT_STATUS_INVALID_PARAMS;
4858         else
4859                 status = MGMT_STATUS_SUCCESS;
4860
4861 done:
4862         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4863                                 status, &cp->addr, sizeof(cp->addr));
4864
4865         hci_dev_unlock(hdev);
4866         return err;
4867 }
4868
4869 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4870 {
4871         struct mgmt_pending_cmd *cmd;
4872
4873         bt_dev_dbg(hdev, "status %u", status);
4874
4875         hci_dev_lock(hdev);
4876
4877         cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4878         if (!cmd)
4879                 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4880
4881         if (!cmd)
4882                 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4883
4884         if (cmd) {
4885                 cmd->cmd_complete(cmd, mgmt_status(status));
4886                 mgmt_pending_remove(cmd);
4887         }
4888
4889         hci_dev_unlock(hdev);
4890
4891         /* Handle suspend notifier */
4892         if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4893                                hdev->suspend_tasks)) {
4894                 bt_dev_dbg(hdev, "Unpaused discovery");
4895                 wake_up(&hdev->suspend_wait_q);
4896         }
4897 }
4898
4899 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4900                                     uint8_t *mgmt_status)
4901 {
4902         switch (type) {
4903         case DISCOV_TYPE_LE:
4904                 *mgmt_status = mgmt_le_support(hdev);
4905                 if (*mgmt_status)
4906                         return false;
4907                 break;
4908         case DISCOV_TYPE_INTERLEAVED:
4909                 *mgmt_status = mgmt_le_support(hdev);
4910                 if (*mgmt_status)
4911                         return false;
4912                 fallthrough;
4913         case DISCOV_TYPE_BREDR:
4914                 *mgmt_status = mgmt_bredr_support(hdev);
4915                 if (*mgmt_status)
4916                         return false;
4917                 break;
4918         default:
4919                 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4920                 return false;
4921         }
4922
4923         return true;
4924 }
4925
4926 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4927                                     u16 op, void *data, u16 len)
4928 {
4929         struct mgmt_cp_start_discovery *cp = data;
4930         struct mgmt_pending_cmd *cmd;
4931         u8 status;
4932         int err;
4933
4934         bt_dev_dbg(hdev, "sock %p", sk);
4935
4936         hci_dev_lock(hdev);
4937
4938         if (!hdev_is_powered(hdev)) {
4939                 err = mgmt_cmd_complete(sk, hdev->id, op,
4940                                         MGMT_STATUS_NOT_POWERED,
4941                                         &cp->type, sizeof(cp->type));
4942                 goto failed;
4943         }
4944
4945         if (hdev->discovery.state != DISCOVERY_STOPPED ||
4946             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4947                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4948                                         &cp->type, sizeof(cp->type));
4949                 goto failed;
4950         }
4951
4952         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4953                 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4954                                         &cp->type, sizeof(cp->type));
4955                 goto failed;
4956         }
4957
4958         /* Can't start discovery when it is paused */
4959         if (hdev->discovery_paused) {
4960                 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4961                                         &cp->type, sizeof(cp->type));
4962                 goto failed;
4963         }
4964
4965         /* Clear the discovery filter first to free any previously
4966          * allocated memory for the UUID list.
4967          */
4968         hci_discovery_filter_clear(hdev);
4969
4970         hdev->discovery.type = cp->type;
4971         hdev->discovery.report_invalid_rssi = false;
4972         if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4973                 hdev->discovery.limited = true;
4974         else
4975                 hdev->discovery.limited = false;
4976
4977         cmd = mgmt_pending_add(sk, op, hdev, data, len);
4978         if (!cmd) {
4979                 err = -ENOMEM;
4980                 goto failed;
4981         }
4982
4983         cmd->cmd_complete = generic_cmd_complete;
4984
4985         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4986         queue_work(hdev->req_workqueue, &hdev->discov_update);
4987         err = 0;
4988
4989 failed:
4990         hci_dev_unlock(hdev);
4991         return err;
4992 }
4993
4994 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4995                            void *data, u16 len)
4996 {
4997         return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4998                                         data, len);
4999 }
5000
5001 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
5002                                    void *data, u16 len)
5003 {
5004         return start_discovery_internal(sk, hdev,
5005                                         MGMT_OP_START_LIMITED_DISCOVERY,
5006                                         data, len);
5007 }
5008
5009 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
5010                                           u8 status)
5011 {
5012         return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
5013                                  cmd->param, 1);
5014 }
5015
5016 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
5017                                    void *data, u16 len)
5018 {
5019         struct mgmt_cp_start_service_discovery *cp = data;
5020         struct mgmt_pending_cmd *cmd;
5021         const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
5022         u16 uuid_count, expected_len;
5023         u8 status;
5024         int err;
5025
5026         bt_dev_dbg(hdev, "sock %p", sk);
5027
5028         hci_dev_lock(hdev);
5029
5030         if (!hdev_is_powered(hdev)) {
5031                 err = mgmt_cmd_complete(sk, hdev->id,
5032                                         MGMT_OP_START_SERVICE_DISCOVERY,
5033                                         MGMT_STATUS_NOT_POWERED,
5034                                         &cp->type, sizeof(cp->type));
5035                 goto failed;
5036         }
5037
5038         if (hdev->discovery.state != DISCOVERY_STOPPED ||
5039             hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
5040                 err = mgmt_cmd_complete(sk, hdev->id,
5041                                         MGMT_OP_START_SERVICE_DISCOVERY,
5042                                         MGMT_STATUS_BUSY, &cp->type,
5043                                         sizeof(cp->type));
5044                 goto failed;
5045         }
5046
5047         if (hdev->discovery_paused) {
5048                 err = mgmt_cmd_complete(sk, hdev->id,
5049                                         MGMT_OP_START_SERVICE_DISCOVERY,
5050                                         MGMT_STATUS_BUSY, &cp->type,
5051                                         sizeof(cp->type));
5052                 goto failed;
5053         }
5054
5055         uuid_count = __le16_to_cpu(cp->uuid_count);
5056         if (uuid_count > max_uuid_count) {
5057                 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
5058                            uuid_count);
5059                 err = mgmt_cmd_complete(sk, hdev->id,
5060                                         MGMT_OP_START_SERVICE_DISCOVERY,
5061                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5062                                         sizeof(cp->type));
5063                 goto failed;
5064         }
5065
5066         expected_len = sizeof(*cp) + uuid_count * 16;
5067         if (expected_len != len) {
5068                 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
5069                            expected_len, len);
5070                 err = mgmt_cmd_complete(sk, hdev->id,
5071                                         MGMT_OP_START_SERVICE_DISCOVERY,
5072                                         MGMT_STATUS_INVALID_PARAMS, &cp->type,
5073                                         sizeof(cp->type));
5074                 goto failed;
5075         }
5076
5077         if (!discovery_type_is_valid(hdev, cp->type, &status)) {
5078                 err = mgmt_cmd_complete(sk, hdev->id,
5079                                         MGMT_OP_START_SERVICE_DISCOVERY,
5080                                         status, &cp->type, sizeof(cp->type));
5081                 goto failed;
5082         }
5083
5084         cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
5085                                hdev, data, len);
5086         if (!cmd) {
5087                 err = -ENOMEM;
5088                 goto failed;
5089         }
5090
5091         cmd->cmd_complete = service_discovery_cmd_complete;
5092
5093         /* Clear the discovery filter first to free any previously
5094          * allocated memory for the UUID list.
5095          */
5096         hci_discovery_filter_clear(hdev);
5097
5098         hdev->discovery.result_filtering = true;
5099         hdev->discovery.type = cp->type;
5100         hdev->discovery.rssi = cp->rssi;
5101         hdev->discovery.uuid_count = uuid_count;
5102
5103         if (uuid_count > 0) {
5104                 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
5105                                                 GFP_KERNEL);
5106                 if (!hdev->discovery.uuids) {
5107                         err = mgmt_cmd_complete(sk, hdev->id,
5108                                                 MGMT_OP_START_SERVICE_DISCOVERY,
5109                                                 MGMT_STATUS_FAILED,
5110                                                 &cp->type, sizeof(cp->type));
5111                         mgmt_pending_remove(cmd);
5112                         goto failed;
5113                 }
5114         }
5115
5116         hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5117         queue_work(hdev->req_workqueue, &hdev->discov_update);
5118         err = 0;
5119
5120 failed:
5121         hci_dev_unlock(hdev);
5122         return err;
5123 }
5124
5125 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
5126 {
5127         struct mgmt_pending_cmd *cmd;
5128
5129         bt_dev_dbg(hdev, "status %u", status);
5130
5131         hci_dev_lock(hdev);
5132
5133         cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
5134         if (cmd) {
5135                 cmd->cmd_complete(cmd, mgmt_status(status));
5136                 mgmt_pending_remove(cmd);
5137         }
5138
5139         hci_dev_unlock(hdev);
5140
5141         /* Handle suspend notifier */
5142         if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
5143                 bt_dev_dbg(hdev, "Paused discovery");
5144                 wake_up(&hdev->suspend_wait_q);
5145         }
5146 }
5147
5148 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
5149                           u16 len)
5150 {
5151         struct mgmt_cp_stop_discovery *mgmt_cp = data;
5152         struct mgmt_pending_cmd *cmd;
5153         int err;
5154
5155         bt_dev_dbg(hdev, "sock %p", sk);
5156
5157         hci_dev_lock(hdev);
5158
5159         if (!hci_discovery_active(hdev)) {
5160                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5161                                         MGMT_STATUS_REJECTED, &mgmt_cp->type,
5162                                         sizeof(mgmt_cp->type));
5163                 goto unlock;
5164         }
5165
5166         if (hdev->discovery.type != mgmt_cp->type) {
5167                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
5168                                         MGMT_STATUS_INVALID_PARAMS,
5169                                         &mgmt_cp->type, sizeof(mgmt_cp->type));
5170                 goto unlock;
5171         }
5172
5173         cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
5174         if (!cmd) {
5175                 err = -ENOMEM;
5176                 goto unlock;
5177         }
5178
5179         cmd->cmd_complete = generic_cmd_complete;
5180
5181         hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5182         queue_work(hdev->req_workqueue, &hdev->discov_update);
5183         err = 0;
5184
5185 unlock:
5186         hci_dev_unlock(hdev);
5187         return err;
5188 }
5189
5190 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
5191                         u16 len)
5192 {
5193         struct mgmt_cp_confirm_name *cp = data;
5194         struct inquiry_entry *e;
5195         int err;
5196
5197         bt_dev_dbg(hdev, "sock %p", sk);
5198
5199         hci_dev_lock(hdev);
5200
5201         if (!hci_discovery_active(hdev)) {
5202                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5203                                         MGMT_STATUS_FAILED, &cp->addr,
5204                                         sizeof(cp->addr));
5205                 goto failed;
5206         }
5207
5208         e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
5209         if (!e) {
5210                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
5211                                         MGMT_STATUS_INVALID_PARAMS, &cp->addr,
5212                                         sizeof(cp->addr));
5213                 goto failed;
5214         }
5215
5216         if (cp->name_known) {
5217                 e->name_state = NAME_KNOWN;
5218                 list_del(&e->list);
5219         } else {
5220                 e->name_state = NAME_NEEDED;
5221                 hci_inquiry_cache_update_resolve(hdev, e);
5222         }
5223
5224         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
5225                                 &cp->addr, sizeof(cp->addr));
5226
5227 failed:
5228         hci_dev_unlock(hdev);
5229         return err;
5230 }
5231
5232 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
5233                         u16 len)
5234 {
5235         struct mgmt_cp_block_device *cp = data;
5236         u8 status;
5237         int err;
5238
5239         bt_dev_dbg(hdev, "sock %p", sk);
5240
5241         if (!bdaddr_type_is_valid(cp->addr.type))
5242                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
5243                                          MGMT_STATUS_INVALID_PARAMS,
5244                                          &cp->addr, sizeof(cp->addr));
5245
5246         hci_dev_lock(hdev);
5247
5248         err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
5249                                   cp->addr.type);
5250         if (err < 0) {
5251                 status = MGMT_STATUS_FAILED;
5252                 goto done;
5253         }
5254
5255         mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5256                    sk);
5257         status = MGMT_STATUS_SUCCESS;
5258
5259 done:
5260         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5261                                 &cp->addr, sizeof(cp->addr));
5262
5263         hci_dev_unlock(hdev);
5264
5265         return err;
5266 }
5267
5268 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5269                           u16 len)
5270 {
5271         struct mgmt_cp_unblock_device *cp = data;
5272         u8 status;
5273         int err;
5274
5275         bt_dev_dbg(hdev, "sock %p", sk);
5276
5277         if (!bdaddr_type_is_valid(cp->addr.type))
5278                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5279                                          MGMT_STATUS_INVALID_PARAMS,
5280                                          &cp->addr, sizeof(cp->addr));
5281
5282         hci_dev_lock(hdev);
5283
5284         err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
5285                                   cp->addr.type);
5286         if (err < 0) {
5287                 status = MGMT_STATUS_INVALID_PARAMS;
5288                 goto done;
5289         }
5290
5291         mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5292                    sk);
5293         status = MGMT_STATUS_SUCCESS;
5294
5295 done:
5296         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5297                                 &cp->addr, sizeof(cp->addr));
5298
5299         hci_dev_unlock(hdev);
5300
5301         return err;
5302 }
5303
5304 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5305                          u16 len)
5306 {
5307         struct mgmt_cp_set_device_id *cp = data;
5308         struct hci_request req;
5309         int err;
5310         __u16 source;
5311
5312         bt_dev_dbg(hdev, "sock %p", sk);
5313
5314         source = __le16_to_cpu(cp->source);
5315
5316         if (source > 0x0002)
5317                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5318                                        MGMT_STATUS_INVALID_PARAMS);
5319
5320         hci_dev_lock(hdev);
5321
5322         hdev->devid_source = source;
5323         hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5324         hdev->devid_product = __le16_to_cpu(cp->product);
5325         hdev->devid_version = __le16_to_cpu(cp->version);
5326
5327         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5328                                 NULL, 0);
5329
5330         hci_req_init(&req, hdev);
5331         __hci_req_update_eir(&req);
5332         hci_req_run(&req, NULL);
5333
5334         hci_dev_unlock(hdev);
5335
5336         return err;
5337 }
5338
5339 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5340                                         u16 opcode)
5341 {
5342         bt_dev_dbg(hdev, "status %u", status);
5343 }
5344
5345 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5346                                      u16 opcode)
5347 {
5348         struct cmd_lookup match = { NULL, hdev };
5349         struct hci_request req;
5350         u8 instance;
5351         struct adv_info *adv_instance;
5352         int err;
5353
5354         hci_dev_lock(hdev);
5355
5356         if (status) {
5357                 u8 mgmt_err = mgmt_status(status);
5358
5359                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5360                                      cmd_status_rsp, &mgmt_err);
5361                 goto unlock;
5362         }
5363
5364         if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5365                 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5366         else
5367                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5368
5369         mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5370                              &match);
5371
5372         new_settings(hdev, match.sk);
5373
5374         if (match.sk)
5375                 sock_put(match.sk);
5376
5377         /* Handle suspend notifier */
5378         if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5379                                hdev->suspend_tasks)) {
5380                 bt_dev_dbg(hdev, "Paused advertising");
5381                 wake_up(&hdev->suspend_wait_q);
5382         } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5383                                       hdev->suspend_tasks)) {
5384                 bt_dev_dbg(hdev, "Unpaused advertising");
5385                 wake_up(&hdev->suspend_wait_q);
5386         }
5387
5388         /* If "Set Advertising" was just disabled and instance advertising was
5389          * set up earlier, then re-enable multi-instance advertising.
5390          */
5391         if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5392             list_empty(&hdev->adv_instances))
5393                 goto unlock;
5394
5395         instance = hdev->cur_adv_instance;
5396         if (!instance) {
5397                 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5398                                                         struct adv_info, list);
5399                 if (!adv_instance)
5400                         goto unlock;
5401
5402                 instance = adv_instance->instance;
5403         }
5404
5405         hci_req_init(&req, hdev);
5406
5407         err = __hci_req_schedule_adv_instance(&req, instance, true);
5408
5409         if (!err)
5410                 err = hci_req_run(&req, enable_advertising_instance);
5411
5412         if (err)
5413                 bt_dev_err(hdev, "failed to re-configure advertising");
5414
5415 unlock:
5416         hci_dev_unlock(hdev);
5417 }
5418
5419 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5420                            u16 len)
5421 {
5422         struct mgmt_mode *cp = data;
5423         struct mgmt_pending_cmd *cmd;
5424         struct hci_request req;
5425         u8 val, status;
5426         int err;
5427
5428         bt_dev_dbg(hdev, "sock %p", sk);
5429
5430         status = mgmt_le_support(hdev);
5431         if (status)
5432                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5433                                        status);
5434
5435         /* Enabling the experimental LL Privay support disables support for
5436          * advertising.
5437          */
5438         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5439                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5440                                        MGMT_STATUS_NOT_SUPPORTED);
5441
5442         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5443                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5444                                        MGMT_STATUS_INVALID_PARAMS);
5445
5446         if (hdev->advertising_paused)
5447                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5448                                        MGMT_STATUS_BUSY);
5449
5450         hci_dev_lock(hdev);
5451
5452         val = !!cp->val;
5453
5454         /* The following conditions are ones which mean that we should
5455          * not do any HCI communication but directly send a mgmt
5456          * response to user space (after toggling the flag if
5457          * necessary).
5458          */
5459         if (!hdev_is_powered(hdev) ||
5460             (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5461              (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5462             hci_conn_num(hdev, LE_LINK) > 0 ||
5463             (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5464              hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5465                 bool changed;
5466
5467                 if (cp->val) {
5468                         hdev->cur_adv_instance = 0x00;
5469                         changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5470                         if (cp->val == 0x02)
5471                                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5472                         else
5473                                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5474                 } else {
5475                         changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5476                         hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5477                 }
5478
5479                 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5480                 if (err < 0)
5481                         goto unlock;
5482
5483                 if (changed)
5484                         err = new_settings(hdev, sk);
5485
5486                 goto unlock;
5487         }
5488
5489         if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5490             pending_find(MGMT_OP_SET_LE, hdev)) {
5491                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5492                                       MGMT_STATUS_BUSY);
5493                 goto unlock;
5494         }
5495
5496         cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5497         if (!cmd) {
5498                 err = -ENOMEM;
5499                 goto unlock;
5500         }
5501
5502         hci_req_init(&req, hdev);
5503
5504         if (cp->val == 0x02)
5505                 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5506         else
5507                 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5508
5509         cancel_adv_timeout(hdev);
5510
5511         if (val) {
5512                 /* Switch to instance "0" for the Set Advertising setting.
5513                  * We cannot use update_[adv|scan_rsp]_data() here as the
5514                  * HCI_ADVERTISING flag is not yet set.
5515                  */
5516                 hdev->cur_adv_instance = 0x00;
5517
5518                 if (ext_adv_capable(hdev)) {
5519                         __hci_req_start_ext_adv(&req, 0x00);
5520                 } else {
5521                         __hci_req_update_adv_data(&req, 0x00);
5522                         __hci_req_update_scan_rsp_data(&req, 0x00);
5523                         __hci_req_enable_advertising(&req);
5524                 }
5525         } else {
5526                 __hci_req_disable_advertising(&req);
5527         }
5528
5529         err = hci_req_run(&req, set_advertising_complete);
5530         if (err < 0)
5531                 mgmt_pending_remove(cmd);
5532
5533 unlock:
5534         hci_dev_unlock(hdev);
5535         return err;
5536 }
5537
5538 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5539                               void *data, u16 len)
5540 {
5541         struct mgmt_cp_set_static_address *cp = data;
5542         int err;
5543
5544         bt_dev_dbg(hdev, "sock %p", sk);
5545
5546         if (!lmp_le_capable(hdev))
5547                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5548                                        MGMT_STATUS_NOT_SUPPORTED);
5549
5550         if (hdev_is_powered(hdev))
5551                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5552                                        MGMT_STATUS_REJECTED);
5553
5554         if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5555                 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5556                         return mgmt_cmd_status(sk, hdev->id,
5557                                                MGMT_OP_SET_STATIC_ADDRESS,
5558                                                MGMT_STATUS_INVALID_PARAMS);
5559
5560                 /* Two most significant bits shall be set */
5561                 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5562                         return mgmt_cmd_status(sk, hdev->id,
5563                                                MGMT_OP_SET_STATIC_ADDRESS,
5564                                                MGMT_STATUS_INVALID_PARAMS);
5565         }
5566
5567         hci_dev_lock(hdev);
5568
5569         bacpy(&hdev->static_addr, &cp->bdaddr);
5570
5571         err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5572         if (err < 0)
5573                 goto unlock;
5574
5575         err = new_settings(hdev, sk);
5576
5577 unlock:
5578         hci_dev_unlock(hdev);
5579         return err;
5580 }
5581
5582 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5583                            void *data, u16 len)
5584 {
5585         struct mgmt_cp_set_scan_params *cp = data;
5586         __u16 interval, window;
5587         int err;
5588
5589         bt_dev_dbg(hdev, "sock %p", sk);
5590
5591         if (!lmp_le_capable(hdev))
5592                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5593                                        MGMT_STATUS_NOT_SUPPORTED);
5594
5595         interval = __le16_to_cpu(cp->interval);
5596
5597         if (interval < 0x0004 || interval > 0x4000)
5598                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5599                                        MGMT_STATUS_INVALID_PARAMS);
5600
5601         window = __le16_to_cpu(cp->window);
5602
5603         if (window < 0x0004 || window > 0x4000)
5604                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5605                                        MGMT_STATUS_INVALID_PARAMS);
5606
5607         if (window > interval)
5608                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5609                                        MGMT_STATUS_INVALID_PARAMS);
5610
5611         hci_dev_lock(hdev);
5612
5613         hdev->le_scan_interval = interval;
5614         hdev->le_scan_window = window;
5615
5616         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5617                                 NULL, 0);
5618
5619         /* If background scan is running, restart it so new parameters are
5620          * loaded.
5621          */
5622         if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5623             hdev->discovery.state == DISCOVERY_STOPPED) {
5624                 struct hci_request req;
5625
5626                 hci_req_init(&req, hdev);
5627
5628                 hci_req_add_le_scan_disable(&req, false);
5629                 hci_req_add_le_passive_scan(&req);
5630
5631                 hci_req_run(&req, NULL);
5632         }
5633
5634         hci_dev_unlock(hdev);
5635
5636         return err;
5637 }
5638
5639 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5640                                       u16 opcode)
5641 {
5642         struct mgmt_pending_cmd *cmd;
5643
5644         bt_dev_dbg(hdev, "status 0x%02x", status);
5645
5646         hci_dev_lock(hdev);
5647
5648         cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5649         if (!cmd)
5650                 goto unlock;
5651
5652         if (status) {
5653                 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5654                                 mgmt_status(status));
5655         } else {
5656                 struct mgmt_mode *cp = cmd->param;
5657
5658                 if (cp->val)
5659                         hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5660                 else
5661                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5662
5663                 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5664                 new_settings(hdev, cmd->sk);
5665         }
5666
5667         mgmt_pending_remove(cmd);
5668
5669 unlock:
5670         hci_dev_unlock(hdev);
5671 }
5672
5673 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5674                                 void *data, u16 len)
5675 {
5676         struct mgmt_mode *cp = data;
5677         struct mgmt_pending_cmd *cmd;
5678         struct hci_request req;
5679         int err;
5680
5681         bt_dev_dbg(hdev, "sock %p", sk);
5682
5683         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5684             hdev->hci_ver < BLUETOOTH_VER_1_2)
5685                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5686                                        MGMT_STATUS_NOT_SUPPORTED);
5687
5688         if (cp->val != 0x00 && cp->val != 0x01)
5689                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5690                                        MGMT_STATUS_INVALID_PARAMS);
5691
5692         hci_dev_lock(hdev);
5693
5694         if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5695                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5696                                       MGMT_STATUS_BUSY);
5697                 goto unlock;
5698         }
5699
5700         if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5701                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5702                                         hdev);
5703                 goto unlock;
5704         }
5705
5706         if (!hdev_is_powered(hdev)) {
5707                 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5708                 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5709                                         hdev);
5710                 new_settings(hdev, sk);
5711                 goto unlock;
5712         }
5713
5714         cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5715                                data, len);
5716         if (!cmd) {
5717                 err = -ENOMEM;
5718                 goto unlock;
5719         }
5720
5721         hci_req_init(&req, hdev);
5722
5723         __hci_req_write_fast_connectable(&req, cp->val);
5724
5725         err = hci_req_run(&req, fast_connectable_complete);
5726         if (err < 0) {
5727                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5728                                       MGMT_STATUS_FAILED);
5729                 mgmt_pending_remove(cmd);
5730         }
5731
5732 unlock:
5733         hci_dev_unlock(hdev);
5734
5735         return err;
5736 }
5737
5738 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5739 {
5740         struct mgmt_pending_cmd *cmd;
5741
5742         bt_dev_dbg(hdev, "status 0x%02x", status);
5743
5744         hci_dev_lock(hdev);
5745
5746         cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5747         if (!cmd)
5748                 goto unlock;
5749
5750         if (status) {
5751                 u8 mgmt_err = mgmt_status(status);
5752
5753                 /* We need to restore the flag if related HCI commands
5754                  * failed.
5755                  */
5756                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5757
5758                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5759         } else {
5760                 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5761                 new_settings(hdev, cmd->sk);
5762         }
5763
5764         mgmt_pending_remove(cmd);
5765
5766 unlock:
5767         hci_dev_unlock(hdev);
5768 }
5769
5770 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5771 {
5772         struct mgmt_mode *cp = data;
5773         struct mgmt_pending_cmd *cmd;
5774         struct hci_request req;
5775         int err;
5776
5777         bt_dev_dbg(hdev, "sock %p", sk);
5778
5779         if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5780                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5781                                        MGMT_STATUS_NOT_SUPPORTED);
5782
5783         if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5784                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5785                                        MGMT_STATUS_REJECTED);
5786
5787         if (cp->val != 0x00 && cp->val != 0x01)
5788                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5789                                        MGMT_STATUS_INVALID_PARAMS);
5790
5791         hci_dev_lock(hdev);
5792
5793         if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5794                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5795                 goto unlock;
5796         }
5797
5798         if (!hdev_is_powered(hdev)) {
5799                 if (!cp->val) {
5800                         hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5801                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5802                         hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5803                         hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5804                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5805                 }
5806
5807                 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5808
5809                 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5810                 if (err < 0)
5811                         goto unlock;
5812
5813                 err = new_settings(hdev, sk);
5814                 goto unlock;
5815         }
5816
5817         /* Reject disabling when powered on */
5818         if (!cp->val) {
5819                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5820                                       MGMT_STATUS_REJECTED);
5821                 goto unlock;
5822         } else {
5823                 /* When configuring a dual-mode controller to operate
5824                  * with LE only and using a static address, then switching
5825                  * BR/EDR back on is not allowed.
5826                  *
5827                  * Dual-mode controllers shall operate with the public
5828                  * address as its identity address for BR/EDR and LE. So
5829                  * reject the attempt to create an invalid configuration.
5830                  *
5831                  * The same restrictions applies when secure connections
5832                  * has been enabled. For BR/EDR this is a controller feature
5833                  * while for LE it is a host stack feature. This means that
5834                  * switching BR/EDR back on when secure connections has been
5835                  * enabled is not a supported transaction.
5836                  */
5837                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5838                     (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5839                      hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5840                         err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5841                                               MGMT_STATUS_REJECTED);
5842                         goto unlock;
5843                 }
5844         }
5845
5846         if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5847                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5848                                       MGMT_STATUS_BUSY);
5849                 goto unlock;
5850         }
5851
5852         cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5853         if (!cmd) {
5854                 err = -ENOMEM;
5855                 goto unlock;
5856         }
5857
5858         /* We need to flip the bit already here so that
5859          * hci_req_update_adv_data generates the correct flags.
5860          */
5861         hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5862
5863         hci_req_init(&req, hdev);
5864
5865         __hci_req_write_fast_connectable(&req, false);
5866         __hci_req_update_scan(&req);
5867
5868         /* Since only the advertising data flags will change, there
5869          * is no need to update the scan response data.
5870          */
5871         __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5872
5873         err = hci_req_run(&req, set_bredr_complete);
5874         if (err < 0)
5875                 mgmt_pending_remove(cmd);
5876
5877 unlock:
5878         hci_dev_unlock(hdev);
5879         return err;
5880 }
5881
5882 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5883 {
5884         struct mgmt_pending_cmd *cmd;
5885         struct mgmt_mode *cp;
5886
5887         bt_dev_dbg(hdev, "status %u", status);
5888
5889         hci_dev_lock(hdev);
5890
5891         cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5892         if (!cmd)
5893                 goto unlock;
5894
5895         if (status) {
5896                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5897                                 mgmt_status(status));
5898                 goto remove;
5899         }
5900
5901         cp = cmd->param;
5902
5903         switch (cp->val) {
5904         case 0x00:
5905                 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5906                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5907                 break;
5908         case 0x01:
5909                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5910                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5911                 break;
5912         case 0x02:
5913                 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5914                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5915                 break;
5916         }
5917
5918         send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5919         new_settings(hdev, cmd->sk);
5920
5921 remove:
5922         mgmt_pending_remove(cmd);
5923 unlock:
5924         hci_dev_unlock(hdev);
5925 }
5926
5927 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5928                            void *data, u16 len)
5929 {
5930         struct mgmt_mode *cp = data;
5931         struct mgmt_pending_cmd *cmd;
5932         struct hci_request req;
5933         u8 val;
5934         int err;
5935
5936         bt_dev_dbg(hdev, "sock %p", sk);
5937
5938         if (!lmp_sc_capable(hdev) &&
5939             !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5940                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5941                                        MGMT_STATUS_NOT_SUPPORTED);
5942
5943         if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5944             lmp_sc_capable(hdev) &&
5945             !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5946                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5947                                        MGMT_STATUS_REJECTED);
5948
5949         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5950                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5951                                   MGMT_STATUS_INVALID_PARAMS);
5952
5953         hci_dev_lock(hdev);
5954
5955         if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5956             !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5957                 bool changed;
5958
5959                 if (cp->val) {
5960                         changed = !hci_dev_test_and_set_flag(hdev,
5961                                                              HCI_SC_ENABLED);
5962                         if (cp->val == 0x02)
5963                                 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5964                         else
5965                                 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5966                 } else {
5967                         changed = hci_dev_test_and_clear_flag(hdev,
5968                                                               HCI_SC_ENABLED);
5969                         hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5970                 }
5971
5972                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5973                 if (err < 0)
5974                         goto failed;
5975
5976                 if (changed)
5977                         err = new_settings(hdev, sk);
5978
5979                 goto failed;
5980         }
5981
5982         if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5983                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5984                                       MGMT_STATUS_BUSY);
5985                 goto failed;
5986         }
5987
5988         val = !!cp->val;
5989
5990         if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5991             (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5992                 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5993                 goto failed;
5994         }
5995
5996         cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5997         if (!cmd) {
5998                 err = -ENOMEM;
5999                 goto failed;
6000         }
6001
6002         hci_req_init(&req, hdev);
6003         hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
6004         err = hci_req_run(&req, sc_enable_complete);
6005         if (err < 0) {
6006                 mgmt_pending_remove(cmd);
6007                 goto failed;
6008         }
6009
6010 failed:
6011         hci_dev_unlock(hdev);
6012         return err;
6013 }
6014
6015 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
6016                           void *data, u16 len)
6017 {
6018         struct mgmt_mode *cp = data;
6019         bool changed, use_changed;
6020         int err;
6021
6022         bt_dev_dbg(hdev, "sock %p", sk);
6023
6024         if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6025                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
6026                                        MGMT_STATUS_INVALID_PARAMS);
6027
6028         hci_dev_lock(hdev);
6029
6030         if (cp->val)
6031                 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
6032         else
6033                 changed = hci_dev_test_and_clear_flag(hdev,
6034                                                       HCI_KEEP_DEBUG_KEYS);
6035
6036         if (cp->val == 0x02)
6037                 use_changed = !hci_dev_test_and_set_flag(hdev,
6038                                                          HCI_USE_DEBUG_KEYS);
6039         else
6040                 use_changed = hci_dev_test_and_clear_flag(hdev,
6041                                                           HCI_USE_DEBUG_KEYS);
6042
6043         if (hdev_is_powered(hdev) && use_changed &&
6044             hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6045                 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
6046                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
6047                              sizeof(mode), &mode);
6048         }
6049
6050         err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
6051         if (err < 0)
6052                 goto unlock;
6053
6054         if (changed)
6055                 err = new_settings(hdev, sk);
6056
6057 unlock:
6058         hci_dev_unlock(hdev);
6059         return err;
6060 }
6061
6062 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6063                        u16 len)
6064 {
6065         struct mgmt_cp_set_privacy *cp = cp_data;
6066         bool changed;
6067         int err;
6068
6069         bt_dev_dbg(hdev, "sock %p", sk);
6070
6071         if (!lmp_le_capable(hdev))
6072                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6073                                        MGMT_STATUS_NOT_SUPPORTED);
6074
6075         if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
6076                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6077                                        MGMT_STATUS_INVALID_PARAMS);
6078
6079         if (hdev_is_powered(hdev))
6080                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
6081                                        MGMT_STATUS_REJECTED);
6082
6083         hci_dev_lock(hdev);
6084
6085         /* If user space supports this command it is also expected to
6086          * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
6087          */
6088         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6089
6090         if (cp->privacy) {
6091                 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
6092                 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
6093                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
6094                 hci_adv_instances_set_rpa_expired(hdev, true);
6095                 if (cp->privacy == 0x02)
6096                         hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
6097                 else
6098                         hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6099         } else {
6100                 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
6101                 memset(hdev->irk, 0, sizeof(hdev->irk));
6102                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
6103                 hci_adv_instances_set_rpa_expired(hdev, false);
6104                 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
6105         }
6106
6107         err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
6108         if (err < 0)
6109                 goto unlock;
6110
6111         if (changed)
6112                 err = new_settings(hdev, sk);
6113
6114 unlock:
6115         hci_dev_unlock(hdev);
6116         return err;
6117 }
6118
6119 static bool irk_is_valid(struct mgmt_irk_info *irk)
6120 {
6121         switch (irk->addr.type) {
6122         case BDADDR_LE_PUBLIC:
6123                 return true;
6124
6125         case BDADDR_LE_RANDOM:
6126                 /* Two most significant bits shall be set */
6127                 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6128                         return false;
6129                 return true;
6130         }
6131
6132         return false;
6133 }
6134
6135 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
6136                      u16 len)
6137 {
6138         struct mgmt_cp_load_irks *cp = cp_data;
6139         const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
6140                                    sizeof(struct mgmt_irk_info));
6141         u16 irk_count, expected_len;
6142         int i, err;
6143
6144         bt_dev_dbg(hdev, "sock %p", sk);
6145
6146         if (!lmp_le_capable(hdev))
6147                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6148                                        MGMT_STATUS_NOT_SUPPORTED);
6149
6150         irk_count = __le16_to_cpu(cp->irk_count);
6151         if (irk_count > max_irk_count) {
6152                 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
6153                            irk_count);
6154                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6155                                        MGMT_STATUS_INVALID_PARAMS);
6156         }
6157
6158         expected_len = struct_size(cp, irks, irk_count);
6159         if (expected_len != len) {
6160                 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
6161                            expected_len, len);
6162                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
6163                                        MGMT_STATUS_INVALID_PARAMS);
6164         }
6165
6166         bt_dev_dbg(hdev, "irk_count %u", irk_count);
6167
6168         for (i = 0; i < irk_count; i++) {
6169                 struct mgmt_irk_info *key = &cp->irks[i];
6170
6171                 if (!irk_is_valid(key))
6172                         return mgmt_cmd_status(sk, hdev->id,
6173                                                MGMT_OP_LOAD_IRKS,
6174                                                MGMT_STATUS_INVALID_PARAMS);
6175         }
6176
6177         hci_dev_lock(hdev);
6178
6179         hci_smp_irks_clear(hdev);
6180
6181         for (i = 0; i < irk_count; i++) {
6182                 struct mgmt_irk_info *irk = &cp->irks[i];
6183
6184                 if (hci_is_blocked_key(hdev,
6185                                        HCI_BLOCKED_KEY_TYPE_IRK,
6186                                        irk->val)) {
6187                         bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
6188                                     &irk->addr.bdaddr);
6189                         continue;
6190                 }
6191
6192                 hci_add_irk(hdev, &irk->addr.bdaddr,
6193                             le_addr_type(irk->addr.type), irk->val,
6194                             BDADDR_ANY);
6195         }
6196
6197         hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
6198
6199         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
6200
6201         hci_dev_unlock(hdev);
6202
6203         return err;
6204 }
6205
6206 static bool ltk_is_valid(struct mgmt_ltk_info *key)
6207 {
6208         if (key->initiator != 0x00 && key->initiator != 0x01)
6209                 return false;
6210
6211         switch (key->addr.type) {
6212         case BDADDR_LE_PUBLIC:
6213                 return true;
6214
6215         case BDADDR_LE_RANDOM:
6216                 /* Two most significant bits shall be set */
6217                 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
6218                         return false;
6219                 return true;
6220         }
6221
6222         return false;
6223 }
6224
6225 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
6226                                void *cp_data, u16 len)
6227 {
6228         struct mgmt_cp_load_long_term_keys *cp = cp_data;
6229         const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
6230                                    sizeof(struct mgmt_ltk_info));
6231         u16 key_count, expected_len;
6232         int i, err;
6233
6234         bt_dev_dbg(hdev, "sock %p", sk);
6235
6236         if (!lmp_le_capable(hdev))
6237                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6238                                        MGMT_STATUS_NOT_SUPPORTED);
6239
6240         key_count = __le16_to_cpu(cp->key_count);
6241         if (key_count > max_key_count) {
6242                 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
6243                            key_count);
6244                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6245                                        MGMT_STATUS_INVALID_PARAMS);
6246         }
6247
6248         expected_len = struct_size(cp, keys, key_count);
6249         if (expected_len != len) {
6250                 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
6251                            expected_len, len);
6252                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
6253                                        MGMT_STATUS_INVALID_PARAMS);
6254         }
6255
6256         bt_dev_dbg(hdev, "key_count %u", key_count);
6257
6258         for (i = 0; i < key_count; i++) {
6259                 struct mgmt_ltk_info *key = &cp->keys[i];
6260
6261                 if (!ltk_is_valid(key))
6262                         return mgmt_cmd_status(sk, hdev->id,
6263                                                MGMT_OP_LOAD_LONG_TERM_KEYS,
6264                                                MGMT_STATUS_INVALID_PARAMS);
6265         }
6266
6267         hci_dev_lock(hdev);
6268
6269         hci_smp_ltks_clear(hdev);
6270
6271         for (i = 0; i < key_count; i++) {
6272                 struct mgmt_ltk_info *key = &cp->keys[i];
6273                 u8 type, authenticated;
6274
6275                 if (hci_is_blocked_key(hdev,
6276                                        HCI_BLOCKED_KEY_TYPE_LTK,
6277                                        key->val)) {
6278                         bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
6279                                     &key->addr.bdaddr);
6280                         continue;
6281                 }
6282
6283                 switch (key->type) {
6284                 case MGMT_LTK_UNAUTHENTICATED:
6285                         authenticated = 0x00;
6286                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
6287                         break;
6288                 case MGMT_LTK_AUTHENTICATED:
6289                         authenticated = 0x01;
6290                         type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
6291                         break;
6292                 case MGMT_LTK_P256_UNAUTH:
6293                         authenticated = 0x00;
6294                         type = SMP_LTK_P256;
6295                         break;
6296                 case MGMT_LTK_P256_AUTH:
6297                         authenticated = 0x01;
6298                         type = SMP_LTK_P256;
6299                         break;
6300                 case MGMT_LTK_P256_DEBUG:
6301                         authenticated = 0x00;
6302                         type = SMP_LTK_P256_DEBUG;
6303                         fallthrough;
6304                 default:
6305                         continue;
6306                 }
6307
6308                 hci_add_ltk(hdev, &key->addr.bdaddr,
6309                             le_addr_type(key->addr.type), type, authenticated,
6310                             key->val, key->enc_size, key->ediv, key->rand);
6311         }
6312
6313         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
6314                            NULL, 0);
6315
6316         hci_dev_unlock(hdev);
6317
6318         return err;
6319 }
6320
6321 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6322 {
6323         struct hci_conn *conn = cmd->user_data;
6324         struct mgmt_rp_get_conn_info rp;
6325         int err;
6326
6327         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6328
6329         if (status == MGMT_STATUS_SUCCESS) {
6330                 rp.rssi = conn->rssi;
6331                 rp.tx_power = conn->tx_power;
6332                 rp.max_tx_power = conn->max_tx_power;
6333         } else {
6334                 rp.rssi = HCI_RSSI_INVALID;
6335                 rp.tx_power = HCI_TX_POWER_INVALID;
6336                 rp.max_tx_power = HCI_TX_POWER_INVALID;
6337         }
6338
6339         err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
6340                                 status, &rp, sizeof(rp));
6341
6342         hci_conn_drop(conn);
6343         hci_conn_put(conn);
6344
6345         return err;
6346 }
6347
6348 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
6349                                        u16 opcode)
6350 {
6351         struct hci_cp_read_rssi *cp;
6352         struct mgmt_pending_cmd *cmd;
6353         struct hci_conn *conn;
6354         u16 handle;
6355         u8 status;
6356
6357         bt_dev_dbg(hdev, "status 0x%02x", hci_status);
6358
6359         hci_dev_lock(hdev);
6360
6361         /* Commands sent in request are either Read RSSI or Read Transmit Power
6362          * Level so we check which one was last sent to retrieve connection
6363          * handle.  Both commands have handle as first parameter so it's safe to
6364          * cast data on the same command struct.
6365          *
6366          * First command sent is always Read RSSI and we fail only if it fails.
6367          * In other case we simply override error to indicate success as we
6368          * already remembered if TX power value is actually valid.
6369          */
6370         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
6371         if (!cp) {
6372                 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
6373                 status = MGMT_STATUS_SUCCESS;
6374         } else {
6375                 status = mgmt_status(hci_status);
6376         }
6377
6378         if (!cp) {
6379                 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
6380                 goto unlock;
6381         }
6382
6383         handle = __le16_to_cpu(cp->handle);
6384         conn = hci_conn_hash_lookup_handle(hdev, handle);
6385         if (!conn) {
6386                 bt_dev_err(hdev, "unknown handle (%u) in conn_info response",
6387                            handle);
6388                 goto unlock;
6389         }
6390
6391         cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
6392         if (!cmd)
6393                 goto unlock;
6394
6395         cmd->cmd_complete(cmd, status);
6396         mgmt_pending_remove(cmd);
6397
6398 unlock:
6399         hci_dev_unlock(hdev);
6400 }
6401
6402 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
6403                          u16 len)
6404 {
6405         struct mgmt_cp_get_conn_info *cp = data;
6406         struct mgmt_rp_get_conn_info rp;
6407         struct hci_conn *conn;
6408         unsigned long conn_info_age;
6409         int err = 0;
6410
6411         bt_dev_dbg(hdev, "sock %p", sk);
6412
6413         memset(&rp, 0, sizeof(rp));
6414         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6415         rp.addr.type = cp->addr.type;
6416
6417         if (!bdaddr_type_is_valid(cp->addr.type))
6418                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6419                                          MGMT_STATUS_INVALID_PARAMS,
6420                                          &rp, sizeof(rp));
6421
6422         hci_dev_lock(hdev);
6423
6424         if (!hdev_is_powered(hdev)) {
6425                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6426                                         MGMT_STATUS_NOT_POWERED, &rp,
6427                                         sizeof(rp));
6428                 goto unlock;
6429         }
6430
6431         if (cp->addr.type == BDADDR_BREDR)
6432                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6433                                                &cp->addr.bdaddr);
6434         else
6435                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
6436
6437         if (!conn || conn->state != BT_CONNECTED) {
6438                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6439                                         MGMT_STATUS_NOT_CONNECTED, &rp,
6440                                         sizeof(rp));
6441                 goto unlock;
6442         }
6443
6444         if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
6445                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6446                                         MGMT_STATUS_BUSY, &rp, sizeof(rp));
6447                 goto unlock;
6448         }
6449
6450         /* To avoid client trying to guess when to poll again for information we
6451          * calculate conn info age as random value between min/max set in hdev.
6452          */
6453         conn_info_age = hdev->conn_info_min_age +
6454                         prandom_u32_max(hdev->conn_info_max_age -
6455                                         hdev->conn_info_min_age);
6456
6457         /* Query controller to refresh cached values if they are too old or were
6458          * never read.
6459          */
6460         if (time_after(jiffies, conn->conn_info_timestamp +
6461                        msecs_to_jiffies(conn_info_age)) ||
6462             !conn->conn_info_timestamp) {
6463                 struct hci_request req;
6464                 struct hci_cp_read_tx_power req_txp_cp;
6465                 struct hci_cp_read_rssi req_rssi_cp;
6466                 struct mgmt_pending_cmd *cmd;
6467
6468                 hci_req_init(&req, hdev);
6469                 req_rssi_cp.handle = cpu_to_le16(conn->handle);
6470                 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
6471                             &req_rssi_cp);
6472
6473                 /* For LE links TX power does not change thus we don't need to
6474                  * query for it once value is known.
6475                  */
6476                 if (!bdaddr_type_is_le(cp->addr.type) ||
6477                     conn->tx_power == HCI_TX_POWER_INVALID) {
6478                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6479                         req_txp_cp.type = 0x00;
6480                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6481                                     sizeof(req_txp_cp), &req_txp_cp);
6482                 }
6483
6484                 /* Max TX power needs to be read only once per connection */
6485                 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
6486                         req_txp_cp.handle = cpu_to_le16(conn->handle);
6487                         req_txp_cp.type = 0x01;
6488                         hci_req_add(&req, HCI_OP_READ_TX_POWER,
6489                                     sizeof(req_txp_cp), &req_txp_cp);
6490                 }
6491
6492                 err = hci_req_run(&req, conn_info_refresh_complete);
6493                 if (err < 0)
6494                         goto unlock;
6495
6496                 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
6497                                        data, len);
6498                 if (!cmd) {
6499                         err = -ENOMEM;
6500                         goto unlock;
6501                 }
6502
6503                 hci_conn_hold(conn);
6504                 cmd->user_data = hci_conn_get(conn);
6505                 cmd->cmd_complete = conn_info_cmd_complete;
6506
6507                 conn->conn_info_timestamp = jiffies;
6508         } else {
6509                 /* Cache is valid, just reply with values cached in hci_conn */
6510                 rp.rssi = conn->rssi;
6511                 rp.tx_power = conn->tx_power;
6512                 rp.max_tx_power = conn->max_tx_power;
6513
6514                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6515                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6516         }
6517
6518 unlock:
6519         hci_dev_unlock(hdev);
6520         return err;
6521 }
6522
6523 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6524 {
6525         struct hci_conn *conn = cmd->user_data;
6526         struct mgmt_rp_get_clock_info rp;
6527         struct hci_dev *hdev;
6528         int err;
6529
6530         memset(&rp, 0, sizeof(rp));
6531         memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6532
6533         if (status)
6534                 goto complete;
6535
6536         hdev = hci_dev_get(cmd->index);
6537         if (hdev) {
6538                 rp.local_clock = cpu_to_le32(hdev->clock);
6539                 hci_dev_put(hdev);
6540         }
6541
6542         if (conn) {
6543                 rp.piconet_clock = cpu_to_le32(conn->clock);
6544                 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
6545         }
6546
6547 complete:
6548         err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
6549                                 sizeof(rp));
6550
6551         if (conn) {
6552                 hci_conn_drop(conn);
6553                 hci_conn_put(conn);
6554         }
6555
6556         return err;
6557 }
6558
6559 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6560 {
6561         struct hci_cp_read_clock *hci_cp;
6562         struct mgmt_pending_cmd *cmd;
6563         struct hci_conn *conn;
6564
6565         bt_dev_dbg(hdev, "status %u", status);
6566
6567         hci_dev_lock(hdev);
6568
6569         hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
6570         if (!hci_cp)
6571                 goto unlock;
6572
6573         if (hci_cp->which) {
6574                 u16 handle = __le16_to_cpu(hci_cp->handle);
6575                 conn = hci_conn_hash_lookup_handle(hdev, handle);
6576         } else {
6577                 conn = NULL;
6578         }
6579
6580         cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
6581         if (!cmd)
6582                 goto unlock;
6583
6584         cmd->cmd_complete(cmd, mgmt_status(status));
6585         mgmt_pending_remove(cmd);
6586
6587 unlock:
6588         hci_dev_unlock(hdev);
6589 }
6590
6591 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
6592                          u16 len)
6593 {
6594         struct mgmt_cp_get_clock_info *cp = data;
6595         struct mgmt_rp_get_clock_info rp;
6596         struct hci_cp_read_clock hci_cp;
6597         struct mgmt_pending_cmd *cmd;
6598         struct hci_request req;
6599         struct hci_conn *conn;
6600         int err;
6601
6602         bt_dev_dbg(hdev, "sock %p", sk);
6603
6604         memset(&rp, 0, sizeof(rp));
6605         bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6606         rp.addr.type = cp->addr.type;
6607
6608         if (cp->addr.type != BDADDR_BREDR)
6609                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6610                                          MGMT_STATUS_INVALID_PARAMS,
6611                                          &rp, sizeof(rp));
6612
6613         hci_dev_lock(hdev);
6614
6615         if (!hdev_is_powered(hdev)) {
6616                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6617                                         MGMT_STATUS_NOT_POWERED, &rp,
6618                                         sizeof(rp));
6619                 goto unlock;
6620         }
6621
6622         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6623                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6624                                                &cp->addr.bdaddr);
6625                 if (!conn || conn->state != BT_CONNECTED) {
6626                         err = mgmt_cmd_complete(sk, hdev->id,
6627                                                 MGMT_OP_GET_CLOCK_INFO,
6628                                                 MGMT_STATUS_NOT_CONNECTED,
6629                                                 &rp, sizeof(rp));
6630                         goto unlock;
6631                 }
6632         } else {
6633                 conn = NULL;
6634         }
6635
6636         cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6637         if (!cmd) {
6638                 err = -ENOMEM;
6639                 goto unlock;
6640         }
6641
6642         cmd->cmd_complete = clock_info_cmd_complete;
6643
6644         hci_req_init(&req, hdev);
6645
6646         memset(&hci_cp, 0, sizeof(hci_cp));
6647         hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6648
6649         if (conn) {
6650                 hci_conn_hold(conn);
6651                 cmd->user_data = hci_conn_get(conn);
6652
6653                 hci_cp.handle = cpu_to_le16(conn->handle);
6654                 hci_cp.which = 0x01; /* Piconet clock */
6655                 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6656         }
6657
6658         err = hci_req_run(&req, get_clock_info_complete);
6659         if (err < 0)
6660                 mgmt_pending_remove(cmd);
6661
6662 unlock:
6663         hci_dev_unlock(hdev);
6664         return err;
6665 }
6666
6667 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6668 {
6669         struct hci_conn *conn;
6670
6671         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6672         if (!conn)
6673                 return false;
6674
6675         if (conn->dst_type != type)
6676                 return false;
6677
6678         if (conn->state != BT_CONNECTED)
6679                 return false;
6680
6681         return true;
6682 }
6683
6684 /* This function requires the caller holds hdev->lock */
6685 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
6686                                u8 addr_type, u8 auto_connect)
6687 {
6688         struct hci_conn_params *params;
6689
6690         params = hci_conn_params_add(hdev, addr, addr_type);
6691         if (!params)
6692                 return -EIO;
6693
6694         if (params->auto_connect == auto_connect)
6695                 return 0;
6696
6697         list_del_init(&params->action);
6698
6699         switch (auto_connect) {
6700         case HCI_AUTO_CONN_DISABLED:
6701         case HCI_AUTO_CONN_LINK_LOSS:
6702                 /* If auto connect is being disabled when we're trying to
6703                  * connect to device, keep connecting.
6704                  */
6705                 if (params->explicit_connect)
6706                         list_add(&params->action, &hdev->pend_le_conns);
6707                 break;
6708         case HCI_AUTO_CONN_REPORT:
6709                 if (params->explicit_connect)
6710                         list_add(&params->action, &hdev->pend_le_conns);
6711                 else
6712                         list_add(&params->action, &hdev->pend_le_reports);
6713                 break;
6714         case HCI_AUTO_CONN_DIRECT:
6715         case HCI_AUTO_CONN_ALWAYS:
6716                 if (!is_connected(hdev, addr, addr_type))
6717                         list_add(&params->action, &hdev->pend_le_conns);
6718                 break;
6719         }
6720
6721         params->auto_connect = auto_connect;
6722
6723         bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
6724                    addr, addr_type, auto_connect);
6725
6726         return 0;
6727 }
6728
6729 static void device_added(struct sock *sk, struct hci_dev *hdev,
6730                          bdaddr_t *bdaddr, u8 type, u8 action)
6731 {
6732         struct mgmt_ev_device_added ev;
6733
6734         bacpy(&ev.addr.bdaddr, bdaddr);
6735         ev.addr.type = type;
6736         ev.action = action;
6737
6738         mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6739 }
6740
6741 static int add_device(struct sock *sk, struct hci_dev *hdev,
6742                       void *data, u16 len)
6743 {
6744         struct mgmt_cp_add_device *cp = data;
6745         u8 auto_conn, addr_type;
6746         struct hci_conn_params *params;
6747         int err;
6748         u32 current_flags = 0;
6749
6750         bt_dev_dbg(hdev, "sock %p", sk);
6751
6752         if (!bdaddr_type_is_valid(cp->addr.type) ||
6753             !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
6754                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6755                                          MGMT_STATUS_INVALID_PARAMS,
6756                                          &cp->addr, sizeof(cp->addr));
6757
6758         if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
6759                 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6760                                          MGMT_STATUS_INVALID_PARAMS,
6761                                          &cp->addr, sizeof(cp->addr));
6762
6763         hci_dev_lock(hdev);
6764
6765         if (cp->addr.type == BDADDR_BREDR) {
6766                 /* Only incoming connections action is supported for now */
6767                 if (cp->action != 0x01) {
6768                         err = mgmt_cmd_complete(sk, hdev->id,
6769                                                 MGMT_OP_ADD_DEVICE,
6770                                                 MGMT_STATUS_INVALID_PARAMS,
6771                                                 &cp->addr, sizeof(cp->addr));
6772                         goto unlock;
6773                 }
6774
6775                 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
6776                                                      &cp->addr.bdaddr,
6777                                                      cp->addr.type, 0);
6778                 if (err)
6779                         goto unlock;
6780
6781                 hci_req_update_scan(hdev);
6782
6783                 goto added;
6784         }
6785
6786         addr_type = le_addr_type(cp->addr.type);
6787
6788         if (cp->action == 0x02)
6789                 auto_conn = HCI_AUTO_CONN_ALWAYS;
6790         else if (cp->action == 0x01)
6791                 auto_conn = HCI_AUTO_CONN_DIRECT;
6792         else
6793                 auto_conn = HCI_AUTO_CONN_REPORT;
6794
6795         /* Kernel internally uses conn_params with resolvable private
6796          * address, but Add Device allows only identity addresses.
6797          * Make sure it is enforced before calling
6798          * hci_conn_params_lookup.
6799          */
6800         if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6801                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6802                                         MGMT_STATUS_INVALID_PARAMS,
6803                                         &cp->addr, sizeof(cp->addr));
6804                 goto unlock;
6805         }
6806
6807         /* If the connection parameters don't exist for this device,
6808          * they will be created and configured with defaults.
6809          */
6810         if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
6811                                 auto_conn) < 0) {
6812                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6813                                         MGMT_STATUS_FAILED, &cp->addr,
6814                                         sizeof(cp->addr));
6815                 goto unlock;
6816         } else {
6817                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6818                                                 addr_type);
6819                 if (params)
6820                         current_flags = params->current_flags;
6821         }
6822
6823         hci_update_background_scan(hdev);
6824
6825 added:
6826         device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6827         device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
6828                              SUPPORTED_DEVICE_FLAGS(), current_flags);
6829
6830         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6831                                 MGMT_STATUS_SUCCESS, &cp->addr,
6832                                 sizeof(cp->addr));
6833
6834 unlock:
6835         hci_dev_unlock(hdev);
6836         return err;
6837 }
6838
6839 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6840                            bdaddr_t *bdaddr, u8 type)
6841 {
6842         struct mgmt_ev_device_removed ev;
6843
6844         bacpy(&ev.addr.bdaddr, bdaddr);
6845         ev.addr.type = type;
6846
6847         mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6848 }
6849
6850 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6851                          void *data, u16 len)
6852 {
6853         struct mgmt_cp_remove_device *cp = data;
6854         int err;
6855
6856         bt_dev_dbg(hdev, "sock %p", sk);
6857
6858         hci_dev_lock(hdev);
6859
6860         if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6861                 struct hci_conn_params *params;
6862                 u8 addr_type;
6863
6864                 if (!bdaddr_type_is_valid(cp->addr.type)) {
6865                         err = mgmt_cmd_complete(sk, hdev->id,
6866                                                 MGMT_OP_REMOVE_DEVICE,
6867                                                 MGMT_STATUS_INVALID_PARAMS,
6868                                                 &cp->addr, sizeof(cp->addr));
6869                         goto unlock;
6870                 }
6871
6872                 if (cp->addr.type == BDADDR_BREDR) {
6873                         err = hci_bdaddr_list_del(&hdev->accept_list,
6874                                                   &cp->addr.bdaddr,
6875                                                   cp->addr.type);
6876                         if (err) {
6877                                 err = mgmt_cmd_complete(sk, hdev->id,
6878                                                         MGMT_OP_REMOVE_DEVICE,
6879                                                         MGMT_STATUS_INVALID_PARAMS,
6880                                                         &cp->addr,
6881                                                         sizeof(cp->addr));
6882                                 goto unlock;
6883                         }
6884
6885                         hci_req_update_scan(hdev);
6886
6887                         device_removed(sk, hdev, &cp->addr.bdaddr,
6888                                        cp->addr.type);
6889                         goto complete;
6890                 }
6891
6892                 addr_type = le_addr_type(cp->addr.type);
6893
6894                 /* Kernel internally uses conn_params with resolvable private
6895                  * address, but Remove Device allows only identity addresses.
6896                  * Make sure it is enforced before calling
6897                  * hci_conn_params_lookup.
6898                  */
6899                 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6900                         err = mgmt_cmd_complete(sk, hdev->id,
6901                                                 MGMT_OP_REMOVE_DEVICE,
6902                                                 MGMT_STATUS_INVALID_PARAMS,
6903                                                 &cp->addr, sizeof(cp->addr));
6904                         goto unlock;
6905                 }
6906
6907                 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6908                                                 addr_type);
6909                 if (!params) {
6910                         err = mgmt_cmd_complete(sk, hdev->id,
6911                                                 MGMT_OP_REMOVE_DEVICE,
6912                                                 MGMT_STATUS_INVALID_PARAMS,
6913                                                 &cp->addr, sizeof(cp->addr));
6914                         goto unlock;
6915                 }
6916
6917                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
6918                     params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
6919                         err = mgmt_cmd_complete(sk, hdev->id,
6920                                                 MGMT_OP_REMOVE_DEVICE,
6921                                                 MGMT_STATUS_INVALID_PARAMS,
6922                                                 &cp->addr, sizeof(cp->addr));
6923                         goto unlock;
6924                 }
6925
6926                 list_del(&params->action);
6927                 list_del(&params->list);
6928                 kfree(params);
6929                 hci_update_background_scan(hdev);
6930
6931                 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6932         } else {
6933                 struct hci_conn_params *p, *tmp;
6934                 struct bdaddr_list *b, *btmp;
6935
6936                 if (cp->addr.type) {
6937                         err = mgmt_cmd_complete(sk, hdev->id,
6938                                                 MGMT_OP_REMOVE_DEVICE,
6939                                                 MGMT_STATUS_INVALID_PARAMS,
6940                                                 &cp->addr, sizeof(cp->addr));
6941                         goto unlock;
6942                 }
6943
6944                 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
6945                         device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6946                         list_del(&b->list);
6947                         kfree(b);
6948                 }
6949
6950                 hci_req_update_scan(hdev);
6951
6952                 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6953                         if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6954                                 continue;
6955                         device_removed(sk, hdev, &p->addr, p->addr_type);
6956                         if (p->explicit_connect) {
6957                                 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
6958                                 continue;
6959                         }
6960                         list_del(&p->action);
6961                         list_del(&p->list);
6962                         kfree(p);
6963                 }
6964
6965                 bt_dev_dbg(hdev, "All LE connection parameters were removed");
6966
6967                 hci_update_background_scan(hdev);
6968         }
6969
6970 complete:
6971         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
6972                                 MGMT_STATUS_SUCCESS, &cp->addr,
6973                                 sizeof(cp->addr));
6974 unlock:
6975         hci_dev_unlock(hdev);
6976         return err;
6977 }
6978
6979 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6980                            u16 len)
6981 {
6982         struct mgmt_cp_load_conn_param *cp = data;
6983         const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6984                                      sizeof(struct mgmt_conn_param));
6985         u16 param_count, expected_len;
6986         int i;
6987
6988         if (!lmp_le_capable(hdev))
6989                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6990                                        MGMT_STATUS_NOT_SUPPORTED);
6991
6992         param_count = __le16_to_cpu(cp->param_count);
6993         if (param_count > max_param_count) {
6994                 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
6995                            param_count);
6996                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6997                                        MGMT_STATUS_INVALID_PARAMS);
6998         }
6999
7000         expected_len = struct_size(cp, params, param_count);
7001         if (expected_len != len) {
7002                 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
7003                            expected_len, len);
7004                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
7005                                        MGMT_STATUS_INVALID_PARAMS);
7006         }
7007
7008         bt_dev_dbg(hdev, "param_count %u", param_count);
7009
7010         hci_dev_lock(hdev);
7011
7012         hci_conn_params_clear_disabled(hdev);
7013
7014         for (i = 0; i < param_count; i++) {
7015                 struct mgmt_conn_param *param = &cp->params[i];
7016                 struct hci_conn_params *hci_param;
7017                 u16 min, max, latency, timeout;
7018                 u8 addr_type;
7019
7020                 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
7021                            param->addr.type);
7022
7023                 if (param->addr.type == BDADDR_LE_PUBLIC) {
7024                         addr_type = ADDR_LE_DEV_PUBLIC;
7025                 } else if (param->addr.type == BDADDR_LE_RANDOM) {
7026                         addr_type = ADDR_LE_DEV_RANDOM;
7027                 } else {
7028                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7029                         continue;
7030                 }
7031
7032                 min = le16_to_cpu(param->min_interval);
7033                 max = le16_to_cpu(param->max_interval);
7034                 latency = le16_to_cpu(param->latency);
7035                 timeout = le16_to_cpu(param->timeout);
7036
7037                 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
7038                            min, max, latency, timeout);
7039
7040                 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
7041                         bt_dev_err(hdev, "ignoring invalid connection parameters");
7042                         continue;
7043                 }
7044
7045                 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
7046                                                 addr_type);
7047                 if (!hci_param) {
7048                         bt_dev_err(hdev, "failed to add connection parameters");
7049                         continue;
7050                 }
7051
7052                 hci_param->conn_min_interval = min;
7053                 hci_param->conn_max_interval = max;
7054                 hci_param->conn_latency = latency;
7055                 hci_param->supervision_timeout = timeout;
7056         }
7057
7058         hci_dev_unlock(hdev);
7059
7060         return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
7061                                  NULL, 0);
7062 }
7063
7064 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
7065                                void *data, u16 len)
7066 {
7067         struct mgmt_cp_set_external_config *cp = data;
7068         bool changed;
7069         int err;
7070
7071         bt_dev_dbg(hdev, "sock %p", sk);
7072
7073         if (hdev_is_powered(hdev))
7074                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7075                                        MGMT_STATUS_REJECTED);
7076
7077         if (cp->config != 0x00 && cp->config != 0x01)
7078                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7079                                          MGMT_STATUS_INVALID_PARAMS);
7080
7081         if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
7082                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
7083                                        MGMT_STATUS_NOT_SUPPORTED);
7084
7085         hci_dev_lock(hdev);
7086
7087         if (cp->config)
7088                 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
7089         else
7090                 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
7091
7092         err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
7093         if (err < 0)
7094                 goto unlock;
7095
7096         if (!changed)
7097                 goto unlock;
7098
7099         err = new_options(hdev, sk);
7100
7101         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
7102                 mgmt_index_removed(hdev);
7103
7104                 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
7105                         hci_dev_set_flag(hdev, HCI_CONFIG);
7106                         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7107
7108                         queue_work(hdev->req_workqueue, &hdev->power_on);
7109                 } else {
7110                         set_bit(HCI_RAW, &hdev->flags);
7111                         mgmt_index_added(hdev);
7112                 }
7113         }
7114
7115 unlock:
7116         hci_dev_unlock(hdev);
7117         return err;
7118 }
7119
7120 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
7121                               void *data, u16 len)
7122 {
7123         struct mgmt_cp_set_public_address *cp = data;
7124         bool changed;
7125         int err;
7126
7127         bt_dev_dbg(hdev, "sock %p", sk);
7128
7129         if (hdev_is_powered(hdev))
7130                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7131                                        MGMT_STATUS_REJECTED);
7132
7133         if (!bacmp(&cp->bdaddr, BDADDR_ANY))
7134                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7135                                        MGMT_STATUS_INVALID_PARAMS);
7136
7137         if (!hdev->set_bdaddr)
7138                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
7139                                        MGMT_STATUS_NOT_SUPPORTED);
7140
7141         hci_dev_lock(hdev);
7142
7143         changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
7144         bacpy(&hdev->public_addr, &cp->bdaddr);
7145
7146         err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
7147         if (err < 0)
7148                 goto unlock;
7149
7150         if (!changed)
7151                 goto unlock;
7152
7153         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
7154                 err = new_options(hdev, sk);
7155
7156         if (is_configured(hdev)) {
7157                 mgmt_index_removed(hdev);
7158
7159                 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
7160
7161                 hci_dev_set_flag(hdev, HCI_CONFIG);
7162                 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
7163
7164                 queue_work(hdev->req_workqueue, &hdev->power_on);
7165         }
7166
7167 unlock:
7168         hci_dev_unlock(hdev);
7169         return err;
7170 }
7171
7172 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
7173                                              u16 opcode, struct sk_buff *skb)
7174 {
7175         const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
7176         struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
7177         u8 *h192, *r192, *h256, *r256;
7178         struct mgmt_pending_cmd *cmd;
7179         u16 eir_len;
7180         int err;
7181
7182         bt_dev_dbg(hdev, "status %u", status);
7183
7184         cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
7185         if (!cmd)
7186                 return;
7187
7188         mgmt_cp = cmd->param;
7189
7190         if (status) {
7191                 status = mgmt_status(status);
7192                 eir_len = 0;
7193
7194                 h192 = NULL;
7195                 r192 = NULL;
7196                 h256 = NULL;
7197                 r256 = NULL;
7198         } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
7199                 struct hci_rp_read_local_oob_data *rp;
7200
7201                 if (skb->len != sizeof(*rp)) {
7202                         status = MGMT_STATUS_FAILED;
7203                         eir_len = 0;
7204                 } else {
7205                         status = MGMT_STATUS_SUCCESS;
7206                         rp = (void *)skb->data;
7207
7208                         eir_len = 5 + 18 + 18;
7209                         h192 = rp->hash;
7210                         r192 = rp->rand;
7211                         h256 = NULL;
7212                         r256 = NULL;
7213                 }
7214         } else {
7215                 struct hci_rp_read_local_oob_ext_data *rp;
7216
7217                 if (skb->len != sizeof(*rp)) {
7218                         status = MGMT_STATUS_FAILED;
7219                         eir_len = 0;
7220                 } else {
7221                         status = MGMT_STATUS_SUCCESS;
7222                         rp = (void *)skb->data;
7223
7224                         if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
7225                                 eir_len = 5 + 18 + 18;
7226                                 h192 = NULL;
7227                                 r192 = NULL;
7228                         } else {
7229                                 eir_len = 5 + 18 + 18 + 18 + 18;
7230                                 h192 = rp->hash192;
7231                                 r192 = rp->rand192;
7232                         }
7233
7234                         h256 = rp->hash256;
7235                         r256 = rp->rand256;
7236                 }
7237         }
7238
7239         mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
7240         if (!mgmt_rp)
7241                 goto done;
7242
7243         if (eir_len == 0)
7244                 goto send_rsp;
7245
7246         eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
7247                                   hdev->dev_class, 3);
7248
7249         if (h192 && r192) {
7250                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7251                                           EIR_SSP_HASH_C192, h192, 16);
7252                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7253                                           EIR_SSP_RAND_R192, r192, 16);
7254         }
7255
7256         if (h256 && r256) {
7257                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7258                                           EIR_SSP_HASH_C256, h256, 16);
7259                 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7260                                           EIR_SSP_RAND_R256, r256, 16);
7261         }
7262
7263 send_rsp:
7264         mgmt_rp->type = mgmt_cp->type;
7265         mgmt_rp->eir_len = cpu_to_le16(eir_len);
7266
7267         err = mgmt_cmd_complete(cmd->sk, hdev->id,
7268                                 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
7269                                 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
7270         if (err < 0 || status)
7271                 goto done;
7272
7273         hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
7274
7275         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7276                                  mgmt_rp, sizeof(*mgmt_rp) + eir_len,
7277                                  HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
7278 done:
7279         kfree(mgmt_rp);
7280         mgmt_pending_remove(cmd);
7281 }
7282
7283 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
7284                                   struct mgmt_cp_read_local_oob_ext_data *cp)
7285 {
7286         struct mgmt_pending_cmd *cmd;
7287         struct hci_request req;
7288         int err;
7289
7290         cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
7291                                cp, sizeof(*cp));
7292         if (!cmd)
7293                 return -ENOMEM;
7294
7295         hci_req_init(&req, hdev);
7296
7297         if (bredr_sc_enabled(hdev))
7298                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
7299         else
7300                 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
7301
7302         err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
7303         if (err < 0) {
7304                 mgmt_pending_remove(cmd);
7305                 return err;
7306         }
7307
7308         return 0;
7309 }
7310
7311 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
7312                                    void *data, u16 data_len)
7313 {
7314         struct mgmt_cp_read_local_oob_ext_data *cp = data;
7315         struct mgmt_rp_read_local_oob_ext_data *rp;
7316         size_t rp_len;
7317         u16 eir_len;
7318         u8 status, flags, role, addr[7], hash[16], rand[16];
7319         int err;
7320
7321         bt_dev_dbg(hdev, "sock %p", sk);
7322
7323         if (hdev_is_powered(hdev)) {
7324                 switch (cp->type) {
7325                 case BIT(BDADDR_BREDR):
7326                         status = mgmt_bredr_support(hdev);
7327                         if (status)
7328                                 eir_len = 0;
7329                         else
7330                                 eir_len = 5;
7331                         break;
7332                 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7333                         status = mgmt_le_support(hdev);
7334                         if (status)
7335                                 eir_len = 0;
7336                         else
7337                                 eir_len = 9 + 3 + 18 + 18 + 3;
7338                         break;
7339                 default:
7340                         status = MGMT_STATUS_INVALID_PARAMS;
7341                         eir_len = 0;
7342                         break;
7343                 }
7344         } else {
7345                 status = MGMT_STATUS_NOT_POWERED;
7346                 eir_len = 0;
7347         }
7348
7349         rp_len = sizeof(*rp) + eir_len;
7350         rp = kmalloc(rp_len, GFP_ATOMIC);
7351         if (!rp)
7352                 return -ENOMEM;
7353
7354         if (status)
7355                 goto complete;
7356
7357         hci_dev_lock(hdev);
7358
7359         eir_len = 0;
7360         switch (cp->type) {
7361         case BIT(BDADDR_BREDR):
7362                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7363                         err = read_local_ssp_oob_req(hdev, sk, cp);
7364                         hci_dev_unlock(hdev);
7365                         if (!err)
7366                                 goto done;
7367
7368                         status = MGMT_STATUS_FAILED;
7369                         goto complete;
7370                 } else {
7371                         eir_len = eir_append_data(rp->eir, eir_len,
7372                                                   EIR_CLASS_OF_DEV,
7373                                                   hdev->dev_class, 3);
7374                 }
7375                 break;
7376         case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7377                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7378                     smp_generate_oob(hdev, hash, rand) < 0) {
7379                         hci_dev_unlock(hdev);
7380                         status = MGMT_STATUS_FAILED;
7381                         goto complete;
7382                 }
7383
7384                 /* This should return the active RPA, but since the RPA
7385                  * is only programmed on demand, it is really hard to fill
7386                  * this in at the moment. For now disallow retrieving
7387                  * local out-of-band data when privacy is in use.
7388                  *
7389                  * Returning the identity address will not help here since
7390                  * pairing happens before the identity resolving key is
7391                  * known and thus the connection establishment happens
7392                  * based on the RPA and not the identity address.
7393                  */
7394                 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
7395                         hci_dev_unlock(hdev);
7396                         status = MGMT_STATUS_REJECTED;
7397                         goto complete;
7398                 }
7399
7400                 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
7401                    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
7402                    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7403                     bacmp(&hdev->static_addr, BDADDR_ANY))) {
7404                         memcpy(addr, &hdev->static_addr, 6);
7405                         addr[6] = 0x01;
7406                 } else {
7407                         memcpy(addr, &hdev->bdaddr, 6);
7408                         addr[6] = 0x00;
7409                 }
7410
7411                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
7412                                           addr, sizeof(addr));
7413
7414                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7415                         role = 0x02;
7416                 else
7417                         role = 0x01;
7418
7419                 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
7420                                           &role, sizeof(role));
7421
7422                 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
7423                         eir_len = eir_append_data(rp->eir, eir_len,
7424                                                   EIR_LE_SC_CONFIRM,
7425                                                   hash, sizeof(hash));
7426
7427                         eir_len = eir_append_data(rp->eir, eir_len,
7428                                                   EIR_LE_SC_RANDOM,
7429                                                   rand, sizeof(rand));
7430                 }
7431
7432                 flags = mgmt_get_adv_discov_flags(hdev);
7433
7434                 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
7435                         flags |= LE_AD_NO_BREDR;
7436
7437                 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
7438                                           &flags, sizeof(flags));
7439                 break;
7440         }
7441
7442         hci_dev_unlock(hdev);
7443
7444         hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
7445
7446         status = MGMT_STATUS_SUCCESS;
7447
7448 complete:
7449         rp->type = cp->type;
7450         rp->eir_len = cpu_to_le16(eir_len);
7451
7452         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
7453                                 status, rp, sizeof(*rp) + eir_len);
7454         if (err < 0 || status)
7455                 goto done;
7456
7457         err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7458                                  rp, sizeof(*rp) + eir_len,
7459                                  HCI_MGMT_OOB_DATA_EVENTS, sk);
7460
7461 done:
7462         kfree(rp);
7463
7464         return err;
7465 }
7466
7467 static u32 get_supported_adv_flags(struct hci_dev *hdev)
7468 {
7469         u32 flags = 0;
7470
7471         flags |= MGMT_ADV_FLAG_CONNECTABLE;
7472         flags |= MGMT_ADV_FLAG_DISCOV;
7473         flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
7474         flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
7475         flags |= MGMT_ADV_FLAG_APPEARANCE;
7476         flags |= MGMT_ADV_FLAG_LOCAL_NAME;
7477         flags |= MGMT_ADV_PARAM_DURATION;
7478         flags |= MGMT_ADV_PARAM_TIMEOUT;
7479         flags |= MGMT_ADV_PARAM_INTERVALS;
7480         flags |= MGMT_ADV_PARAM_TX_POWER;
7481         flags |= MGMT_ADV_PARAM_SCAN_RSP;
7482
7483         /* In extended adv TX_POWER returned from Set Adv Param
7484          * will be always valid.
7485          */
7486         if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
7487             ext_adv_capable(hdev))
7488                 flags |= MGMT_ADV_FLAG_TX_POWER;
7489
7490         if (ext_adv_capable(hdev)) {
7491                 flags |= MGMT_ADV_FLAG_SEC_1M;
7492                 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
7493                 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
7494
7495                 if (hdev->le_features[1] & HCI_LE_PHY_2M)
7496                         flags |= MGMT_ADV_FLAG_SEC_2M;
7497
7498                 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
7499                         flags |= MGMT_ADV_FLAG_SEC_CODED;
7500         }
7501
7502         return flags;
7503 }
7504
7505 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
7506                              void *data, u16 data_len)
7507 {
7508         struct mgmt_rp_read_adv_features *rp;
7509         size_t rp_len;
7510         int err;
7511         struct adv_info *adv_instance;
7512         u32 supported_flags;
7513         u8 *instance;
7514
7515         bt_dev_dbg(hdev, "sock %p", sk);
7516
7517         if (!lmp_le_capable(hdev))
7518                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7519                                        MGMT_STATUS_REJECTED);
7520
7521         /* Enabling the experimental LL Privay support disables support for
7522          * advertising.
7523          */
7524         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7525                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7526                                        MGMT_STATUS_NOT_SUPPORTED);
7527
7528         hci_dev_lock(hdev);
7529
7530         rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
7531         rp = kmalloc(rp_len, GFP_ATOMIC);
7532         if (!rp) {
7533                 hci_dev_unlock(hdev);
7534                 return -ENOMEM;
7535         }
7536
7537         supported_flags = get_supported_adv_flags(hdev);
7538
7539         rp->supported_flags = cpu_to_le32(supported_flags);
7540         rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
7541         rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
7542         rp->max_instances = hdev->le_num_of_adv_sets;
7543         rp->num_instances = hdev->adv_instance_cnt;
7544
7545         instance = rp->instance;
7546         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
7547                 *instance = adv_instance->instance;
7548                 instance++;
7549         }
7550
7551         hci_dev_unlock(hdev);
7552
7553         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7554                                 MGMT_STATUS_SUCCESS, rp, rp_len);
7555
7556         kfree(rp);
7557
7558         return err;
7559 }
7560
7561 static u8 calculate_name_len(struct hci_dev *hdev)
7562 {
7563         u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
7564
7565         return append_local_name(hdev, buf, 0);
7566 }
7567
7568 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
7569                            bool is_adv_data)
7570 {
7571         u8 max_len = HCI_MAX_AD_LENGTH;
7572
7573         if (is_adv_data) {
7574                 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
7575                                  MGMT_ADV_FLAG_LIMITED_DISCOV |
7576                                  MGMT_ADV_FLAG_MANAGED_FLAGS))
7577                         max_len -= 3;
7578
7579                 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
7580                         max_len -= 3;
7581         } else {
7582                 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
7583                         max_len -= calculate_name_len(hdev);
7584
7585                 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
7586                         max_len -= 4;
7587         }
7588
7589         return max_len;
7590 }
7591
7592 static bool flags_managed(u32 adv_flags)
7593 {
7594         return adv_flags & (MGMT_ADV_FLAG_DISCOV |
7595                             MGMT_ADV_FLAG_LIMITED_DISCOV |
7596                             MGMT_ADV_FLAG_MANAGED_FLAGS);
7597 }
7598
7599 static bool tx_power_managed(u32 adv_flags)
7600 {
7601         return adv_flags & MGMT_ADV_FLAG_TX_POWER;
7602 }
7603
7604 static bool name_managed(u32 adv_flags)
7605 {
7606         return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
7607 }
7608
7609 static bool appearance_managed(u32 adv_flags)
7610 {
7611         return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
7612 }
7613
7614 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
7615                               u8 len, bool is_adv_data)
7616 {
7617         int i, cur_len;
7618         u8 max_len;
7619
7620         max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
7621
7622         if (len > max_len)
7623                 return false;
7624
7625         /* Make sure that the data is correctly formatted. */
7626         for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7627                 cur_len = data[i];
7628
7629                 if (!cur_len)
7630                         continue;
7631
7632                 if (data[i + 1] == EIR_FLAGS &&
7633                     (!is_adv_data || flags_managed(adv_flags)))
7634                         return false;
7635
7636                 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
7637                         return false;
7638
7639                 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
7640                         return false;
7641
7642                 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
7643                         return false;
7644
7645                 if (data[i + 1] == EIR_APPEARANCE &&
7646                     appearance_managed(adv_flags))
7647                         return false;
7648
7649                 /* If the current field length would exceed the total data
7650                  * length, then it's invalid.
7651                  */
7652                 if (i + cur_len >= len)
7653                         return false;
7654         }
7655
7656         return true;
7657 }
7658
7659 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
7660 {
7661         u32 supported_flags, phy_flags;
7662
7663         /* The current implementation only supports a subset of the specified
7664          * flags. Also need to check mutual exclusiveness of sec flags.
7665          */
7666         supported_flags = get_supported_adv_flags(hdev);
7667         phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
7668         if (adv_flags & ~supported_flags ||
7669             ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
7670                 return false;
7671
7672         return true;
7673 }
7674
7675 static bool adv_busy(struct hci_dev *hdev)
7676 {
7677         return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7678                 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7679                 pending_find(MGMT_OP_SET_LE, hdev) ||
7680                 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
7681                 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
7682 }
7683
7684 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7685                                      u16 opcode)
7686 {
7687         struct mgmt_pending_cmd *cmd;
7688         struct mgmt_cp_add_advertising *cp;
7689         struct mgmt_rp_add_advertising rp;
7690         struct adv_info *adv_instance, *n;
7691         u8 instance;
7692
7693         bt_dev_dbg(hdev, "status %u", status);
7694
7695         hci_dev_lock(hdev);
7696
7697         cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7698         if (!cmd)
7699                 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
7700
7701         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7702                 if (!adv_instance->pending)
7703                         continue;
7704
7705                 if (!status) {
7706                         adv_instance->pending = false;
7707                         continue;
7708                 }
7709
7710                 instance = adv_instance->instance;
7711
7712                 if (hdev->cur_adv_instance == instance)
7713                         cancel_adv_timeout(hdev);
7714
7715                 hci_remove_adv_instance(hdev, instance);
7716                 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
7717         }
7718
7719         if (!cmd)
7720                 goto unlock;
7721
7722         cp = cmd->param;
7723         rp.instance = cp->instance;
7724
7725         if (status)
7726                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7727                                 mgmt_status(status));
7728         else
7729                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7730                                   mgmt_status(status), &rp, sizeof(rp));
7731
7732         mgmt_pending_remove(cmd);
7733
7734 unlock:
7735         hci_dev_unlock(hdev);
7736 }
7737
7738 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7739                            void *data, u16 data_len)
7740 {
7741         struct mgmt_cp_add_advertising *cp = data;
7742         struct mgmt_rp_add_advertising rp;
7743         u32 flags;
7744         u8 status;
7745         u16 timeout, duration;
7746         unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
7747         u8 schedule_instance = 0;
7748         struct adv_info *next_instance;
7749         int err;
7750         struct mgmt_pending_cmd *cmd;
7751         struct hci_request req;
7752
7753         bt_dev_dbg(hdev, "sock %p", sk);
7754
7755         status = mgmt_le_support(hdev);
7756         if (status)
7757                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7758                                        status);
7759
7760         /* Enabling the experimental LL Privay support disables support for
7761          * advertising.
7762          */
7763         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7764                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7765                                        MGMT_STATUS_NOT_SUPPORTED);
7766
7767         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7768                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7769                                        MGMT_STATUS_INVALID_PARAMS);
7770
7771         if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
7772                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7773                                        MGMT_STATUS_INVALID_PARAMS);
7774
7775         flags = __le32_to_cpu(cp->flags);
7776         timeout = __le16_to_cpu(cp->timeout);
7777         duration = __le16_to_cpu(cp->duration);
7778
7779         if (!requested_adv_flags_are_valid(hdev, flags))
7780                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7781                                        MGMT_STATUS_INVALID_PARAMS);
7782
7783         hci_dev_lock(hdev);
7784
7785         if (timeout && !hdev_is_powered(hdev)) {
7786                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7787                                       MGMT_STATUS_REJECTED);
7788                 goto unlock;
7789         }
7790
7791         if (adv_busy(hdev)) {
7792                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7793                                       MGMT_STATUS_BUSY);
7794                 goto unlock;
7795         }
7796
7797         if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
7798             !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
7799                                cp->scan_rsp_len, false)) {
7800                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7801                                       MGMT_STATUS_INVALID_PARAMS);
7802                 goto unlock;
7803         }
7804
7805         err = hci_add_adv_instance(hdev, cp->instance, flags,
7806                                    cp->adv_data_len, cp->data,
7807                                    cp->scan_rsp_len,
7808                                    cp->data + cp->adv_data_len,
7809                                    timeout, duration,
7810                                    HCI_ADV_TX_POWER_NO_PREFERENCE,
7811                                    hdev->le_adv_min_interval,
7812                                    hdev->le_adv_max_interval);
7813         if (err < 0) {
7814                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7815                                       MGMT_STATUS_FAILED);
7816                 goto unlock;
7817         }
7818
7819         /* Only trigger an advertising added event if a new instance was
7820          * actually added.
7821          */
7822         if (hdev->adv_instance_cnt > prev_instance_cnt)
7823                 mgmt_advertising_added(sk, hdev, cp->instance);
7824
7825         if (hdev->cur_adv_instance == cp->instance) {
7826                 /* If the currently advertised instance is being changed then
7827                  * cancel the current advertising and schedule the next
7828                  * instance. If there is only one instance then the overridden
7829                  * advertising data will be visible right away.
7830                  */
7831                 cancel_adv_timeout(hdev);
7832
7833                 next_instance = hci_get_next_instance(hdev, cp->instance);
7834                 if (next_instance)
7835                         schedule_instance = next_instance->instance;
7836         } else if (!hdev->adv_instance_timeout) {
7837                 /* Immediately advertise the new instance if no other
7838                  * instance is currently being advertised.
7839                  */
7840                 schedule_instance = cp->instance;
7841         }
7842
7843         /* If the HCI_ADVERTISING flag is set or the device isn't powered or
7844          * there is no instance to be advertised then we have no HCI
7845          * communication to make. Simply return.
7846          */
7847         if (!hdev_is_powered(hdev) ||
7848             hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7849             !schedule_instance) {
7850                 rp.instance = cp->instance;
7851                 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7852                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7853                 goto unlock;
7854         }
7855
7856         /* We're good to go, update advertising data, parameters, and start
7857          * advertising.
7858          */
7859         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7860                                data_len);
7861         if (!cmd) {
7862                 err = -ENOMEM;
7863                 goto unlock;
7864         }
7865
7866         hci_req_init(&req, hdev);
7867
7868         err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
7869
7870         if (!err)
7871                 err = hci_req_run(&req, add_advertising_complete);
7872
7873         if (err < 0) {
7874                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7875                                       MGMT_STATUS_FAILED);
7876                 mgmt_pending_remove(cmd);
7877         }
7878
7879 unlock:
7880         hci_dev_unlock(hdev);
7881
7882         return err;
7883 }
7884
7885 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
7886                                         u16 opcode)
7887 {
7888         struct mgmt_pending_cmd *cmd;
7889         struct mgmt_cp_add_ext_adv_params *cp;
7890         struct mgmt_rp_add_ext_adv_params rp;
7891         struct adv_info *adv_instance;
7892         u32 flags;
7893
7894         BT_DBG("%s", hdev->name);
7895
7896         hci_dev_lock(hdev);
7897
7898         cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
7899         if (!cmd)
7900                 goto unlock;
7901
7902         cp = cmd->param;
7903         adv_instance = hci_find_adv_instance(hdev, cp->instance);
7904         if (!adv_instance)
7905                 goto unlock;
7906
7907         rp.instance = cp->instance;
7908         rp.tx_power = adv_instance->tx_power;
7909
7910         /* While we're at it, inform userspace of the available space for this
7911          * advertisement, given the flags that will be used.
7912          */
7913         flags = __le32_to_cpu(cp->flags);
7914         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
7915         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
7916
7917         if (status) {
7918                 /* If this advertisement was previously advertising and we
7919                  * failed to update it, we signal that it has been removed and
7920                  * delete its structure
7921                  */
7922                 if (!adv_instance->pending)
7923                         mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
7924
7925                 hci_remove_adv_instance(hdev, cp->instance);
7926
7927                 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7928                                 mgmt_status(status));
7929
7930         } else {
7931                 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7932                                   mgmt_status(status), &rp, sizeof(rp));
7933         }
7934
7935 unlock:
7936         if (cmd)
7937                 mgmt_pending_remove(cmd);
7938
7939         hci_dev_unlock(hdev);
7940 }
7941
7942 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
7943                               void *data, u16 data_len)
7944 {
7945         struct mgmt_cp_add_ext_adv_params *cp = data;
7946         struct mgmt_rp_add_ext_adv_params rp;
7947         struct mgmt_pending_cmd *cmd = NULL;
7948         struct adv_info *adv_instance;
7949         struct hci_request req;
7950         u32 flags, min_interval, max_interval;
7951         u16 timeout, duration;
7952         u8 status;
7953         s8 tx_power;
7954         int err;
7955
7956         BT_DBG("%s", hdev->name);
7957
7958         status = mgmt_le_support(hdev);
7959         if (status)
7960                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7961                                        status);
7962
7963         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7964                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7965                                        MGMT_STATUS_INVALID_PARAMS);
7966
7967         /* The purpose of breaking add_advertising into two separate MGMT calls
7968          * for params and data is to allow more parameters to be added to this
7969          * structure in the future. For this reason, we verify that we have the
7970          * bare minimum structure we know of when the interface was defined. Any
7971          * extra parameters we don't know about will be ignored in this request.
7972          */
7973         if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
7974                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7975                                        MGMT_STATUS_INVALID_PARAMS);
7976
7977         flags = __le32_to_cpu(cp->flags);
7978
7979         if (!requested_adv_flags_are_valid(hdev, flags))
7980                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7981                                        MGMT_STATUS_INVALID_PARAMS);
7982
7983         hci_dev_lock(hdev);
7984
7985         /* In new interface, we require that we are powered to register */
7986         if (!hdev_is_powered(hdev)) {
7987                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7988                                       MGMT_STATUS_REJECTED);
7989                 goto unlock;
7990         }
7991
7992         if (adv_busy(hdev)) {
7993                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7994                                       MGMT_STATUS_BUSY);
7995                 goto unlock;
7996         }
7997
7998         /* Parse defined parameters from request, use defaults otherwise */
7999         timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
8000                   __le16_to_cpu(cp->timeout) : 0;
8001
8002         duration = (flags & MGMT_ADV_PARAM_DURATION) ?
8003                    __le16_to_cpu(cp->duration) :
8004                    hdev->def_multi_adv_rotation_duration;
8005
8006         min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8007                        __le32_to_cpu(cp->min_interval) :
8008                        hdev->le_adv_min_interval;
8009
8010         max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
8011                        __le32_to_cpu(cp->max_interval) :
8012                        hdev->le_adv_max_interval;
8013
8014         tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
8015                    cp->tx_power :
8016                    HCI_ADV_TX_POWER_NO_PREFERENCE;
8017
8018         /* Create advertising instance with no advertising or response data */
8019         err = hci_add_adv_instance(hdev, cp->instance, flags,
8020                                    0, NULL, 0, NULL, timeout, duration,
8021                                    tx_power, min_interval, max_interval);
8022
8023         if (err < 0) {
8024                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
8025                                       MGMT_STATUS_FAILED);
8026                 goto unlock;
8027         }
8028
8029         /* Submit request for advertising params if ext adv available */
8030         if (ext_adv_capable(hdev)) {
8031                 hci_req_init(&req, hdev);
8032                 adv_instance = hci_find_adv_instance(hdev, cp->instance);
8033
8034                 /* Updating parameters of an active instance will return a
8035                  * Command Disallowed error, so we must first disable the
8036                  * instance if it is active.
8037                  */
8038                 if (!adv_instance->pending)
8039                         __hci_req_disable_ext_adv_instance(&req, cp->instance);
8040
8041                 __hci_req_setup_ext_adv_instance(&req, cp->instance);
8042
8043                 err = hci_req_run(&req, add_ext_adv_params_complete);
8044
8045                 if (!err)
8046                         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
8047                                                hdev, data, data_len);
8048                 if (!cmd) {
8049                         err = -ENOMEM;
8050                         hci_remove_adv_instance(hdev, cp->instance);
8051                         goto unlock;
8052                 }
8053
8054         } else {
8055                 rp.instance = cp->instance;
8056                 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
8057                 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8058                 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8059                 err = mgmt_cmd_complete(sk, hdev->id,
8060                                         MGMT_OP_ADD_EXT_ADV_PARAMS,
8061                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8062         }
8063
8064 unlock:
8065         hci_dev_unlock(hdev);
8066
8067         return err;
8068 }
8069
8070 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
8071                             u16 data_len)
8072 {
8073         struct mgmt_cp_add_ext_adv_data *cp = data;
8074         struct mgmt_rp_add_ext_adv_data rp;
8075         u8 schedule_instance = 0;
8076         struct adv_info *next_instance;
8077         struct adv_info *adv_instance;
8078         int err = 0;
8079         struct mgmt_pending_cmd *cmd;
8080         struct hci_request req;
8081
8082         BT_DBG("%s", hdev->name);
8083
8084         hci_dev_lock(hdev);
8085
8086         adv_instance = hci_find_adv_instance(hdev, cp->instance);
8087
8088         if (!adv_instance) {
8089                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8090                                       MGMT_STATUS_INVALID_PARAMS);
8091                 goto unlock;
8092         }
8093
8094         /* In new interface, we require that we are powered to register */
8095         if (!hdev_is_powered(hdev)) {
8096                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8097                                       MGMT_STATUS_REJECTED);
8098                 goto clear_new_instance;
8099         }
8100
8101         if (adv_busy(hdev)) {
8102                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8103                                       MGMT_STATUS_BUSY);
8104                 goto clear_new_instance;
8105         }
8106
8107         /* Validate new data */
8108         if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
8109                                cp->adv_data_len, true) ||
8110             !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
8111                                cp->adv_data_len, cp->scan_rsp_len, false)) {
8112                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8113                                       MGMT_STATUS_INVALID_PARAMS);
8114                 goto clear_new_instance;
8115         }
8116
8117         /* Set the data in the advertising instance */
8118         hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
8119                                   cp->data, cp->scan_rsp_len,
8120                                   cp->data + cp->adv_data_len);
8121
8122         /* We're good to go, update advertising data, parameters, and start
8123          * advertising.
8124          */
8125
8126         hci_req_init(&req, hdev);
8127
8128         hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
8129
8130         if (ext_adv_capable(hdev)) {
8131                 __hci_req_update_adv_data(&req, cp->instance);
8132                 __hci_req_update_scan_rsp_data(&req, cp->instance);
8133                 __hci_req_enable_ext_advertising(&req, cp->instance);
8134
8135         } else {
8136                 /* If using software rotation, determine next instance to use */
8137
8138                 if (hdev->cur_adv_instance == cp->instance) {
8139                         /* If the currently advertised instance is being changed
8140                          * then cancel the current advertising and schedule the
8141                          * next instance. If there is only one instance then the
8142                          * overridden advertising data will be visible right
8143                          * away
8144                          */
8145                         cancel_adv_timeout(hdev);
8146
8147                         next_instance = hci_get_next_instance(hdev,
8148                                                               cp->instance);
8149                         if (next_instance)
8150                                 schedule_instance = next_instance->instance;
8151                 } else if (!hdev->adv_instance_timeout) {
8152                         /* Immediately advertise the new instance if no other
8153                          * instance is currently being advertised.
8154                          */
8155                         schedule_instance = cp->instance;
8156                 }
8157
8158                 /* If the HCI_ADVERTISING flag is set or there is no instance to
8159                  * be advertised then we have no HCI communication to make.
8160                  * Simply return.
8161                  */
8162                 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
8163                     !schedule_instance) {
8164                         if (adv_instance->pending) {
8165                                 mgmt_advertising_added(sk, hdev, cp->instance);
8166                                 adv_instance->pending = false;
8167                         }
8168                         rp.instance = cp->instance;
8169                         err = mgmt_cmd_complete(sk, hdev->id,
8170                                                 MGMT_OP_ADD_EXT_ADV_DATA,
8171                                                 MGMT_STATUS_SUCCESS, &rp,
8172                                                 sizeof(rp));
8173                         goto unlock;
8174                 }
8175
8176                 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
8177                                                       true);
8178         }
8179
8180         cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
8181                                data_len);
8182         if (!cmd) {
8183                 err = -ENOMEM;
8184                 goto clear_new_instance;
8185         }
8186
8187         if (!err)
8188                 err = hci_req_run(&req, add_advertising_complete);
8189
8190         if (err < 0) {
8191                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
8192                                       MGMT_STATUS_FAILED);
8193                 mgmt_pending_remove(cmd);
8194                 goto clear_new_instance;
8195         }
8196
8197         /* We were successful in updating data, so trigger advertising_added
8198          * event if this is an instance that wasn't previously advertising. If
8199          * a failure occurs in the requests we initiated, we will remove the
8200          * instance again in add_advertising_complete
8201          */
8202         if (adv_instance->pending)
8203                 mgmt_advertising_added(sk, hdev, cp->instance);
8204
8205         goto unlock;
8206
8207 clear_new_instance:
8208         hci_remove_adv_instance(hdev, cp->instance);
8209
8210 unlock:
8211         hci_dev_unlock(hdev);
8212
8213         return err;
8214 }
8215
8216 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
8217                                         u16 opcode)
8218 {
8219         struct mgmt_pending_cmd *cmd;
8220         struct mgmt_cp_remove_advertising *cp;
8221         struct mgmt_rp_remove_advertising rp;
8222
8223         bt_dev_dbg(hdev, "status %u", status);
8224
8225         hci_dev_lock(hdev);
8226
8227         /* A failure status here only means that we failed to disable
8228          * advertising. Otherwise, the advertising instance has been removed,
8229          * so report success.
8230          */
8231         cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
8232         if (!cmd)
8233                 goto unlock;
8234
8235         cp = cmd->param;
8236         rp.instance = cp->instance;
8237
8238         mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
8239                           &rp, sizeof(rp));
8240         mgmt_pending_remove(cmd);
8241
8242 unlock:
8243         hci_dev_unlock(hdev);
8244 }
8245
8246 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
8247                               void *data, u16 data_len)
8248 {
8249         struct mgmt_cp_remove_advertising *cp = data;
8250         struct mgmt_rp_remove_advertising rp;
8251         struct mgmt_pending_cmd *cmd;
8252         struct hci_request req;
8253         int err;
8254
8255         bt_dev_dbg(hdev, "sock %p", sk);
8256
8257         /* Enabling the experimental LL Privay support disables support for
8258          * advertising.
8259          */
8260         if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
8261                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
8262                                        MGMT_STATUS_NOT_SUPPORTED);
8263
8264         hci_dev_lock(hdev);
8265
8266         if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
8267                 err = mgmt_cmd_status(sk, hdev->id,
8268                                       MGMT_OP_REMOVE_ADVERTISING,
8269                                       MGMT_STATUS_INVALID_PARAMS);
8270                 goto unlock;
8271         }
8272
8273         if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
8274             pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
8275             pending_find(MGMT_OP_SET_LE, hdev)) {
8276                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8277                                       MGMT_STATUS_BUSY);
8278                 goto unlock;
8279         }
8280
8281         if (list_empty(&hdev->adv_instances)) {
8282                 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8283                                       MGMT_STATUS_INVALID_PARAMS);
8284                 goto unlock;
8285         }
8286
8287         hci_req_init(&req, hdev);
8288
8289         /* If we use extended advertising, instance is disabled and removed */
8290         if (ext_adv_capable(hdev)) {
8291                 __hci_req_disable_ext_adv_instance(&req, cp->instance);
8292                 __hci_req_remove_ext_adv_instance(&req, cp->instance);
8293         }
8294
8295         hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
8296
8297         if (list_empty(&hdev->adv_instances))
8298                 __hci_req_disable_advertising(&req);
8299
8300         /* If no HCI commands have been collected so far or the HCI_ADVERTISING
8301          * flag is set or the device isn't powered then we have no HCI
8302          * communication to make. Simply return.
8303          */
8304         if (skb_queue_empty(&req.cmd_q) ||
8305             !hdev_is_powered(hdev) ||
8306             hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
8307                 hci_req_purge(&req);
8308                 rp.instance = cp->instance;
8309                 err = mgmt_cmd_complete(sk, hdev->id,
8310                                         MGMT_OP_REMOVE_ADVERTISING,
8311                                         MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8312                 goto unlock;
8313         }
8314
8315         cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
8316                                data_len);
8317         if (!cmd) {
8318                 err = -ENOMEM;
8319                 goto unlock;
8320         }
8321
8322         err = hci_req_run(&req, remove_advertising_complete);
8323         if (err < 0)
8324                 mgmt_pending_remove(cmd);
8325
8326 unlock:
8327         hci_dev_unlock(hdev);
8328
8329         return err;
8330 }
8331
8332 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
8333                              void *data, u16 data_len)
8334 {
8335         struct mgmt_cp_get_adv_size_info *cp = data;
8336         struct mgmt_rp_get_adv_size_info rp;
8337         u32 flags, supported_flags;
8338         int err;
8339
8340         bt_dev_dbg(hdev, "sock %p", sk);
8341
8342         if (!lmp_le_capable(hdev))
8343                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8344                                        MGMT_STATUS_REJECTED);
8345
8346         if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8347                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8348                                        MGMT_STATUS_INVALID_PARAMS);
8349
8350         flags = __le32_to_cpu(cp->flags);
8351
8352         /* The current implementation only supports a subset of the specified
8353          * flags.
8354          */
8355         supported_flags = get_supported_adv_flags(hdev);
8356         if (flags & ~supported_flags)
8357                 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8358                                        MGMT_STATUS_INVALID_PARAMS);
8359
8360         rp.instance = cp->instance;
8361         rp.flags = cp->flags;
8362         rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8363         rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8364
8365         err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8366                                 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8367
8368         return err;
8369 }
8370
8371 static const struct hci_mgmt_handler mgmt_handlers[] = {
8372         { NULL }, /* 0x0000 (no command) */
8373         { read_version,            MGMT_READ_VERSION_SIZE,
8374                                                 HCI_MGMT_NO_HDEV |
8375                                                 HCI_MGMT_UNTRUSTED },
8376         { read_commands,           MGMT_READ_COMMANDS_SIZE,
8377                                                 HCI_MGMT_NO_HDEV |
8378                                                 HCI_MGMT_UNTRUSTED },
8379         { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
8380                                                 HCI_MGMT_NO_HDEV |
8381                                                 HCI_MGMT_UNTRUSTED },
8382         { read_controller_info,    MGMT_READ_INFO_SIZE,
8383                                                 HCI_MGMT_UNTRUSTED },
8384         { set_powered,             MGMT_SETTING_SIZE },
8385         { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
8386         { set_connectable,         MGMT_SETTING_SIZE },
8387         { set_fast_connectable,    MGMT_SETTING_SIZE },
8388         { set_bondable,            MGMT_SETTING_SIZE },
8389         { set_link_security,       MGMT_SETTING_SIZE },
8390         { set_ssp,                 MGMT_SETTING_SIZE },
8391         { set_hs,                  MGMT_SETTING_SIZE },
8392         { set_le,                  MGMT_SETTING_SIZE },
8393         { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
8394         { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
8395         { add_uuid,                MGMT_ADD_UUID_SIZE },
8396         { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
8397         { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
8398                                                 HCI_MGMT_VAR_LEN },
8399         { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
8400                                                 HCI_MGMT_VAR_LEN },
8401         { disconnect,              MGMT_DISCONNECT_SIZE },
8402         { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
8403         { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
8404         { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
8405         { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
8406         { pair_device,             MGMT_PAIR_DEVICE_SIZE },
8407         { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
8408         { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
8409         { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
8410         { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
8411         { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
8412         { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
8413         { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
8414         { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
8415                                                 HCI_MGMT_VAR_LEN },
8416         { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
8417         { start_discovery,         MGMT_START_DISCOVERY_SIZE },
8418         { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
8419         { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
8420         { block_device,            MGMT_BLOCK_DEVICE_SIZE },
8421         { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
8422         { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
8423         { set_advertising,         MGMT_SETTING_SIZE },
8424         { set_bredr,               MGMT_SETTING_SIZE },
8425         { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
8426         { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
8427         { set_secure_conn,         MGMT_SETTING_SIZE },
8428         { set_debug_keys,          MGMT_SETTING_SIZE },
8429         { set_privacy,             MGMT_SET_PRIVACY_SIZE },
8430         { load_irks,               MGMT_LOAD_IRKS_SIZE,
8431                                                 HCI_MGMT_VAR_LEN },
8432         { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
8433         { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
8434         { add_device,              MGMT_ADD_DEVICE_SIZE },
8435         { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
8436         { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
8437                                                 HCI_MGMT_VAR_LEN },
8438         { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
8439                                                 HCI_MGMT_NO_HDEV |
8440                                                 HCI_MGMT_UNTRUSTED },
8441         { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
8442                                                 HCI_MGMT_UNCONFIGURED |
8443                                                 HCI_MGMT_UNTRUSTED },
8444         { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
8445                                                 HCI_MGMT_UNCONFIGURED },
8446         { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
8447                                                 HCI_MGMT_UNCONFIGURED },
8448         { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
8449                                                 HCI_MGMT_VAR_LEN },
8450         { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
8451         { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
8452                                                 HCI_MGMT_NO_HDEV |
8453                                                 HCI_MGMT_UNTRUSTED },
8454         { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
8455         { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
8456                                                 HCI_MGMT_VAR_LEN },
8457         { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
8458         { get_adv_size_info,       MGMT_GET_ADV_SIZE_INFO_SIZE },
8459         { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
8460         { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
8461                                                 HCI_MGMT_UNTRUSTED },
8462         { set_appearance,          MGMT_SET_APPEARANCE_SIZE },
8463         { get_phy_configuration,   MGMT_GET_PHY_CONFIGURATION_SIZE },
8464         { set_phy_configuration,   MGMT_SET_PHY_CONFIGURATION_SIZE },
8465         { set_blocked_keys,        MGMT_OP_SET_BLOCKED_KEYS_SIZE,
8466                                                 HCI_MGMT_VAR_LEN },
8467         { set_wideband_speech,     MGMT_SETTING_SIZE },
8468         { read_controller_cap,     MGMT_READ_CONTROLLER_CAP_SIZE,
8469                                                 HCI_MGMT_UNTRUSTED },
8470         { read_exp_features_info,  MGMT_READ_EXP_FEATURES_INFO_SIZE,
8471                                                 HCI_MGMT_UNTRUSTED |
8472                                                 HCI_MGMT_HDEV_OPTIONAL },
8473         { set_exp_feature,         MGMT_SET_EXP_FEATURE_SIZE,
8474                                                 HCI_MGMT_VAR_LEN |
8475                                                 HCI_MGMT_HDEV_OPTIONAL },
8476         { read_def_system_config,  MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
8477                                                 HCI_MGMT_UNTRUSTED },
8478         { set_def_system_config,   MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
8479                                                 HCI_MGMT_VAR_LEN },
8480         { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
8481                                                 HCI_MGMT_UNTRUSTED },
8482         { set_def_runtime_config,  MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
8483                                                 HCI_MGMT_VAR_LEN },
8484         { get_device_flags,        MGMT_GET_DEVICE_FLAGS_SIZE },
8485         { set_device_flags,        MGMT_SET_DEVICE_FLAGS_SIZE },
8486         { read_adv_mon_features,   MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
8487         { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
8488                                                 HCI_MGMT_VAR_LEN },
8489         { remove_adv_monitor,      MGMT_REMOVE_ADV_MONITOR_SIZE },
8490         { add_ext_adv_params,      MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
8491                                                 HCI_MGMT_VAR_LEN },
8492         { add_ext_adv_data,        MGMT_ADD_EXT_ADV_DATA_SIZE,
8493                                                 HCI_MGMT_VAR_LEN },
8494         { add_adv_patterns_monitor_rssi,
8495                                    MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
8496                                                 HCI_MGMT_VAR_LEN },
8497 };
8498
8499 void mgmt_index_added(struct hci_dev *hdev)
8500 {
8501         struct mgmt_ev_ext_index ev;
8502
8503         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8504                 return;
8505
8506         switch (hdev->dev_type) {
8507         case HCI_PRIMARY:
8508                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8509                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
8510                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8511                         ev.type = 0x01;
8512                 } else {
8513                         mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
8514                                          HCI_MGMT_INDEX_EVENTS);
8515                         ev.type = 0x00;
8516                 }
8517                 break;
8518         case HCI_AMP:
8519                 ev.type = 0x02;
8520                 break;
8521         default:
8522                 return;
8523         }
8524
8525         ev.bus = hdev->bus;
8526
8527         mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
8528                          HCI_MGMT_EXT_INDEX_EVENTS);
8529 }
8530
8531 void mgmt_index_removed(struct hci_dev *hdev)
8532 {
8533         struct mgmt_ev_ext_index ev;
8534         u8 status = MGMT_STATUS_INVALID_INDEX;
8535
8536         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8537                 return;
8538
8539         switch (hdev->dev_type) {
8540         case HCI_PRIMARY:
8541                 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8542
8543                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8544                         mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
8545                                          NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8546                         ev.type = 0x01;
8547                 } else {
8548                         mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
8549                                          HCI_MGMT_INDEX_EVENTS);
8550                         ev.type = 0x00;
8551                 }
8552                 break;
8553         case HCI_AMP:
8554                 ev.type = 0x02;
8555                 break;
8556         default:
8557                 return;
8558         }
8559
8560         ev.bus = hdev->bus;
8561
8562         mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
8563                          HCI_MGMT_EXT_INDEX_EVENTS);
8564 }
8565
8566 /* This function requires the caller holds hdev->lock */
8567 static void restart_le_actions(struct hci_dev *hdev)
8568 {
8569         struct hci_conn_params *p;
8570
8571         list_for_each_entry(p, &hdev->le_conn_params, list) {
8572                 /* Needed for AUTO_OFF case where might not "really"
8573                  * have been powered off.
8574                  */
8575                 list_del_init(&p->action);
8576
8577                 switch (p->auto_connect) {
8578                 case HCI_AUTO_CONN_DIRECT:
8579                 case HCI_AUTO_CONN_ALWAYS:
8580                         list_add(&p->action, &hdev->pend_le_conns);
8581                         break;
8582                 case HCI_AUTO_CONN_REPORT:
8583                         list_add(&p->action, &hdev->pend_le_reports);
8584                         break;
8585                 default:
8586                         break;
8587                 }
8588         }
8589 }
8590
8591 void mgmt_power_on(struct hci_dev *hdev, int err)
8592 {
8593         struct cmd_lookup match = { NULL, hdev };
8594
8595         bt_dev_dbg(hdev, "err %d", err);
8596
8597         hci_dev_lock(hdev);
8598
8599         if (!err) {
8600                 restart_le_actions(hdev);
8601                 hci_update_background_scan(hdev);
8602         }
8603
8604         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8605
8606         new_settings(hdev, match.sk);
8607
8608         if (match.sk)
8609                 sock_put(match.sk);
8610
8611         hci_dev_unlock(hdev);
8612 }
8613
8614 void __mgmt_power_off(struct hci_dev *hdev)
8615 {
8616         struct cmd_lookup match = { NULL, hdev };
8617         u8 status, zero_cod[] = { 0, 0, 0 };
8618
8619         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8620
8621         /* If the power off is because of hdev unregistration let
8622          * use the appropriate INVALID_INDEX status. Otherwise use
8623          * NOT_POWERED. We cover both scenarios here since later in
8624          * mgmt_index_removed() any hci_conn callbacks will have already
8625          * been triggered, potentially causing misleading DISCONNECTED
8626          * status responses.
8627          */
8628         if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
8629                 status = MGMT_STATUS_INVALID_INDEX;
8630         else
8631                 status = MGMT_STATUS_NOT_POWERED;
8632
8633         mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8634
8635         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
8636                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8637                                    zero_cod, sizeof(zero_cod),
8638                                    HCI_MGMT_DEV_CLASS_EVENTS, NULL);
8639                 ext_info_changed(hdev, NULL);
8640         }
8641
8642         new_settings(hdev, match.sk);
8643
8644         if (match.sk)
8645                 sock_put(match.sk);
8646 }
8647
8648 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
8649 {
8650         struct mgmt_pending_cmd *cmd;
8651         u8 status;
8652
8653         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8654         if (!cmd)
8655                 return;
8656
8657         if (err == -ERFKILL)
8658                 status = MGMT_STATUS_RFKILLED;
8659         else
8660                 status = MGMT_STATUS_FAILED;
8661
8662         mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
8663
8664         mgmt_pending_remove(cmd);
8665 }
8666
8667 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
8668                        bool persistent)
8669 {
8670         struct mgmt_ev_new_link_key ev;
8671
8672         memset(&ev, 0, sizeof(ev));
8673
8674         ev.store_hint = persistent;
8675         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8676         ev.key.addr.type = BDADDR_BREDR;
8677         ev.key.type = key->type;
8678         memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
8679         ev.key.pin_len = key->pin_len;
8680
8681         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
8682 }
8683
8684 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
8685 {
8686         switch (ltk->type) {
8687         case SMP_LTK:
8688         case SMP_LTK_RESPONDER:
8689                 if (ltk->authenticated)
8690                         return MGMT_LTK_AUTHENTICATED;
8691                 return MGMT_LTK_UNAUTHENTICATED;
8692         case SMP_LTK_P256:
8693                 if (ltk->authenticated)
8694                         return MGMT_LTK_P256_AUTH;
8695                 return MGMT_LTK_P256_UNAUTH;
8696         case SMP_LTK_P256_DEBUG:
8697                 return MGMT_LTK_P256_DEBUG;
8698         }
8699
8700         return MGMT_LTK_UNAUTHENTICATED;
8701 }
8702
8703 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
8704 {
8705         struct mgmt_ev_new_long_term_key ev;
8706
8707         memset(&ev, 0, sizeof(ev));
8708
8709         /* Devices using resolvable or non-resolvable random addresses
8710          * without providing an identity resolving key don't require
8711          * to store long term keys. Their addresses will change the
8712          * next time around.
8713          *
8714          * Only when a remote device provides an identity address
8715          * make sure the long term key is stored. If the remote
8716          * identity is known, the long term keys are internally
8717          * mapped to the identity address. So allow static random
8718          * and public addresses here.
8719          */
8720         if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8721             (key->bdaddr.b[5] & 0xc0) != 0xc0)
8722                 ev.store_hint = 0x00;
8723         else
8724                 ev.store_hint = persistent;
8725
8726         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8727         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
8728         ev.key.type = mgmt_ltk_type(key);
8729         ev.key.enc_size = key->enc_size;
8730         ev.key.ediv = key->ediv;
8731         ev.key.rand = key->rand;
8732
8733         if (key->type == SMP_LTK)
8734                 ev.key.initiator = 1;
8735
8736         /* Make sure we copy only the significant bytes based on the
8737          * encryption key size, and set the rest of the value to zeroes.
8738          */
8739         memcpy(ev.key.val, key->val, key->enc_size);
8740         memset(ev.key.val + key->enc_size, 0,
8741                sizeof(ev.key.val) - key->enc_size);
8742
8743         mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
8744 }
8745
8746 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
8747 {
8748         struct mgmt_ev_new_irk ev;
8749
8750         memset(&ev, 0, sizeof(ev));
8751
8752         ev.store_hint = persistent;
8753
8754         bacpy(&ev.rpa, &irk->rpa);
8755         bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
8756         ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
8757         memcpy(ev.irk.val, irk->val, sizeof(irk->val));
8758
8759         mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
8760 }
8761
8762 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
8763                    bool persistent)
8764 {
8765         struct mgmt_ev_new_csrk ev;
8766
8767         memset(&ev, 0, sizeof(ev));
8768
8769         /* Devices using resolvable or non-resolvable random addresses
8770          * without providing an identity resolving key don't require
8771          * to store signature resolving keys. Their addresses will change
8772          * the next time around.
8773          *
8774          * Only when a remote device provides an identity address
8775          * make sure the signature resolving key is stored. So allow
8776          * static random and public addresses here.
8777          */
8778         if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8779             (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
8780                 ev.store_hint = 0x00;
8781         else
8782                 ev.store_hint = persistent;
8783
8784         bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
8785         ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
8786         ev.key.type = csrk->type;
8787         memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
8788
8789         mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
8790 }
8791
8792 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
8793                          u8 bdaddr_type, u8 store_hint, u16 min_interval,
8794                          u16 max_interval, u16 latency, u16 timeout)
8795 {
8796         struct mgmt_ev_new_conn_param ev;
8797
8798         if (!hci_is_identity_address(bdaddr, bdaddr_type))
8799                 return;
8800
8801         memset(&ev, 0, sizeof(ev));
8802         bacpy(&ev.addr.bdaddr, bdaddr);
8803         ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
8804         ev.store_hint = store_hint;
8805         ev.min_interval = cpu_to_le16(min_interval);
8806         ev.max_interval = cpu_to_le16(max_interval);
8807         ev.latency = cpu_to_le16(latency);
8808         ev.timeout = cpu_to_le16(timeout);
8809
8810         mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
8811 }
8812
8813 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
8814                            u8 *name, u8 name_len)
8815 {
8816         char buf[512];
8817         struct mgmt_ev_device_connected *ev = (void *) buf;
8818         u16 eir_len = 0;
8819         u32 flags = 0;
8820
8821         bacpy(&ev->addr.bdaddr, &conn->dst);
8822         ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8823
8824         if (conn->out)
8825                 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
8826
8827         ev->flags = __cpu_to_le32(flags);
8828
8829         /* We must ensure that the EIR Data fields are ordered and
8830          * unique. Keep it simple for now and avoid the problem by not
8831          * adding any BR/EDR data to the LE adv.
8832          */
8833         if (conn->le_adv_data_len > 0) {
8834                 memcpy(&ev->eir[eir_len],
8835                        conn->le_adv_data, conn->le_adv_data_len);
8836                 eir_len = conn->le_adv_data_len;
8837         } else {
8838                 if (name_len > 0)
8839                         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
8840                                                   name, name_len);
8841
8842                 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
8843                         eir_len = eir_append_data(ev->eir, eir_len,
8844                                                   EIR_CLASS_OF_DEV,
8845                                                   conn->dev_class, 3);
8846         }
8847
8848         ev->eir_len = cpu_to_le16(eir_len);
8849
8850         mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
8851                     sizeof(*ev) + eir_len, NULL);
8852 }
8853
8854 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8855 {
8856         struct sock **sk = data;
8857
8858         cmd->cmd_complete(cmd, 0);
8859
8860         *sk = cmd->sk;
8861         sock_hold(*sk);
8862
8863         mgmt_pending_remove(cmd);
8864 }
8865
8866 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
8867 {
8868         struct hci_dev *hdev = data;
8869         struct mgmt_cp_unpair_device *cp = cmd->param;
8870
8871         device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
8872
8873         cmd->cmd_complete(cmd, 0);
8874         mgmt_pending_remove(cmd);
8875 }
8876
8877 bool mgmt_powering_down(struct hci_dev *hdev)
8878 {
8879         struct mgmt_pending_cmd *cmd;
8880         struct mgmt_mode *cp;
8881
8882         cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8883         if (!cmd)
8884                 return false;
8885
8886         cp = cmd->param;
8887         if (!cp->val)
8888                 return true;
8889
8890         return false;
8891 }
8892
8893 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
8894                               u8 link_type, u8 addr_type, u8 reason,
8895                               bool mgmt_connected)
8896 {
8897         struct mgmt_ev_device_disconnected ev;
8898         struct sock *sk = NULL;
8899
8900         /* The connection is still in hci_conn_hash so test for 1
8901          * instead of 0 to know if this is the last one.
8902          */
8903         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8904                 cancel_delayed_work(&hdev->power_off);
8905                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8906         }
8907
8908         if (!mgmt_connected)
8909                 return;
8910
8911         if (link_type != ACL_LINK && link_type != LE_LINK)
8912                 return;
8913
8914         mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
8915
8916         bacpy(&ev.addr.bdaddr, bdaddr);
8917         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8918         ev.reason = reason;
8919
8920         /* Report disconnects due to suspend */
8921         if (hdev->suspended)
8922                 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
8923
8924         mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8925
8926         if (sk)
8927                 sock_put(sk);
8928
8929         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8930                              hdev);
8931 }
8932
8933 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8934                             u8 link_type, u8 addr_type, u8 status)
8935 {
8936         u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8937         struct mgmt_cp_disconnect *cp;
8938         struct mgmt_pending_cmd *cmd;
8939
8940         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8941                              hdev);
8942
8943         cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8944         if (!cmd)
8945                 return;
8946
8947         cp = cmd->param;
8948
8949         if (bacmp(bdaddr, &cp->addr.bdaddr))
8950                 return;
8951
8952         if (cp->addr.type != bdaddr_type)
8953                 return;
8954
8955         cmd->cmd_complete(cmd, mgmt_status(status));
8956         mgmt_pending_remove(cmd);
8957 }
8958
8959 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8960                          u8 addr_type, u8 status)
8961 {
8962         struct mgmt_ev_connect_failed ev;
8963
8964         /* The connection is still in hci_conn_hash so test for 1
8965          * instead of 0 to know if this is the last one.
8966          */
8967         if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8968                 cancel_delayed_work(&hdev->power_off);
8969                 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8970         }
8971
8972         bacpy(&ev.addr.bdaddr, bdaddr);
8973         ev.addr.type = link_to_bdaddr(link_type, addr_type);
8974         ev.status = mgmt_status(status);
8975
8976         mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
8977 }
8978
8979 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
8980 {
8981         struct mgmt_ev_pin_code_request ev;
8982
8983         bacpy(&ev.addr.bdaddr, bdaddr);
8984         ev.addr.type = BDADDR_BREDR;
8985         ev.secure = secure;
8986
8987         mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
8988 }
8989
8990 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8991                                   u8 status)
8992 {
8993         struct mgmt_pending_cmd *cmd;
8994
8995         cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
8996         if (!cmd)
8997                 return;
8998
8999         cmd->cmd_complete(cmd, mgmt_status(status));
9000         mgmt_pending_remove(cmd);
9001 }
9002
9003 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9004                                       u8 status)
9005 {
9006         struct mgmt_pending_cmd *cmd;
9007
9008         cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
9009         if (!cmd)
9010                 return;
9011
9012         cmd->cmd_complete(cmd, mgmt_status(status));
9013         mgmt_pending_remove(cmd);
9014 }
9015
9016 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9017                               u8 link_type, u8 addr_type, u32 value,
9018                               u8 confirm_hint)
9019 {
9020         struct mgmt_ev_user_confirm_request ev;
9021
9022         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9023
9024         bacpy(&ev.addr.bdaddr, bdaddr);
9025         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9026         ev.confirm_hint = confirm_hint;
9027         ev.value = cpu_to_le32(value);
9028
9029         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
9030                           NULL);
9031 }
9032
9033 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
9034                               u8 link_type, u8 addr_type)
9035 {
9036         struct mgmt_ev_user_passkey_request ev;
9037
9038         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9039
9040         bacpy(&ev.addr.bdaddr, bdaddr);
9041         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9042
9043         return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
9044                           NULL);
9045 }
9046
9047 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9048                                       u8 link_type, u8 addr_type, u8 status,
9049                                       u8 opcode)
9050 {
9051         struct mgmt_pending_cmd *cmd;
9052
9053         cmd = pending_find(opcode, hdev);
9054         if (!cmd)
9055                 return -ENOENT;
9056
9057         cmd->cmd_complete(cmd, mgmt_status(status));
9058         mgmt_pending_remove(cmd);
9059
9060         return 0;
9061 }
9062
9063 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9064                                      u8 link_type, u8 addr_type, u8 status)
9065 {
9066         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9067                                           status, MGMT_OP_USER_CONFIRM_REPLY);
9068 }
9069
9070 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9071                                          u8 link_type, u8 addr_type, u8 status)
9072 {
9073         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9074                                           status,
9075                                           MGMT_OP_USER_CONFIRM_NEG_REPLY);
9076 }
9077
9078 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9079                                      u8 link_type, u8 addr_type, u8 status)
9080 {
9081         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9082                                           status, MGMT_OP_USER_PASSKEY_REPLY);
9083 }
9084
9085 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
9086                                          u8 link_type, u8 addr_type, u8 status)
9087 {
9088         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
9089                                           status,
9090                                           MGMT_OP_USER_PASSKEY_NEG_REPLY);
9091 }
9092
9093 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
9094                              u8 link_type, u8 addr_type, u32 passkey,
9095                              u8 entered)
9096 {
9097         struct mgmt_ev_passkey_notify ev;
9098
9099         bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
9100
9101         bacpy(&ev.addr.bdaddr, bdaddr);
9102         ev.addr.type = link_to_bdaddr(link_type, addr_type);
9103         ev.passkey = __cpu_to_le32(passkey);
9104         ev.entered = entered;
9105
9106         return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
9107 }
9108
9109 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
9110 {
9111         struct mgmt_ev_auth_failed ev;
9112         struct mgmt_pending_cmd *cmd;
9113         u8 status = mgmt_status(hci_status);
9114
9115         bacpy(&ev.addr.bdaddr, &conn->dst);
9116         ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
9117         ev.status = status;
9118
9119         cmd = find_pairing(conn);
9120
9121         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
9122                     cmd ? cmd->sk : NULL);
9123
9124         if (cmd) {
9125                 cmd->cmd_complete(cmd, status);
9126                 mgmt_pending_remove(cmd);
9127         }
9128 }
9129
9130 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
9131 {
9132         struct cmd_lookup match = { NULL, hdev };
9133         bool changed;
9134
9135         if (status) {
9136                 u8 mgmt_err = mgmt_status(status);
9137                 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
9138                                      cmd_status_rsp, &mgmt_err);
9139                 return;
9140         }
9141
9142         if (test_bit(HCI_AUTH, &hdev->flags))
9143                 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
9144         else
9145                 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
9146
9147         mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
9148                              &match);
9149
9150         if (changed)
9151                 new_settings(hdev, match.sk);
9152
9153         if (match.sk)
9154                 sock_put(match.sk);
9155 }
9156
9157 static void clear_eir(struct hci_request *req)
9158 {
9159         struct hci_dev *hdev = req->hdev;
9160         struct hci_cp_write_eir cp;
9161
9162         if (!lmp_ext_inq_capable(hdev))
9163                 return;
9164
9165         memset(hdev->eir, 0, sizeof(hdev->eir));
9166
9167         memset(&cp, 0, sizeof(cp));
9168
9169         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
9170 }
9171
9172 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
9173 {
9174         struct cmd_lookup match = { NULL, hdev };
9175         struct hci_request req;
9176         bool changed = false;
9177
9178         if (status) {
9179                 u8 mgmt_err = mgmt_status(status);
9180
9181                 if (enable && hci_dev_test_and_clear_flag(hdev,
9182                                                           HCI_SSP_ENABLED)) {
9183                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
9184                         new_settings(hdev, NULL);
9185                 }
9186
9187                 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
9188                                      &mgmt_err);
9189                 return;
9190         }
9191
9192         if (enable) {
9193                 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
9194         } else {
9195                 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9196                 if (!changed)
9197                         changed = hci_dev_test_and_clear_flag(hdev,
9198                                                               HCI_HS_ENABLED);
9199                 else
9200                         hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
9201         }
9202
9203         mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
9204
9205         if (changed)
9206                 new_settings(hdev, match.sk);
9207
9208         if (match.sk)
9209                 sock_put(match.sk);
9210
9211         hci_req_init(&req, hdev);
9212
9213         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
9214                 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
9215                         hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
9216                                     sizeof(enable), &enable);
9217                 __hci_req_update_eir(&req);
9218         } else {
9219                 clear_eir(&req);
9220         }
9221
9222         hci_req_run(&req, NULL);
9223 }
9224
9225 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
9226 {
9227         struct cmd_lookup *match = data;
9228
9229         if (match->sk == NULL) {
9230                 match->sk = cmd->sk;
9231                 sock_hold(match->sk);
9232         }
9233 }
9234
9235 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
9236                                     u8 status)
9237 {
9238         struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
9239
9240         mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
9241         mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
9242         mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
9243
9244         if (!status) {
9245                 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
9246                                    3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9247                 ext_info_changed(hdev, NULL);
9248         }
9249
9250         if (match.sk)
9251                 sock_put(match.sk);
9252 }
9253
9254 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
9255 {
9256         struct mgmt_cp_set_local_name ev;
9257         struct mgmt_pending_cmd *cmd;
9258
9259         if (status)
9260                 return;
9261
9262         memset(&ev, 0, sizeof(ev));
9263         memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
9264         memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
9265
9266         cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
9267         if (!cmd) {
9268                 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
9269
9270                 /* If this is a HCI command related to powering on the
9271                  * HCI dev don't send any mgmt signals.
9272                  */
9273                 if (pending_find(MGMT_OP_SET_POWERED, hdev))
9274                         return;
9275         }
9276
9277         mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
9278                            HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
9279         ext_info_changed(hdev, cmd ? cmd->sk : NULL);
9280 }
9281
9282 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
9283 {
9284         int i;
9285
9286         for (i = 0; i < uuid_count; i++) {
9287                 if (!memcmp(uuid, uuids[i], 16))
9288                         return true;
9289         }
9290
9291         return false;
9292 }
9293
9294 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
9295 {
9296         u16 parsed = 0;
9297
9298         while (parsed < eir_len) {
9299                 u8 field_len = eir[0];
9300                 u8 uuid[16];
9301                 int i;
9302
9303                 if (field_len == 0)
9304                         break;
9305
9306                 if (eir_len - parsed < field_len + 1)
9307                         break;
9308
9309                 switch (eir[1]) {
9310                 case EIR_UUID16_ALL:
9311                 case EIR_UUID16_SOME:
9312                         for (i = 0; i + 3 <= field_len; i += 2) {
9313                                 memcpy(uuid, bluetooth_base_uuid, 16);
9314                                 uuid[13] = eir[i + 3];
9315                                 uuid[12] = eir[i + 2];
9316                                 if (has_uuid(uuid, uuid_count, uuids))
9317                                         return true;
9318                         }
9319                         break;
9320                 case EIR_UUID32_ALL:
9321                 case EIR_UUID32_SOME:
9322                         for (i = 0; i + 5 <= field_len; i += 4) {
9323                                 memcpy(uuid, bluetooth_base_uuid, 16);
9324                                 uuid[15] = eir[i + 5];
9325                                 uuid[14] = eir[i + 4];
9326                                 uuid[13] = eir[i + 3];
9327                                 uuid[12] = eir[i + 2];
9328                                 if (has_uuid(uuid, uuid_count, uuids))
9329                                         return true;
9330                         }
9331                         break;
9332                 case EIR_UUID128_ALL:
9333                 case EIR_UUID128_SOME:
9334                         for (i = 0; i + 17 <= field_len; i += 16) {
9335                                 memcpy(uuid, eir + i + 2, 16);
9336                                 if (has_uuid(uuid, uuid_count, uuids))
9337                                         return true;
9338                         }
9339                         break;
9340                 }
9341
9342                 parsed += field_len + 1;
9343                 eir += field_len + 1;
9344         }
9345
9346         return false;
9347 }
9348
9349 static void restart_le_scan(struct hci_dev *hdev)
9350 {
9351         /* If controller is not scanning we are done. */
9352         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
9353                 return;
9354
9355         if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
9356                        hdev->discovery.scan_start +
9357                        hdev->discovery.scan_duration))
9358                 return;
9359
9360         queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
9361                            DISCOV_LE_RESTART_DELAY);
9362 }
9363
9364 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
9365                             u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9366 {
9367         /* If a RSSI threshold has been specified, and
9368          * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
9369          * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
9370          * is set, let it through for further processing, as we might need to
9371          * restart the scan.
9372          *
9373          * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
9374          * the results are also dropped.
9375          */
9376         if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9377             (rssi == HCI_RSSI_INVALID ||
9378             (rssi < hdev->discovery.rssi &&
9379              !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
9380                 return  false;
9381
9382         if (hdev->discovery.uuid_count != 0) {
9383                 /* If a list of UUIDs is provided in filter, results with no
9384                  * matching UUID should be dropped.
9385                  */
9386                 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
9387                                    hdev->discovery.uuids) &&
9388                     !eir_has_uuids(scan_rsp, scan_rsp_len,
9389                                    hdev->discovery.uuid_count,
9390                                    hdev->discovery.uuids))
9391                         return false;
9392         }
9393
9394         /* If duplicate filtering does not report RSSI changes, then restart
9395          * scanning to ensure updated result with updated RSSI values.
9396          */
9397         if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
9398                 restart_le_scan(hdev);
9399
9400                 /* Validate RSSI value against the RSSI threshold once more. */
9401                 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9402                     rssi < hdev->discovery.rssi)
9403                         return false;
9404         }
9405
9406         return true;
9407 }
9408
9409 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9410                        u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9411                        u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9412 {
9413         char buf[512];
9414         struct mgmt_ev_device_found *ev = (void *)buf;
9415         size_t ev_size;
9416
9417         /* Don't send events for a non-kernel initiated discovery. With
9418          * LE one exception is if we have pend_le_reports > 0 in which
9419          * case we're doing passive scanning and want these events.
9420          */
9421         if (!hci_discovery_active(hdev)) {
9422                 if (link_type == ACL_LINK)
9423                         return;
9424                 if (link_type == LE_LINK &&
9425                     list_empty(&hdev->pend_le_reports) &&
9426                     !hci_is_adv_monitoring(hdev)) {
9427                         return;
9428                 }
9429         }
9430
9431         if (hdev->discovery.result_filtering) {
9432                 /* We are using service discovery */
9433                 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
9434                                      scan_rsp_len))
9435                         return;
9436         }
9437
9438         if (hdev->discovery.limited) {
9439                 /* Check for limited discoverable bit */
9440                 if (dev_class) {
9441                         if (!(dev_class[1] & 0x20))
9442                                 return;
9443                 } else {
9444                         u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
9445                         if (!flags || !(flags[0] & LE_AD_LIMITED))
9446                                 return;
9447                 }
9448         }
9449
9450         /* Make sure that the buffer is big enough. The 5 extra bytes
9451          * are for the potential CoD field.
9452          */
9453         if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9454                 return;
9455
9456         memset(buf, 0, sizeof(buf));
9457
9458         /* In case of device discovery with BR/EDR devices (pre 1.2), the
9459          * RSSI value was reported as 0 when not available. This behavior
9460          * is kept when using device discovery. This is required for full
9461          * backwards compatibility with the API.
9462          *
9463          * However when using service discovery, the value 127 will be
9464          * returned when the RSSI is not available.
9465          */
9466         if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
9467             link_type == ACL_LINK)
9468                 rssi = 0;
9469
9470         bacpy(&ev->addr.bdaddr, bdaddr);
9471         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9472         ev->rssi = rssi;
9473         ev->flags = cpu_to_le32(flags);
9474
9475         if (eir_len > 0)
9476                 /* Copy EIR or advertising data into event */
9477                 memcpy(ev->eir, eir, eir_len);
9478
9479         if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9480                                        NULL))
9481                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9482                                           dev_class, 3);
9483
9484         if (scan_rsp_len > 0)
9485                 /* Append scan response data to event */
9486                 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9487
9488         ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9489         ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9490
9491         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9492 }
9493
9494 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9495                       u8 addr_type, s8 rssi, u8 *name, u8 name_len)
9496 {
9497         struct mgmt_ev_device_found *ev;
9498         char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
9499         u16 eir_len;
9500
9501         ev = (struct mgmt_ev_device_found *) buf;
9502
9503         memset(buf, 0, sizeof(buf));
9504
9505         bacpy(&ev->addr.bdaddr, bdaddr);
9506         ev->addr.type = link_to_bdaddr(link_type, addr_type);
9507         ev->rssi = rssi;
9508
9509         eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9510                                   name_len);
9511
9512         ev->eir_len = cpu_to_le16(eir_len);
9513
9514         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
9515 }
9516
9517 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
9518 {
9519         struct mgmt_ev_discovering ev;
9520
9521         bt_dev_dbg(hdev, "discovering %u", discovering);
9522
9523         memset(&ev, 0, sizeof(ev));
9524         ev.type = hdev->discovery.type;
9525         ev.discovering = discovering;
9526
9527         mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9528 }
9529
9530 void mgmt_suspending(struct hci_dev *hdev, u8 state)
9531 {
9532         struct mgmt_ev_controller_suspend ev;
9533
9534         ev.suspend_state = state;
9535         mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
9536 }
9537
9538 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
9539                    u8 addr_type)
9540 {
9541         struct mgmt_ev_controller_resume ev;
9542
9543         ev.wake_reason = reason;
9544         if (bdaddr) {
9545                 bacpy(&ev.addr.bdaddr, bdaddr);
9546                 ev.addr.type = addr_type;
9547         } else {
9548                 memset(&ev.addr, 0, sizeof(ev.addr));
9549         }
9550
9551         mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
9552 }
9553
9554 static struct hci_mgmt_chan chan = {
9555         .channel        = HCI_CHANNEL_CONTROL,
9556         .handler_count  = ARRAY_SIZE(mgmt_handlers),
9557         .handlers       = mgmt_handlers,
9558         .hdev_init      = mgmt_init_hdev,
9559 };
9560
9561 int mgmt_init(void)
9562 {
9563         return hci_mgmt_chan_register(&chan);
9564 }
9565
9566 void mgmt_exit(void)
9567 {
9568         hci_mgmt_chan_unregister(&chan);
9569 }